Behavior Statistic based Neural Net Anti-spam Filters

Abstract

Current methods for detecting email system mostly work by examining characteristic of incoming messages. Spam detectors calculate statistical features on received email for classification usually dealing with corpus composed of messages from several distinct users. Thus it is not possible to profile that user’s behavior. To characterize the user’s normal email behavior the outgoing email traffic can be observed, after which abnormal behavior caused by a compromised machine can be detected and contained at the source. The effectiveness of feature selection can be seen in the performance of abnormal mail sending detection via different structure classifiers, and the best results from our data set was reached applying Naive Bayes statistical method. There are also discovered that increasing feature set, the accuracy of classifiers doesn’t changes or even reduces. For false positive reduction and gaining classifier accuracy it is essential to combine several distinct methods of user based behavior and content analysis over bidirectional mail traffic. It could form an extremely strong defense against the spread of spam. Ill. 6, bibl. 7 (in English, summaries in English, Russian and Lithuanian).