Volume Of Spam Research Articles

Analyzing Privacy and Security in Cloud Computing Environments

With the rapid surge of spam across the Internet and its various forms, effectively identifying and combating spam has become an urgent priority. Cloud computing offers significant advantages in terms of storage and processing capabilities, making it a viable solution for analysing vast amounts of email data. To address the dynamic nature of spam and its life cycle, an anti-spam system with feedback reassessment is proposed. This system incorporates a text filtering approach based on active learning, involving four key stages: training, filtering, feedback, and re-filtering. Compared to traditional systems, the feedback-enabled filtering system demonstrates improved keyword filtering. To further enhance the accuracy of spam detection and minimize misjudgements in legitimate emails, leveraging weighted decision-making based on email header information is recommended. Additionally, for emails with sparse content, employing title weighting in the filtering process proves to be both feasible and effective, particularly in identifying spam with minimal text content. Given the advancements of cloud-based filtering methods over traditional algorithms, leveraging cloud computing holds promise in effectively combating the escalating volume of spam. As such, this paper delves into an in-depth exploration of spam identification within cloud computing environments, focusing on text filtering systems. This study is informed by a comprehensive analysis of existing anti-spam technologies, aiming to contribute to the ongoing efforts in mitigating spam proliferation online.

Stability and Effective Process Control for Secure Email Filtering

A fantastic tool for both commercial and personal communication is electronic mail. It has increasingly become a necessary component of our working life since it is straightforward, available, and simple to use. Spam emails have started to tarnish internet experiences and threaten the integrity of email. Due to the exponential growth of spam, both people and organisations are under a great deal of financial and other strain. In order to prevent the future of email itself from being in jeopardy, a solution to the spam problem must be discovered. There is an urgent need to solve the Email spam issue since spam volume has been rising over the last several decades. As part of this effort, many effects of spam emails on businesses and people were noted and thoroughly examined. In order to properly assess current technologies, solutions, and methods, a comprehensive literature review was conducted throughout the procedures. The goals of this work is to develop new methodologies for the implementation of new strategies for the efficient management of email spam and to construct a proof-of-concept software system for the Process controlled assessment of such strategies.

Can It Clean Up Your Inbox? Evidence from South Korean Anti‐spam Legislation

Although spam email messages have been the primary source of cybercrime since the early Internet era, there is no quick fix to this problem. Governments have established anti‐spam legislation, but surprisingly, there has been no measurement of policy impact. This study aims to fill the gap by utilizing a quasi‐experimental setting in South Korea, where the anti‐spam policy was substantially amended in November 2014. A significant change was in the default setting, switching from an opt‐out to an opt‐in scheme, which required that commercial email senders obtain recipients' prior consent. Also, the law notably escalated the deterrent penalties for perpetrators. To empirically examine the policy effectiveness, we use a large‐scale data set of 5.61 billion spam emails originating from over 38,000 spammers in 226 countries during twenty months in 2014–2015. Our findings suggest that the amended policy adopting the opt‐in scheme decreased the volume of spam originating from Korea by 16.1%. The expected economic gain from the increased productivity of recipients is 7.649 million USD per year. This study contributes to the literature by highlighting that a well‐designed policy can lower cybersecurity incidents that threaten organizations, operations, and individuals. Our finding also provides important implications for policymakers and managers in designing effective policies with data‐driven evidence.

Information Disclosure and Security Vulnerability Awareness: A Large-Scale Randomized Field Experiment in Pan-Asia

This paper investigates how the awareness of a security vulnerability index affects firms’ security protection strategy and how the information awareness effect interacts with firm incentives and country-wide IT development level. The security index is constructed based on outgoing spams and phishing website hosting, which may serve as an indicator of a firm’s security controls. To study whether security vulnerability awareness causes firms to improve their security, we conducted a randomized field experiment on 1,262 firms in six Pan-Asian countries and regions. Among 631 randomly selected treated firms, we alerted them of their security vulnerability index and their relative rankings compared to their peers via advisory emails and websites. Difference-in-differences analyses show that compared with the controls, the treated firms improve their security over time, with a statistically significant reduction of outgoing spam volume according to one of the data sources but not phishing website hosting. However, a statistically significant reduction in phishing website hosting was observed among non-web hosting firms, suggesting that firms’ underlying incentives play an important role in the treatment effect. Lastly, exploiting the multi-country nature of the data, we found that firms in countries with high information and communications technology (ICT) development are more responsive to our intervention because they have higher IT capabilities and more resources to resolve security issues. Our study provides cybersecurity policymakers with useful insights on how firm incentives and ICT environments play roles in firms’ security measure adoption.

Understanding Security Vulnerability Awareness, Firm Incentives, and ICT Development in Pan-Asia

ABSTRACT This paper investigates how the awareness of a security vulnerability index affects firms’ security protection strategy and how the information awareness effect interacts with firm incentives and country-wide information technology (IT) development level. The security index is constructed based on outgoing spams and phishing website hosting, which may serve as an indicator of a firm’s security controls. To study whether security vulnerability awareness causes firms to improve their security, we conducted a randomized field experiment on 1,262 firms in six Pan-Asian countries and regions. Among 631 randomly selected treated firms, we alerted them of their security vulnerability index and their relative rankings compared to their peers via advisory emails and websites. Difference-in-differences analyses show that compared with the controls, the treated firms improve their security over time, with a statistically significant reduction of outgoing spam volume according to one of the data sources but not phishing website hosting. However, a statistically significant reduction in phishing website hosting was observed among non-web hosting firms, suggesting that firms’ underlying incentives play an important role in the treatment effect. Lastly, exploiting the multi-country nature of the data, we found that firms in countries with high information and communications technology (ICT) development are more responsive to our intervention because they have higher IT capabilities and more resources to resolve security issues. Our study provides cybersecurity policymakers with useful insights on how firm incentives and ICT environments play roles in firms’ security measure adoption.

Spam Detection on Social Media Using Semantic Convolutional Neural Network

This article describes how spam detection in the social media text is becoming increasing important because of the exponential increase in the spam volume over the network. It is challenging, especially in case of text within the limited number of characters. Effective spam detection requires more number of efficient features to be learned. In the current article, the use of a deep learning technology known as a convolutional neural network (CNN) is proposed for spam detection with an added semantic layer on the top of it. The resultant model is known as a semantic convolutional neural network (SCNN). A semantic layer is composed of training the random word vectors with the help of Word2vec to get the semantically enriched word embedding. WordNet and ConceptNet are used to find the word similar to a given word, in case it is missing in the word2vec. The architecture is evaluated on two corpora: SMS Spam dataset (UCI repository) and Twitter dataset (Tweets scrapped from public live tweets). The authors' approach outperforms the-state-of-the-art results with 98.65% accuracy on SMS spam dataset and 94.40% accuracy on Twitter dataset.

How would information disclosure influence organizations’ outbound spam volume? Evidence from a field experiment

Cyber-insecurity is a serious threat in the digital world. In the present paper, we argue that a suboptimal cybersecurity environment is partly due to organizations’ underinvestment on security and a lack of suitable policies. The motivation for this paper stems from a related policy question: how to design policies for governments and other organizations that can ensure a sufficient level of cybersecurity. We address the question by exploring a policy devised to alleviate information asymmetry and to achieve transparency in cybersecurity information sharing practice. We propose a cybersecurity evaluation agency along with regulations on information disclosure. To empirically evaluate the effectiveness of such an institution, we conduct a large-scale randomized field experiment on 7919 US organizations. Specifically, we generate organizations’ security reports based on their outbound spam relative to the industry peers, then share the reports with the subjects in either private or public ways. Using models for heterogeneous treatment effects and machine learning techniques, we find evidence from this experiment that the security information sharing combined with publicity treatment has significant effects on spam reduction for original large spammers. Moreover, significant peer effects are observed among industry peers after the experiment.

Text normalization and semantic indexing to enhance Instant Messaging and SMS spam filtering

The rapid popularization of smartphones has contributed to the growth of online Instant Messaging and SMS usage as an alternative way of communication. The increasing number of users, along with the trust they inherently have in their devices, makes such messages a propitious environment for spammers. In fact, reports clearly indicate that volume of spam over Instant Messaging and SMS is dramatically increasing year by year. It represents a challenging problem for traditional filtering methods nowadays, since such messages are usually fairly short and normally rife with slangs, idioms, symbols and acronyms that make even tokenization a difficult task. In this scenario, this paper proposes and then evaluates a method to normalize and expand original short and messy text messages in order to acquire better attributes and enhance the classification performance. The proposed text processing approach is based on lexicographic and semantic dictionaries along with state-of-the-art techniques for semantic analysis and context detection. This technique is used to normalize terms and create new attributes in order to change and expand original text samples aiming to alleviate factors that can degrade the algorithms performance, such as redundancies and inconsistencies. We have evaluated our approach with a public, real and non-encoded data-set along with several established machine learning methods. Our experiments were diligently designed to ensure statistically sound results which indicate that the proposed text processing techniques can in fact enhance Instant Messaging and SMS spam filtering.

Twitter spammer detection using data stream clustering

The rapid growth of Twitter has triggered a dramatic increase in spam volume and sophistication. The abuse of certain Twitter components such as “hashtags”, “mentions”, and shortened URLs enables spammers to operate efficiently. These same features, however, may be a key factor in identifying new spam accounts as shown in previous studies. Our study provides three novel contributions. Firstly, previous studies have approached spam detection as a classification problem, whereas we view it as an anomaly detection problem. Secondly, 95 one-gram features from tweet text were introduced alongside the user information analyzed in previous studies. Finally, to effectively handle the streaming nature of tweets, two stream clustering algorithms, StreamKM++ and DenStream, were modified to facilitate spam identification. Both algorithms clustered normal Twitter users, treating outliers as spammers. Each of these algorithms performed well individually, with StreamKM++ achieving 99% recall and a 6.4% false positive rate; and DenStream producing 99% recall and a 2.8% false positive rate. When used in conjunction, these algorithms reached 100% recall and a 2.2% false positive rate, meaning that our system was able to identify 100% of the spammers in our test while incorrectly detecting only 2.2% of normal users as spammers.

Reputation as Public Policy for Internet Security

Insufficient resource allocation causes an Internet information security (infosec) problem that public policy could improve. Lack of transparency lets organizations avoid ad- dressing internal risks, leaving vulnerabilities that are exploited by botnets, threatening information security of other Internet participants. Their protection provides no economic benefit to the firm, so this negative externality causes underinvestment in infosec. Public policy could provide a partial solution by adding incentives for organizations to have well-configured in- fosec. Specifically, mandatory reporting of security issues plus presenting this information to the public, can impose shame and fame on organizations through publicity and peer influence by comparison with major competitors. Outbound spam is a prominent symptom of poor infosec that this project uses as a proxy for overall security, mapping anti-spam blocklist IP addresses to organizations (1). Selected top outbound spam rankings publicized through SpamRankings.net have already produced positive pilot test results. Next we use field experiments to test the effects of information disclosure and the relative effectiveness of different information presentations. As the first of two objectives, we determine whether public ranking of spam can be an effective mechanism for encouraging firms to reduce outbound spam. Second, we explore the most effective ways of presenting information to the public to improve infosec. Our study serves as an assessment for the public policy of mandatory information disclosure. We use field experiments to aggregate company information within and between industries and analyze the results of presenting such information to the pub- lic. Field experiments have been used extensively in the analysis of public policy programs (2) (3). The experiments include design of an information system for public information disclosure and presentation to get public attention, to observe reactions, and to analyze the underlying mechanisms. This information system design can be extended to other problems to provide incentives for the decision makers of externality problems, such as pollution, energy saving, etc. A public information system enables inferring internal infosec based on observed outcome, and thus makes such information transparent and induces reputation for the decision makers: shame for producing negative externalities or fame for fixing or preventing them. Reputation internalizes externalities, encouraging decision makers to take socially optimal behavior. Because of the positive pilot test results, we propose conducting a full-scale randomized controlled trial based on the Spam- Rankings.net initiative. The purpose of a randomized controlled trial is to experimentally create individual research groups that are generally similar except that the groups receive different experimental treatments. So any differences that arise between the research groups subsequent to the treatments are due to the respective treatment. Randomized experiments thus avoid selection bias, producing high internal validity. For two full-scale experiments, we will identify a sample of companies by geographic units for which we have outgoing spam data, and randomly assign the companies by geographic unit to different groups. In the first experiment, we will randomly assign the companies to one of two groups: a treatment group whose spam statistics will be widely publicized and a control group without publicizing any spam information. This initial evaluation can examine whether the proposed policy can induce firms to reduce spam. Assuming success of the first experiment, the second will explore the most effective policy intervention, by randomly assigning company groups to different information presentations including absolute spam volume, ranking per country, and ranking per industry, to see what granularity of peer comparison has the most effect. This is the first publication of the details and the behavioral economics context of these experiments. Supported by NSF grant no. 0831338; the usual disclaimers apply.

Spam and Botnet Reputation Randomized Control Trials and Policy

Designing randomized control trials (RCT) of reputational effects of spam and botnet rankings as proxies for Internet security has interesting challenges. These challenges are related to the policy issues such reputation is intended to address. Building on preliminary results and the public SpamRankings.net top 10 rankings per country by spam volume from two anti-spam blocklists (see TPRC 2012 [1] and 2011 [2] papers), formal RCT experiments provide another level of evidence. However, using RCT with thousands of organizations in treatment and control groups raises numerous difficulties in non-homogeneous legal and organizational regimes and methods of active disclosure of comparable rankins across peer groups. Fortunately most of these difficulties can be turned to advantages, and all have policy implications. These complications compared to RCTs of more traditional econometric one-shot surveys with single publication arise because the subject of these field experiments is the live Internet in real time with ongoing updated treatments. The experimental treatments themselves act as information security (infosec), since their purpose is to use reputation to cause internal improvements in infosec in treated companies. treatments thus must adapt to changes in conditions in the Internet as they happen. Like other infosec, to be effective the treatments must also be portable across departments within treated organizations plus customers and investors, and the experimental team itself crosses Economics, Information Systems, and Computer Science. If the experiments demonstrate statistical evidence that this reputational approach works, such results will provide a new policy approach of reputational rankings, plus the beginnings of tools to apply that approach, ranging from the public treatments themselves to drilldowns into underlying details of the symptoms causing good or bad reputation. Difficulties encountered include: 1) Differing sensitivities of different blocklists to spam from certain sources; sensitivities that change over time as the blocklists adapt to new miscreant behavior. Approach: A weighted composite ranking based on both spam volume and spamming address count from at least two different blocklists. 2) Heterogeneity of legal regimes and other characteristics across countries. Approach: Initial experiments within a single country (the U.S.), perhaps followed by clustered RCT using countries as clusters. 3) Availability of organizational characterization information for stratification by industry (finance, medical, etc.) and within industry (ISPs or hosting, telephone company or cable company, etc.). Approach: Start with the U.S., for which this information is relatively readily available in homogeneous form. 4) Public visibility is necessary for reputation so that customers and investors of treated organizations can see the treatments, yet limits flexibility of experimental treatments, since an ongoing, regularly updated treatment once deployed is hard to retract. Approach: Start with a subset of the universe of spamming organizations and deploy more treatments for other organizations later, plus potential additional treatments for already-treated organizations, while tuning existing treatments like product releases. 5) Spammers or bot herders could choose to migrate away from treated organizations to untreated (control) organizations, interfering with independence of treated and control groups. Approach: Use botnet volume and address data to observe whether this actually happens (potential future work). 6) Miscreants may actively retaliate with DDoS or other attacks. Approach: Harden the treatment websites by hosting them in a cloud provided by a very large organization. 7) Many of the most relevant and we think potentially effective features of this work are nonobvious to many persons skilled in various arts indigenous to at least seven major markets the work must reach, in academia, inside the treated organizations, and in governance. Designing marketing materials and interaction methods to make the nonobvious obvious is a major part of this work. Specifically, drawing connections from spam as a proxy for underlying security issues to organizational benefits of reputational rankings to societal benefits of active disclosure is quite a challenge for a tiny research organization simulating the sales and marketing (and engineering) departments of a large corporation. Approach: Model on rankings comprehensible to everyone (sports scores), use analogies, emphasize benefits, tailor to specific markets where necessary, provide writeups on the most nonobvious features, such as active vs. passive/disclosure. This series of experiments is supported by NSF grants 1228990 and 0831338, and the usual disclaimers apply.

Cloud computing-based forensic analysis for collaborative network security management system

Internet security problems remain a major challenge with many security concerns such as Internet worms, spam, and phishing attacks. Botnets, well-organized distributed network attacks, consist of a large number of bots that generate huge volumes of spam or launch Distributed Denial of Service (DDoS) attacks on victim hosts. New emerging botnet attacks degrade the status of Internet security further. To address these problems, a practical collaborative network security management system is proposed with an effective collaborative Unified Threat Management (UTM) and traffic probers. A distributed security overlay network with a centralized security center leverages a peer-to-peer communication protocol used in the UTMs collaborative module and connects them virtually to exchange network events and security rules. Security functions for the UTM are retrofitted to share security rules. In this paper, we propose a design and implementation of a cloud-based security center for network security forensic analysis. We propose using cloud storage to keep collected traffic data and then processing it with cloud computing platforms to find the malicious attacks. As a practical example, phishing attack forensic analysis is presented and the required computing and storage resources are evaluated based on real trace data. The cloud-based security center can instruct each collaborative UTM and prober to collect events and raw traffic, send them back for deep analysis, and generate new security rules. These new security rules are enforced by collaborative UTM and the feedback events of such rules are returned to the security center. By this type of close-loop control, the collaborative network security management system can identify and address new distributed attacks more quickly and effectively.

A collaborative botnets suppression system based on overlay network

Botnets are extremely versatile programs used in many network attacks, such as sending large volumes of spam or launching Distributed Denial-of-Service DDoS attacks. Botnets can switch command-and-control servers automatically, which makes completely suppressing botnets very challenging. In this paper, we present a collaborative botnet suppression system based on an overlay network, with one control center node and several suppression nodes. The suppression nodes automatically collect network traffic information and deploy suppression rules; the control center node gathers all collected data, and processes this data by using a botnet detection algorithm. Once botnets are detected, the control center node generates and distributes suppression rules. In order to prevent an excessive growth of the rules set, the system automatically identifies and removes invalid rules through an efficient feedback mechanism.

Taking down botnets

Botnets are the preferred tools of cyber-criminals who want to harness the power of large volumes of remote computers to generate massive volumes of spam, launch Distributed Denial of Service (DDoS) attacks and generally create controlled havoc on the Internet. Botnets are the preferred tools for cyber-criminals who want to harness the power of large volumes of remote computers to generate massive volumes of spam, launch Distributed Denial of Service (DDoS) attacks and generally create havoc on the Internet. Attempts to counter botnets have varied – from the legal avenues pursued by the likes of Microsoft to direct attempts to take over their infrastructures. Steve Gold investigates the effectiveness of these techniques and examines whether we have learned any lessons about the best ways of eradicating this menace.

“Stock‐touting” through spam e‐mails: a data mining case study

PurposeAlthough the financial markets are regulated by robust systems and rules that control their efficiency and try to protect investors from various manipulation schemes, markets still suffer from frequent attempts to mislead or misinform investors in order to generate illegal profits. The impetus to effectively and systematically address such schemes presents many challenges to academia, industry and relevant authorities. This paper aims to discuss these issues.Design/methodology/approachThe paper describes a case study on fraud detection using data mining techniques that help analysts to identify possible instances of touting based on spam e‐mails. Different data mining techniques such as decision trees, neural networks and linear regression are shown to offer great potential for this emerging domain. The application of these techniques is demonstrated using data from the Pink Sheets market.FindingsResults strongly suggest the cumulative effect of “stock touting” spam e‐mails is key to understanding the patterns of manipulations associated with touting e‐mail campaigns, and that data mining techniques can be used to facilitate fraud investigations of spam e‐mails.Practical implicationsThe approach proposed and the paper's findings could be used retroactively to help the relevant authorities and organisations identify abnormal behaviours in the stock market. It could also be used proactively to warn analysts and stockbrokers of possible cases of market abuse.Originality/valueThis research studies the relationships between the cumulative volume of spam touts and a number of financial indicators using different supervised classification techniques. The paper aims to contribute to a better understanding of the market manipulation problem and provide part of a unified framework for the design and analysis of market manipulation systems.

Spam defence – don't bring a knife to a gun fight

The utilization of multiple layers of disparate technology filters within an anti-spam defence has historically afforded a significant reduction in the amount of spam that reaches the mail server. However, the recent dramatic increase in the volume of spam is clearly overwhelming these traditional anti-spam defences.

Socio-technical defense against voice spamming

Voice over IP (VoIP) is a key enabling technology for migration of circuit-switched PSTN (Public Switched Telephone Network) architectures to packet-based networks. One problem of the present VoIP networks is filtering spam calls referred to as SPIT (Spam over Internet Telephony). Unlike spam in e-mail systems, VoIP spam calls have to be identified in real time. Many of the techniques devised for e-mail spam detection rely upon content analysis, and in the case of VoIP, it is too late to analyze the content (voice) as the user would have already attended the call. Therefore, the real challenge is to block a spam call before the telephone rings. In addition, we believe it is imperative that spam filters integrate human behavioral aspects to gauge the legitimacy of voice calls. We know that, when it comes to receiving or rejecting a voice call, people use the social meaning of trust, reputation, friendship of the calling party and their own mood. In this article, we describe a multi-stage, adaptive spam filter based on presence (location, mood, time), trust, and reputation to detect spam in voice calls. In particular, we describe a closed-loop feedback control between different stages to decide whether an incoming call is spam. We further propose formalism for voice-specific trust and reputation analysis. We base this formal model on a human intuitive behavior for detecting spam based on the called party's direct and indirect relationships with the calling party. No VoIP corpus is available for testing the detection mechanism. Therefore, for verifying the detection accuracy, we used a laboratory setup of several soft-phones, real IP phones and a commercial-grade proxy server that receives and processes incoming calls. We experimentally validated the proposed filtering mechanisms by simulating spam calls and measured the filter's accuracy by applying the trust and reputation formalism. We observed that, while the filter blocks a second spam call from a spammer calling from the same end IP host and domain, the filter needs only a maximum of three calls---even in the case when spammer moves to a new host and domain. Finally, we present a detailed sensitivity analysis for examining the influence of parameters such as spam volume and network size on the filter's accuracy.

Experiments to identify the causes of spam

PurposeThe purpose of this research is to show how spam is generated and what methods have been proposed to combat it.Design/methodology/approachAn experiment whereby a number of e‐mail accounts using different ISPs were set up and then checked for spam over a period of nine weeks. The results were compared to two pre‐existing e‐mail accounts. The types of spam received were classified into broad headings.FindingsFinancial spam was the biggest single type of spam received, with health‐related spam second. The growth in spam over time was noted, as was the volumes of spam received by different Internet Service Providers. The effects of using “obvious” names versus unusual ones in the e‐mail address were measured, as were those of using spam‐filtering software. In the former case, no significant differences were found, but filtering software certainly helped to reduce the volume of spam received. Active involvement in a pornographic site did not, surprisingly, greatly influence the amount of spam received. The biggest single factors affecting the volume of spam received are the length of time the e‐mail account has been active and the use, or non‐use of filtering software. It is by no means certain that responding to spam increases the volume of spam received.Research limitations/implicationsThe research was conducted over a relatively small time period and small number of accounts were examined.Practical implicationsMethods of combating spam and some urban myths about it are examined.Originality/valueTo those tasked with dealing with spam, the paper provides some ideas on the scale of the problem and how to address it.

How good are our weapons in the spam wars?

Will there ever be an end to "spam wars"? We are bombarded with unsolicited bulk email, we deploy newer and supposedly better ways of filtering spam, and yet spammers continue to devise creative ways to circumvent our defenses. Over the years, the volume of spam has increased steadily, in spite of the continued efforts to contain it. In order to understand the spam problem and to explore control methods, it is useful to analyze spam control techniques by looking at spam generation and transmission as a system. We find that not all spam control methods are equal, because each operates at different points in the system, where their leverage is widely different. In the end, no email control technique is likely to solve the spam problem definitively.

Legislative Definition of Spam for New Zealand

This article discusses the phenomenon of spam with the intention of providing a practical definition of the concept for use in anti-spam legislation. The billions of e-mails that are classified as spam every year affect the majority of the world's e-mail users, and apart from causing annoyance these unwanted communications create significant economic costs. Filtering and downloading spam wastes both time and money, and governments around the world are beginning to react to the problem with legislation to reduce the volume of spam and penalise those who deal in this medium.The problem is how to define "spam" without punishing legitimate commercial e-mails and other unsolicited e-mails that, while not specifically requested, are not unwanted. The author supports an "opt-in" regime with the defences of consent and conspicuous publication available to prevent undue curtailment of the freedom of expression guaranteed by the New Zealand Bill of Rights Act 1990. This approach is encompassed in draft legislation set out at the end of the article.