Spam mitigation using spatio-temporal reputations from blacklist history

IP blacklists are a spam filtering tool employed by a large number of email providers. Centrally maintained and well regarded, blacklists can filter 80+% of spam without having to perform computationally expensive content-based filtering. However, spammers can vary which hosts send spam (often in intelligent ways), and as a result, some percentage of spamming IPs are not actively listed on any blacklist. Blacklists also provide a previously untapped resource of rich historical information. Leveraging this history in combination with spatial reasoning, this paper presents a novel reputation model (PreSTA), designed to aid in spam classification. In simulation on arriving email at a large university mail system, PreSTA is capable of classifying up to 50% of spam not identified by blacklists alone, and 93% of spam on average (when used in combination with blacklists). Further, the system is consistent in maintaining this blockage-rate even during periods of decreased blacklist performanc...

• Type: Journal
• Year: 2010
• Where: ACSAC
• Authors: Andrew G. West, Adam J. Aviv, Jian Chang, Insup Lee
• Keywords: ACSAC 2010, Blacklist, Email, Expensive Content-based Filtering, Security Privacy