LENSLEveraging anti-social Networking against Spam

(Introduction)

MSc. Sufian Hameed

Dr. Pan Hui

Prof. Xiaoming Fu

2

Agenda

• Introduction and Motivation• State of the Art• LENS• Experiments and Results

3

1. Introduction and Motivation• Spam

– Unsolicited bulk messages sent indiscriminately

– Increased from 65% in 2005 to 81% in 2009

– 200 billion spams with avg size of 8Kbytes• Per day space consumption and bandwidth usage is 1,525,879 GB

• Common Protection Techniques– Content-Based Filtering

– Sender Authentication

– Header-Based approach

– Social Network Approach

• Problems– False positives and negative

– Spam already traversing the network

4

2. State of the Art• Personal Email

– a social network of friends in the cyberspace based on the emails exchanged between them

– local clustering properties of social network classify emails

– able to classify 53% of all the emails as spam or non-spam with 100% accuracy.

– limited to offline analysis

– 47% emails are left for other filtering techniques.

• Reliable Email– Uses whitelist of friends and FoF to accept email

– Accepts 85% of the emails and prevents 88% of false positives

– Infrastructural overhead (public/private keys Attestation Server)

5

3. LENS: LEveraging anti-social Networking against Spam• Anti-social networking paradigm, based on an underlying social

infrasrtucture– Extend spam protection beyond social network

– Prevent transmission of spam across the network

• Receive all legitimate emails

• Prevents all spam transmission

• LENS consists of two parts– Formation of social network .i.e. community formation

– Anti-social networking i.e. GK selection

6

3.1 Community Formation

7

GK Selection

SKList (SK, GKID, RNID)

SignList (Signature[(CNID)Sign-SK, GKID, RNID ])

Add to SKList

Add to SignList

Add to SKList

8

GK Selection – stage 1 CommLists1

3 – F

33 – F

36 – F

32 – F

31 – F

2 – FoF – 3

4 – FoF – 33

34 – FoF – 33

35 – FoF – 36

38 – FoF – 36

37 – FoF – 32

30 – FoF – 31

5

12 – F

6 – F

19 – F

17 – F

14 – F

11 – FoF – 12

10 – FoF – 6

20 – FoF – 19

18 – FoF – 17

16 – FoF – 17

13 – FoF – 14

15 – FoF – 141

SK ,5, 1

5

SK ,5, 1

6

Sign[(6)SK, 5, 1]

19

Sign[(19)SK, 5, 1]

SignList

SKList

9

GK Selection – stage 2

10

GK Selection – stage 3

Authentication

Annonce

11

Email Processing

12

Email processing with LENS

13

4. Experiments and Results

Concerned in evaluating two things• Scalability

– OSN Date (FaceBook and Flickr)

• Effectiveness at accepting all the legitimate inbound emails.– Two real email traces (Enron and Uni-Kiel)

14

OSN Data

• Interested in– # of GKs for receiving messages– Reachablity of recipient via GK

15

FaceBook

• 4000 nodes

• Community size 100-1500

• Number of GKs– GKs between 56-880

– SKList entry in 76 bytes

– 70 Kbytes in worse case

• Reachablity of recipient via GK

• Between 710K - 1.7 million (23-54%)

16

Flickr

• 4000 nodes

• Community size 100-1500

• Number of GKs– GKs between 25-397

– SKList entry in 76 bytes

– 28 Kbytes in worse case

• Reachablity of recipient via GK

• Between 682K-920K (39-54%)

17

Email Data Set

• Enron– Contains data from mostly senior management of Enron.

• Uni-Kiel– Data taken from log files of the email server at Kiel University

over a period of 112 days.

18

Evaluations of Email Dataset

• Email Acceptance • Number of GKs• Space

Requirement• Message

Overhead

19

Thank You