Bayesian clustering for email campaign detection

We discuss the problem of clustering elements according to the sources that have generated them. For elements that are characterized by independent binary attributes, a closedform Bayesian solution exists. We derive a solution for the case of dependent attributes that is based on a transformation of the instances into a space of independent feature functions. We derive an optimization problem that produces a mapping into a space of independent binary feature vectors; the features can reflect arbitrary dependencies in the input space. This problem setting is motivated by the application of spam filtering for email service providers. Spam traps deliver a real-time stream of messages known to be spam. If elements of the same campaign can be recognized reliably, entire spam and phishing campaigns can be contained. We present a case study that evaluates Bayesian clustering for this application.

• Type: Conference
• Year: 2009
• Where: ICML
• Authors: Peter Haider, Tobias Scheffer
• Keywords: Bayesian Solution Exists, ICML 2009, Independent Binary Attributes, Independent Binary Feature, Machine Learning