Identification of attack/misuse with email header forensic

Abstract

Email becomes important communication nowadays; it was used in government sector, education sector, business sector and others. Because of its popularity it attracts offenders to commit crime in email communication. This study focuses on one type of email crime; spam email. Three popular webmail was choose namely as Hotmail, Gmail and Yahoo mail. Spam email was sent to each webmail to see the accuracy of each webmail in detecting the spam email. The results show Hotmail, Gmail and Yahoo mail are lack of accuracy in detecting those spam email. All spam emails was collected and information contained in the email header was analyze. Previous studies believe mismatch or forging information in the email header may indicate the behavior of spam emails. New email header forgery detection mechanism was developed to check mismatch or forging information in the email header. This study focus on the information contained in the Message-ID, Reply-To, From and Received field. Any mismatch or forging information in this field may indicate the behavior of spam emails. The mechanism will classify those emails that have mismatch or forging information in that particular features as spam emails instead classify as legitimate email since Hotmail, Gmail and Yahoo mail classified those spam email as legitimate email.