Universiti Teknologi Malaysia Institutional Repository

Packet-level open-digest fingerprinting for spam detection of middleboxes

Marsono, Muhammad Nadzir (2012) Packet-level open-digest fingerprinting for spam detection of middleboxes. International Journal of Network Management, 22 . pp. 1-26. ISSN 1055-7148

Full text not available from this repository.

Official URL: http://dx.doi.org/10.1002/nem.780

Abstract

This paper proposes a stateless open‐digest spam fingerprinting at the packet level (layer 3) based on an open‐digest fingerprinting algorithm Nilsimsa. Spam emails show several characteristics when viewed at gateway level, which are suitable for spam fingerprinting: (a) content invariance and (b) recipient address dispersion. In this paper, Nilsimsa is adapted to support both fingerprinting and fast email class estimation, on a per‐packet basis. Email packets are incrementally fingerprinted on a per‐packet basis, without the need for reassembly. Spam detection status is tagged to the last packet of each email. This in turn allows fast email class estimation (spam detection) at receiving email servers to support more effective spam handling on both inbound and outbound (relayed) emails. The work presented in this paper focuses on evaluating the accuracy of spam fingerprinting at the packet level with consideration on the constraints of processing byte streams over the network, including packet reordering, fragmentation, overlapped bytes, different packet sizes, and possibilities of random addition attacks. Results show that the proposed packet‐level fingerprinting can detect spam with 100% random addition when the similarity threshold is set to between 36 and 59. This method gives 0% false positive and 100% true negative, which equals the performance attained for spam fingerprinting at full email abstraction (layer 7). This shows that classifying emails at the packet level can differentiate non‐spam from spam with high confidence for a viable spam control implementation on middleboxes.

Item Type:Article
Uncontrolled Keywords:open‐digest fingerprinting, Nilsimsa, fragmentation
Subjects:Q Science > QA Mathematics > QA76 Computer software
Divisions:Electrical Engineering
ID Code:47343
Deposited By: Narimah Nawil
Deposited On:22 Jun 2015 05:56
Last Modified:25 Apr 2019 01:18

Repository Staff Only: item control page