Improving spam detection using fingerprinting at packet level

Abstract

Spam has grown as fast as the Internet growth and has evolved from mere annoying to a multi-billion dollar problem. Spam generates enormous amount of email traffic that is time consuming to handle and has caused the average Internet users the loss of resources. As the countermeasures to spam, various techniques have been proposed. The current content-based spam detectors that work on fully reassembled emails at mail servers and end host machines require long processing time. The recent work on spam detection to overcome this drawback is proposed at the network layer by using fingerprints matching that detects spam by determining similarity between emails. This improved detection mechanism applied at the lower abstraction level reduces the complexity of email processing hence promises fast spam detection over network nodes. This project report further investigates the detection mechanism by evaluating its accuracy and implementation constraints on the network layer. The experimental evaluations are extended to demonstrate the analysis based on two control parameters: packet sizes and Nilsimsa Compare Value (NCV) thresholds. Based on the observed results, this project report proposes possible solutions for arising issues such as the risk of message misclassification, the optimized NCV threshold and implementation architecture on the network layer.