Tesis sobre el tema "Spam-Filter"

Communication through text messaging, SMS (Short Message Service), is nowadays a huge industry with billions of active users. Because of the huge userbase it has attracted many companies trying to market themselves through unsolicited messages in this medium in the same way as was previously done through email. This is such a common phenomenon that SMS spam has now become a plague in many countries. This report evaluates several established machine learning algorithms to see how well they can be applied to the problem of filtering unsolicited SMS messages. Each filter is mainly evaluated by analyzing the accuracy of the filters on stored message data. The report also discusses and compares requirements for hardware versus performance measured by how many messages that can be evaluated in a fixed amount of time. The results from the evaluation shows that a decision tree filter is the best choice of the filters evaluated. It has the highest accuracy as well as a high enough process rate of messages to be applicable. The decision tree filter which was found to be the most suitable for the task in this environment has been implemented. The accuracy in this new implementation is shown to be as high as the implementation used for the evaluation of this filter. Though the decision tree filter is shown to be the best choice of the filters evaluated it turned out the accuracy is not high enough to meet the specified requirements. It however shows promising results for further testing in this area by using improved methods on the best performing algorithms.

This study aimed to examine if there was a difference in how likely a victim is to click on a phishing email’s links based on the content of the email, the tone and language used and the structure of the code. This likelihood also includes the email’s ability to bypass spam filters.  Method: The method used to examine this was a simulated phishing attack. Six different phishing templates were created and sent out via the Gophish framework to target groups of students (from Halmstad University), from a randomized pool of 20.000 users. The phishing emails contained a link to a landing page (hosted via a virtual machine) which tracked user status. The templates were: Covid19 Pre-Attempt, Spotify Friendly CSS, Spotify Friendly Button, Spotify Aggressive CSS, Spotify Aggressive Button, Student Union. Results: Covid19 Pre-Attempt: 72.6% initial spam filter evasion, 45.8% spam filter evasion, 4% emails opened and 100% links clicked. Spotify Friendly CSS: 50% initial spam filter evasion, 38% spam filter evasion, 26.3% emails opened and 0% links clicked. Spotify Friendly Button: 59% initial spam filter evasion, 28.8% spam filter evasion, 5.8% emails opened and 0 %links clicked. Spotify Aggressive CSS: 50% initial spam filter evasion, 38% spam filter evasion, 10.5% emails opened, and 100% links clicked. Spotify Aggressive Button: 16% initial spam filter evasion, 25% spam filter evasion, 0% emails opened and 0% emails clicked. Student Union: 40% initial spam filter evasion, 75% spam filter evasion, 33.3% emails opened and 100% links clicked. Conclusion: Differently structured emails have different capabilities for bypassing spam filters and for deceiving users. Language and tone appears to affect phishing email efficacy; the results suggest that an aggressive and authoritative tone heightens a phishing email’s ability to deceive users, but seems to not affect its ability to bypass spam filters to a similar degree. Authenticity appears to affect email efficacy; the results showed a difference in deception efficacy if an email was structured like that of a genuine sender. Appealing to emotions such as stress and fear appears to increase the phishing email’s efficacy in deceiving a user.
Syftet med denna studie var att undersöka om det fanns en skillnad i hur troligt det är att ett offer klickar på länkarna till ett phishing-e-postmeddelande, baserat på innehållet i e-postmeddelandet, tonen och språket som används och kodens struktur. Denna sannolikhet inkluderar även e-postens förmåga att kringgå skräppostfilter. Metod: Metoden som användes var en simulerad phishing-attack. Sex olika phishing-mallar skapades och skickades ut via Gophish-ramverket till målgruppen bestående av studenter (från Halmstads universitet), från en slumpmässig pool med 20 000 användare. Phishing-e-postmeddelandena innehöll en länk till en målsida (hostad via en virtuell maskin) som spårade användarstatus. Mallarna var: Covid19 Pre-Attempt, Spotify Friendly CSS, Spotify Friendly Button, Spotify Aggressive CSS, Spotify Aggressive Button, Student Union. Resultat: Covid19 förförsök: 72,6% kringgick det primära spamfiltret, 45,8% kringgick det sekundära spamfiltret, 4% e-postmeddelanden öppnade och 100% länkar klickade Spotify Friendly CSS: 50% kringgick det primära spamfiltret, 38% kringgick det sekundära spamfiltret, 26,3% e-postmeddelanden öppnade och 0% länkar klickade. Spotify Friendly Button: 59% kringgick det primära spamfiltret, 28,8% kringgick det sekundära spamfiltret, 5.8% e-postmeddelanden öppnade och 0% länkar klickade. Spotify Aggressive CSS: 50% kringgick det primära spamfiltret, 38% kringgick det sekundära spamfiltret, 10,5% e-post öppnade och 100% länkar klickade. Spotify Aggressive Button: 16% kringgick det primära spamfiltret, 25% kringgick det sekundära spamfiltret, 0% e-postmeddelanden öppnade och 0% e-postmeddelanden klickade. Studentkåren: 40% kringgick det primära spamfiltret, 75% kringgick det sekundära spamfiltret, 33,3% e-postmeddelanden öppnade och 100% länkar klickade. Slutsats: Olika strukturerade e-postmeddelanden har olika funktioner för att kringgå skräppostfilter och för att lura användare. Språk och ton tycks påverka effektiviteten för epost-phishing. Resultaten tyder på att en aggressiv och auktoritär ton ökar phishing-epostmeddelandets förmåga att lura användare, men verkar inte påverka dess förmåga att kringgå skräppostfilter i motsvarande grad. Autenticitet verkar påverka e-postens effektivitet, då resultaten visade en skillnad i effektivitet om ett e-postmeddelande var strukturerat som en äkta avsändare. Att adressera känslor som stress och rädsla verkar öka phishing-e-postens effektivitet när det gäller att lura en användare.

Gemeinsamer Workshop von Universitaetsrechenzentrum und Professur "Rechnernetze und verteilte Systeme" der Fakultaet fuer Informatik der TU Chemnitz. Workshop-Thema: Mobilitaet Es werden Filtermöglichkeiten für E-Mails vorgestellt, um die E-Mail-Bearbeitung zu automatisieren und Spam-Mails und Mails mit gefährlichem Inhalt abzuwehren.

Unsolicited bulk email, commonly known as spam, represents a significant problem on the Internet. The seriousness of the situation is reflected by the fact that approximately 97% of the total e-mail traffic currently (2009) is spam. To fight this problem, various anti-spam methods have been proposed and are implemented to filter out spam before it gets delivered to recipients, but none of these methods are entirely satisfactory. This thesis analyzes the properties of spam filters from the viewpoint of Signal Detection Theory (SDT). The Bayesian approach of Signal Detection Theory provides a basis for determining the tuning of spam filters from the particular user's point of view and helps in determining the utility which the spam filter provides to the user.

As computer system usage grows in our world, system administrators need better visibility into the workings of computer systems, especially when those systems have problems or go down. Most system components, from hardware, through OS, to application server and application, write log files of some sort, be it system-standardized logs such syslog or application specific logs. These logs very often contain valuable clues to the nature of system problems and outages, but their verbosity can make them difficult to utilize. Statistical data mining methods could help in filtering and classifying log entries, but these tools are often out of the reach of administrators. This research tests the effectiveness of three off-the-shelf Bayesian spam email filters (SpamAssassin, SpamBayes and Bogofilter) for effectiveness as log entry classifiers. A simple scoring system, the Filter Effectiveness Scale (FES), is proposed and used to compare these filters. These filters are tested in three stages: 1) the filters were tested with the SpamAssassin corpus, with various manipulations made to the messages, 2) the filters were tested for their ability to differentiate two types of log entries taken from actual production systems, and 3) the filters were trained on log entries from actual system outages and then tested on effectiveness for finding similar outages via the log files. For stage 1, messages were tested with normalized bodies, normalized headers and with each sentence from each message body as a separate message with a standardized message. The impact of each manipulation is presented. For stages 2 and 3, log entries were tested with digits normalized to zeros, with words chained together to various lengths and one or all levels of word chains used together. The impacts of these manipulations are presented. In each of these stages, it was found that these widely available Bayesian content filters were effective in differentiating log entries. Tables of correct match percentages or score graphs, according to the nature of tests and numbers of entries are presented, are presented, and FES scores are assigned to the filters according to the attributes impacting their effectiveness. This research leads to the suggestion that simple, off-the-shelf Bayesian content filters can be used to assist system administrators and log mining systems in sifting log entries to find entries related to known conditions (for which there are example log entries), and to exclude outages which are not related to specific known entry sets.

The existance of spam email has gone from a fairly small amounts of afew hundred in the late 1970’s to several billions per day in 2010. Thiscontinually growing problem is of great concern to both businesses andusers alike.One attempt to combat this problem comes with a spam filtering toolcalled TRAP. The primary design goal of TRAP is to enable tracking ofthe reputation of mail senders in a decentralized and distributed fashion.In order for the tool to be useful, it is important that it does not haveany security issues that will let a spammer bypass the protocol or gain areputation that it should not have.As a piece of this puzzle, this thesis makes an analysis of TRAP’s protocoland design in order to find threats and vulnerabilies capable of bypassingthe protocol safeguards. Based on these threats we also evaluate possiblemitigations both by analysis and simulation. We have found that althoughthe protocol was not designed with regards to certain attacks on the systemitself most of the attacks can be fairly easily stopped.The analysis shows that by adding cryptographic defenses to the protocola lot of the threats would be mitigated. In those cases where cryptographywould not suffice it is generally down to sane design choices in the implementationas well as not always trusting that a node is being truthful andfollowing protocol.

This thesis focuses on the e-mail classification and describes the basic ways of spam filtering. The Bayesian spam classifiers and artificial immune systems are analyzed and applied in this thesis. Furthermore, existing applications and evaluation metrics are described. The aim of this thesis is to design and implement an algorithm for spam filtering. Ultimately, the results are compared with selected known methods.

Unsolicited e-mails generally present a major problem within the e-mail communication nowadays. There exist several methods that can detect spam and distinguish it from the requested messages. The theoretical part of the masters thesis introduces the ways of detecting unsolicited messages by using artificial immune systems. It presents and subsequently analyses several methods of the artificial immune systems that can assist in the fight against spam. The practical part of the masters thesis deals with the implementation of a spam filter on the basis of the artificial immune systems. The project ends with comparison of effectiveness of the newly designed spam filter and the one which uses common methods for spam detection.

This diploma thesis deals with usage of bayesian filtres. Bayesian filters are used especially as defensive mechanism in fight with unsolicited emails. The main aim is to try whether these filters may operate not only with emails but also on behalf of web pages distinction. The introductory part provides basic information about fight against unsolicited emails. Above all is mentioned bayesian fighting method that is more detailed developed with simple example. The second fundamental half is focusing on attempt where are experimentally analyzed possibilities of web pages distinction with the aid of bayesian filter into legitimate and spam pages. Furthermore it handles with possibility web pages sorting into several categories more than only into legitimate and spam. Both experiments are described in detail and it includes descriptions of all used tools.

Workshop "Netz- und Service-Infrastrukturen" Hat Bayes eine Chance? Seit einigen Monaten oder Jahren werden verstärkt Bayes-Filter eingesetzt, um die Nutz-E-Mail ("`Ham"') vom unerwünschten "`Spam"' zu trennen. Diese stoßen jedoch leicht an ihre Grenzen. In einem zweiten Abschnitt wird ein Filtertest der Zeitschrift c't genauer analysiert.

The problem of junk mail, also called spam, has reached epic proportions and various efforts are underway to fight spam. Junk mail classification using machine learning techniques is a key method to fight spam. We have devised a machine learning algorithm where features are created from individual sentences in the subject and body of a message by forming all possible word-pairings from a sentence. Weights are assigned to the features based on the strength of their predictive capabilities for spam/legitimate determination. The predictive capabilities are estimated by the frequency of occurrence of the feature in spam/legitimate collections as well as by application of heuristic rules. During classification, total spam and legitimate evidence in the message is obtained by summing up the weights of extracted features of each class and the message is classified into whichever class accumulates the greater sum. We compared the algorithm against the popular naïve-bayes algorithm (in [8]) and found it's performance exceeded that of naïve-bayes algorithm both in terms of catching spam and for reducing false positives.

In many applications one is faced with the problem of inferring some functional relation between input and output variables from given data. Consider, for instance, the task of email spam filtering where one seeks to find a model which automatically assigns new, previously unseen emails to class spam or non-spam. Building such a predictive model based on observed training inputs (e.g., emails) with corresponding outputs (e.g., spam labels) is a major goal of machine learning. Many learning methods assume that these training data are governed by the same distribution as the test data which the predictive model will be exposed to at application time. That assumption is violated when the test data are generated in response to the presence of a predictive model. This becomes apparent, for instance, in the above example of email spam filtering. Here, email service providers employ spam filters and spam senders engineer campaign templates such as to achieve a high rate of successful deliveries despite any filters. Most of the existing work casts such situations as learning robust models which are unsusceptible against small changes of the data generation process. The models are constructed under the worst-case assumption that these changes are performed such to produce the highest possible adverse effect on the performance of the predictive model. However, this approach is not capable to realistically model the true dependency between the model-building process and the process of generating future data. We therefore establish the concept of prediction games: We model the interaction between a learner, who builds the predictive model, and a data generator, who controls the process of data generation, as an one-shot game. The game-theoretic framework enables us to explicitly model the players' interests, their possible actions, their level of knowledge about each other, and the order at which they decide for an action. We model the players' interests as minimizing their own cost function which both depend on both players' actions. The learner's action is to choose the model parameters and the data generator's action is to perturbate the training data which reflects the modification of the data generation process with respect to the past data. We extensively study three instances of prediction games which differ regarding the order in which the players decide for their action. We first assume that both player choose their actions simultaneously, that is, without the knowledge of their opponent's decision. We identify conditions under which this Nash prediction game has a meaningful solution, that is, a unique Nash equilibrium, and derive algorithms that find the equilibrial prediction model. As a second case, we consider a data generator who is potentially fully informed about the move of the learner. This setting establishes a Stackelberg competition. We derive a relaxed optimization criterion to determine the solution of this game and show that this Stackelberg prediction game generalizes existing prediction models. Finally, we study the setting where the learner observes the data generator's action, that is, the (unlabeled) test data, before building the predictive model. As the test data and the training data may be governed by differing probability distributions, this scenario reduces to learning under covariate shift. We derive a new integrated as well as a two-stage method to account for this data set shift. In case studies on email spam filtering we empirically explore properties of all derived models as well as several existing baseline methods. We show that spam filters resulting from the Nash prediction game as well as the Stackelberg prediction game in the majority of cases outperform other existing baseline methods.
Eine der Aufgabenstellungen des Maschinellen Lernens ist die Konstruktion von Vorhersagemodellen basierend auf gegebenen Trainingsdaten. Ein solches Modell beschreibt den Zusammenhang zwischen einem Eingabedatum, wie beispielsweise einer E-Mail, und einer Zielgröße; zum Beispiel, ob die E-Mail durch den Empfänger als erwünscht oder unerwünscht empfunden wird. Dabei ist entscheidend, dass ein gelerntes Vorhersagemodell auch die Zielgrößen zuvor unbeobachteter Testdaten korrekt vorhersagt. Die Mehrzahl existierender Lernverfahren wurde unter der Annahme entwickelt, dass Trainings- und Testdaten derselben Wahrscheinlichkeitsverteilung unterliegen. Insbesondere in Fällen in welchen zukünftige Daten von der Wahl des Vorhersagemodells abhängen, ist diese Annahme jedoch verletzt. Ein Beispiel hierfür ist das automatische Filtern von Spam-E-Mails durch E-Mail-Anbieter. Diese konstruieren Spam-Filter basierend auf zuvor empfangenen E-Mails. Die Spam-Sender verändern daraufhin den Inhalt und die Gestaltung der zukünftigen Spam-E-Mails mit dem Ziel, dass diese durch die Filter möglichst nicht erkannt werden. Bisherige Arbeiten zu diesem Thema beschränken sich auf das Lernen robuster Vorhersagemodelle welche unempfindlich gegenüber geringen Veränderungen des datengenerierenden Prozesses sind. Die Modelle werden dabei unter der Worst-Case-Annahme konstruiert, dass diese Veränderungen einen maximal negativen Effekt auf die Vorhersagequalität des Modells haben. Diese Modellierung beschreibt die tatsächliche Wechselwirkung zwischen der Modellbildung und der Generierung zukünftiger Daten nur ungenügend. Aus diesem Grund führen wir in dieser Arbeit das Konzept der Prädiktionsspiele ein. Die Modellbildung wird dabei als mathematisches Spiel zwischen einer lernenden und einer datengenerierenden Instanz beschrieben. Die spieltheoretische Modellierung ermöglicht es uns, die Interaktion der beiden Parteien exakt zu beschreiben. Dies umfasst die jeweils verfolgten Ziele, ihre Handlungsmöglichkeiten, ihr Wissen übereinander und die zeitliche Reihenfolge, in der sie agieren. Insbesondere die Reihenfolge der Spielzüge hat einen entscheidenden Einfluss auf die spieltheoretisch optimale Lösung. Wir betrachten zunächst den Fall gleichzeitig agierender Spieler, in welchem sowohl der Lerner als auch der Datengenerierer keine Kenntnis über die Aktion des jeweils anderen Spielers haben. Wir leiten hinreichende Bedingungen her, unter welchen dieses Spiel eine Lösung in Form eines eindeutigen Nash-Gleichgewichts besitzt. Im Anschluss diskutieren wir zwei verschiedene Verfahren zur effizienten Berechnung dieses Gleichgewichts. Als zweites betrachten wir den Fall eines Stackelberg-Duopols. In diesem Prädiktionsspiel wählt der Lerner zunächst das Vorhersagemodell, woraufhin der Datengenerierer in voller Kenntnis des Modells reagiert. Wir leiten ein relaxiertes Optimierungsproblem zur Bestimmung des Stackelberg-Gleichgewichts her und stellen ein mögliches Lösungsverfahren vor. Darüber hinaus diskutieren wir, inwieweit das Stackelberg-Modell bestehende robuste Lernverfahren verallgemeinert. Abschließend untersuchen wir einen Lerner, der auf die Aktion des Datengenerierers, d.h. der Wahl der Testdaten, reagiert. In diesem Fall sind die Testdaten dem Lerner zum Zeitpunkt der Modellbildung bekannt und können in den Lernprozess einfließen. Allerdings unterliegen die Trainings- und Testdaten nicht notwendigerweise der gleichen Verteilung. Wir leiten daher ein neues integriertes sowie ein zweistufiges Lernverfahren her, welche diese Verteilungsverschiebung bei der Modellbildung berücksichtigen. In mehreren Fallstudien zur Klassifikation von Spam-E-Mails untersuchen wir alle hergeleiteten, sowie existierende Verfahren empirisch. Wir zeigen, dass die hergeleiteten spieltheoretisch-motivierten Lernverfahren in Summe signifikant bessere Spam-Filter erzeugen als alle betrachteten Referenzverfahren.

This work supports the thesis that sound quantitative evaluation for spam filters leads to substantial improvement in the classification of email. To this end, new laboratory testing methods and datasets are introduced, and evidence is presented that their adoption at Text REtrieval Conference (TREC)and elsewhere has led to an improvement in state of the art spam filtering. While many of these improvements have been discovered by others, the best-performing method known at this time -- spam filter fusion -- was demonstrated by the author. This work describes four principal dimensions of spam filter evaluation methodology and spam filter improvement. An initial study investigates the application of twelve open-source filter configurations in a laboratory environment, using a stream of 50,000 messages captured from a single recipient over eight months. The study measures the impact of user feedback and on-line learning on filter performance using methodology and measures which were released to the research community as the TREC Spam Filter Evaluation Toolkit. The toolkit was used as the basis of the TREC Spam Track, which the author co-founded with Cormack. The Spam Track, in addition to evaluating a new application (email spam), addressed the issue of testing systems on both private and public data. While streams of private messages are most realistic, they are not easy to come by and cannot be shared with the research community as archival benchmarks. Using the toolkit, participant filters were evaluated on both, and the differences found not to substantially confound evaluation; as a result, public corpora were validated as research tools. Over the course of TREC and similar evaluation efforts, a dozen or more archival benchmarks -- some private and some public -- have become available. The toolkit and methodology have spawned improvements in the state of the art every year since its deployment in 2005. In 2005, 2006, and 2007, the spam track yielded new best-performing systems based on sequential compression models, orthogonal sparse bigram features, logistic regression and support vector machines. Using the TREC participant filters, we develop and demonstrate methods for on-line filter fusion that outperform all other reported on-line personal spam filters.

碩士
靜宜大學
資訊傳播工程學系
100
The spam E-mail problem has become more and more serious today. Enterprises and users have to spend lots of time on filtering out useful messages from spam. A variety of spam filtering mechanisms had been proposed, including list-based method, behavior-based filter, content-based method, and cocktail filtering mechanisms. In order to improve the accuracy of spam filters, this study proposes a novel spam detection system, which combines Bayesian-based content filter with URL filter. There are two stages in the proposed system: the online stage and the offline stage. In the offline stage, the characteristics of the spam mail and legitimate mail will be analyzed based on the occurrence frequency of keywords, and then four keyword hash tables will be built. In the offline stage, the filtering process is based on the four pre-built hash tables and the proposed Bayesian-based functions. Five different spam filtering scenarios are examined in this study. The results show that the hybrid spam filtering method proposed in this study has 98% precision rate and 94% recall rate. Therefore, the proposed spam filter performs efficiently and accurately.

碩士
淡江大學
資訊管理學系碩士班
94
In this information age, network provides many convenient applications to us, but spam is different one. The huge amount of spam and disgusting contents are disturbance people who use e-mail in daily life. The thesis is to develop a semantic-based spam filter in client side, it can handle mail message in Chinese or in English and doesn’t need to build a huge amount of black-white list for mail. It has an ability of adaptive learning to reach high precision rate and looks after the speed in training phase and classifying phase. So it can be used in real environment. Mail filtering is similar with document classification. First problem is how to extract enough features that represent the mail exactly. Then according to these features, we use automatic classify algorithm to classify this mail is spam or ham. We use sliding window to extract features and take Bayesian’s algorithm as our classification algorithm. Due to the feature extraction method deeps into semantic layer, the precision rate is higher than the feature extraction with keywords as a result.

碩士
國立中山大學
資訊管理學系研究所
93
With the popularization of Internet and the wide use of electronic mails, the number of spam mails grows continuously. The matter has made e-mail users feel inconvenient. If e-mail servers can be integrated with data mining and artificial intelligence techniques and learn spam rules and filter out spam mails automatically, they will help every person who is bothered by spam mails to enjoy a clear e-mail environment. In this research, we propose an architecture called union defense to oppose against the spread of spam mails. Under the architecture, we need a rule-based data mining and artificial intelligence algorithm. Rough sets theory will be a good choice. Rough sets theory was proposed by Palwak, a logician living in Poland. It is a rule-based data mining and artificial intelligence algorithm and suitable to find the potential knowledge of inexact and incomplete data out. This research developed a spam filter based on rough sets theory. It can search for the characteristic rules of spam mails and can use these rules to filter out spam mails. This system set up by this research can be appended to most of existing e-mail servers. Besides, the system support Chinese, Japanese and Korean character sets and overcome the problem that most spam filters only can deal with English mails. We can develop a rule exchange approach between e-mail servers in the future works to realize union defense.

碩士
國立中山大學
資訊管理學系研究所
96
Growing volume of spam mails have not only decreased the productivity of people but also become a security threat on the Internet. Mail servers should have abilities to filter out spam mails which change time by time precisely and manage increasing spam rules which generated by mail servers automatically and effectively. Most paper only focused on single aspect (especially for spam rule generation) to prevent spam mail. However, in real word, spam prevention is not just applying data mining algorithm for rule generation. To filter out spam mails correctly in a real world, there are still many issues should be considered in addition to spam rule generation. In this paper, we integrate three modules to form a complete anti-spam system, they are spam rule generation module, spam rule reinforcement module and spam rule exchange module. In this paper, rule-based data mining approach is used to generate exchangeable spam rules. The feedback of user’s returns is reinforced spam rule. The distributing spam rules are exchanged through machine-readable XML format. The results of experiment draw the following conclusion: (1) The spam filter can filter out the Chinese mails by analyzing the header characteristics. (2) Rules exchanged among mail improve the spam recall and accuracy of mail servers. (3) Rules reinforced improve the effectiveness of spam rule.

碩士
國立中興大學
資訊科學研究所
93
Flooding the Internet with many copies of the same email is known as spam mail. While spammers can send thousands or even millions of spam emails at negligible cost, the recipient pays a considerable price for processing these unwanted mails. Decreases in worker’s productivity, bandwidth, storage, and mail server’s performance are major problems caused by the spam mails. We propose an adaptive,automatic filter for spam mails processing in this paper, based on the Bayes probability. In addition, we make use of weights on server and client, adopt the technique of both black and white list, and offer personalized filter rules definition. In our system, a user can define his own filter rules. Through the automatic training mechanism, even with rapid spam mail evolution, the efficiency of spam mail detection remains. In conclusion, this system can reduce the user’s burden and provide a great flexibility to adaptively filter out most spam mails.

碩士
國立屏東教育大學
資訊科學系
99
在現今科技的蓬勃發展以及網路的普及之下，電子郵件已然成為人們互相傳遞訊息最方便的工具。而垃圾郵件的增加造成系統的負擔，消耗了網路的資源，也浪費了大家等待的時間。這些垃圾郵件內容都包含了惡意程式、木馬、蠕蟲等內容，目前有許多的垃圾郵件的過濾軟體都是使用Bayesian filter的反制垃圾郵件機制。在本篇的論文中，我們主要運用有貝氏過濾法(Bayesian filter)垃圾郵件反制機制的Anti-Spam SMTP Proxy和搭配正規表示式(Regular Expression)的Spampal以及防毒軟體ClamAV來辨識惡意軟體和木馬等附件檔。我們探討的是當只使用一個反垃圾郵件軟體過濾垃圾郵件，會發現將某郵件地址加入白名單後，反垃圾郵件軟體就不再對該郵件地址所寄的所有郵件過濾。本論文設計了一個多層的防護架構，除了過濾一般寄件者所寄的垃圾郵件之外，也可以過濾白名單內的寄件者，藉由多層的架構來防止垃圾郵件寄件者利用各種方式來規避過濾。

碩士
萬能科技大學
資訊管理研究所
99
The Traditional e-Mail filtering technique that most researches proposed could not cope with the complicated Internet nowadays. E-mail has become the necessary part in our daily life. However, spammers use different ways to spread the improper e-mail to trouble peoples’ life. Therefore, how to find the innovative and effective e-mail filtering technique becomes an important issue. Although Bayesian Classifiers shows remarkable accuracy in filtering spam email, but it exists great difficulty in choosing appropriate parameters and understanding the information of Bayesian Training Model. The research proposed a theory-based spam email method, called Fuzzy model. One can establish his/her own filtering model through the result of fuzzy control to manage spam email. The owned filtering model also provided learning mechanism. Unnecessary classified rules can lead to low email server performance and increase the rate of false spam positive. Through the proposed method, email filtering servers can increase filtering efficiency within the smallest set and eliminate the rate of false spam positive so that email server performance can become much more efficient and accurate.

碩士
佛光大學
資訊學系
100
Solve the SPAM problem has been the proliferation of Internet application development on important issues in theses year. E-mail users are affected by the problem of SPAM, it reduces trust in e-mail service. In recent years, portal site and Internet Services Provider in order to increase the number of customers and offer free e-mail account and has a large space. Although accelerated the popularization of e-mail service but ignore the amount of spam increase will reduce the customer's reliability, it have a negative impact on corporate image. Therefore, a high degree of operational efficiency, block rate, and friendly management interface is the three elements must be of development anti-spam technology. Then there must be a better system hardware resources and fast computing efficiency and help each other. Friendly and convenient management interface need for high-performance automatic learning mechanisms and accurate response mechanisms. Provide a complete e-mail records and statistical reports to managers for data analysis spam filter weights and adjustment argument.

碩士
國立臺灣科技大學
資訊工程系
97
Comparing to server side spam mail filter, personal spam mail filter has the advantage to utilize personal information, like address book and local mail folders, to reach higher accuracy on spam filtering. However, filters trained by both spam mails and personal mails may have difficulty classifying e-mails with the same characteristics of both spam and ham. Former research suggests that putting a legitimate mail filter in front of traditional personal spam filter may effectively decrease false positive rate and allow some spam mails which user might be interested with to pass through. E-mails classified as legitimate mails by the legitimate mail filter may pass, while the remaining e-mails are processed by the spam filter in an ordinary way. This thesis focuses on implementation issues including building testbed, developing different training process for Chinese and for English mails, and fine tuning thresholds of both filters to reach lowest false positive rate with reasonable false negative rate. Experiments are performed on two mail servers–one equipped with ordinary spam filter only, and the other equipped both the legitimate mail filter and the spam filter. The results of experiments demonstrates that, given the same false negative rate, the two filters approach offer a much lower false positive rate comparing to the ordinary one.

碩士
國立臺灣科技大學
資訊工程系
92
The two mainly goals in the system are filtering spam E-mails and stopping those malevolence programs, such as virus, backdoor and Trojan Horse, to send E-mails through user’s Mail User Agent. The most important key points of a perfect spam filtering system include high speed and correctness when classifying between spam and legitimate E-mails, and SSVM is one of the most suitable machine algorithms in classifying. In this system we use two public standard training and testing data set: Ling-Spam corpus and PU1 corpus. Each data in these two corpus set will translate from textual form into vector form, and each vector has 108 feature columns. Using these vector-form data, we can use SSVM to train and test our optimal classifying function. From the results of experiments in this paper, we can get totally better Spam Precision and Spam Recall values than other researches before. Besides, our system will also install a firewall in user’s personal computer to stop malevolence programs sending E-mails. The firewall will guard user’s port 25 in order to stop those malevolence programs fake as normal TCP/IP packets but send E-mails stealthily. Based on these two important parts, this system can help users build a clear, safely, and non-spam network environment.

碩士
國立臺北科技大學
工業工程與管理系所
94
It’s favored with quick development of communication information science and technology, bandwidth and speed of internet are surmounted one after another. Marketers go with the trend, combine science and technology of network, internet marketing assumes and already becomes the most modernized outstanding one of industry; Times rising in internet marketing, Marketers besides statically erect websites and improve the exposing rate, send dynamically the advertising document of electron to declare constantly, in order to touch consumer''s mentality, it is an important thing among them to use E-mail as advertising marketing, however, these electron advertising letters become very hated spam that was not agreed and enter promptly by force, are not only increase in quantities, wasted network bandwidth, hide rapidly information safety , raising the cost of management , reducing productivity and working efficiency. So far the spammer’s sending indiscriminately has already reached quite rampantly. The mailers are expectations that authorities legislate to prevent, and ISP (Internet Services Provider) offer filter to hold back. The former, there are two drafted bills have been sent and examined at present, but has not legislated yet; And the latter, the academia counts 14 to the discussion of the spam filter, they primarily writing stress on technology such as how to mine, detect, sieve etc, few people shows any interest in its market. The war of spam and anti-spam has already been launched silently, both sides try one''s very best, what does not bleed attacks and defends fighting, The spammers who attack crazily, the anti-spammers who defend do one''s utmost to defend stopping up , the spam filter are brought following the trend , therefore there are more than 20 kinds spam filter on the market, this research is major receiving the quantity and software demand of spam filter user with the market of the software , and the relation between the filter function and filter software demand differently, to suggest really of management who’s filter provider of anti-spammer and the mailer, and do some good to network clans.

碩士
淡江大學
資訊管理學系碩士班
94
To use E-mail is an indispensable for the way of communication in the E-generation. However, someone make capital of it to send countless advertisement letters by the advantage of network that has low cost and endless scope. Due to advertisement letters violently increase, a lot of scholars bring up the investigations into mails of percolation in the several years. People progressively develop various solutions of SPAM mail filter system. When handle a large number of mails that can effect the speed inevitably. SPAM mail filter system will inefficiency and that can loss the mails timeliness when the system deal with a great quantity of mails. There are no way of solutions aim at an overload situation by single mail domain in every SPAM mail filter system presently. The purpose of this study, we use distributed architecture to design the spam mail filter system. We take some advantage and ameliorate some drawback from old system to construct IM-SPAM system. According to experimental result, the IM-SPAM system solved the bottleneck in system is overloaded. Although we also provided a web-based interface for administrative and user can do the system configuration and set up their filtering policies and feed back spam mail information. This system will analyse feedback information and mistrial fixed. That will reduce wrong decision again.

碩士
元智大學
資訊管理學系
94
This study reviews several popular spam filters and filtering approaches, and then propose and E-mail header based spam filter that takes advantages of both heuristic filtering and Bayesian filter. The experiment results showed that the proposed spam filter performs more stably than SpamAssassin, Bogofilter and SpamBayes. The proposed spam filter achieved an average precision rate above 88% and a false positive rate below 0.1%. Also the proposed spam filter is comparable to other spam filter in filtering efficiency.

碩士
逢甲大學
資訊電機工程碩士在職專班
96
Spam mail has caused great distress in enterprise and individuals. More recently, many spam mail filters were proposed. One of them, Support vector machine (SVM) is a powerful supervised learning method. Many researches explained that the accuracy of SVM is outstanding in the anti-spam field. However it is not easy that determine the suitable parameters of SVM for constructing the training model, and this model is difficult to understand. Additionally, SVM is time consuming on training and re-training. Clustering Launched Classification (CLC) is easy to use, which only needs one parameter. It has been used in other fields and performs well in accuracy. This paper proposes to adopt CLC method as a spam mail filter. The accuracy of CLC was compared with that of MySVM. In the experimental results, the accuracy variation scope of CLC is very small and that of SVM is great. Thus the performance of CLC is comparable to SVM. Furthermore, CLC is insensitive to parameter, while the SVM is sensitive, showing CLC is easier to use in anti-spam field.

碩士
中原大學
資訊管理研究所
93
It is well known that there is a specific effectiveness by using Neural Network Categorization (NNC) to proceed documents category; furthermore, foreign research reports are also obviously revealed that by using NNC to recognize core processor of spam is also workable. However, currently, due to there is no thesis by using NNC to proceed identification of spam in the light of Chinese mails’ contents, it is expected that through concrete experiment to understand does it workable by using NNC with regard to identification of spam. When Chinese documents are sorted out by using NNC, pre-handling is necessary. And, with regard to collection of key words (terms) when Chinese documents being pre-handled, difficulties of collection will be caused due to Chinese non-structured. In this study, as a result of mails are treated as one of documents, collection of key words (terms) in pre-handling is also quite important. Therefore, it is expected that being permeated collection of different numbers of key words (terms), and through live experiment to understand does numbers of key words (terms) influence to identification of spam. If mails are observed by an angle of documents category, even spam are also categorized differently. Hence, it is expected that through experiment to understand if mails are categorized by using dichotomy; as well as by actually using seven sorts of spam which are tested, and adding regular mails altogether, is there any influence between numbers of these two sorting results towards by using NNC to identify spam. It is expected to obtain regional optimum reconciliation through adjustment of three arguments of numbers of key words (terms), numbers of NNC node as well as numbers of NNC output categorization. Through actual experiment, it is aware of if numbers of key words (terms) collected are able to appropriately represent spam, ratio of spam identification not only can be heaved, but that of erroneous judgment can be reduced also. And, numbers of NNC node will be changed to comply with complication of training data. This study has pointed out that the highest ratio of identification will be obtained when numbers of NNC node is five. NNC output categories have to be conformed to categories of actual data after experiment. Spam has been divided to seven categories in this study, and non-spam category has been added up to eight. Therefore, spam identification is the highest when NNC numbers of output category is set at eight. Through experiment, it is informed of using NNC to proceed categorization, SF1 of spam can be reached to 0.82. Hence, it is proved that identification of Chinese spam by using NNC is effective indeed.

碩士
國立臺灣海洋大學
資訊工程學系
94
Abstract With the rise of Internet, email has become a useful communication tool in our daily life. At the same time, spam mails also become a big problem which perplexes people. Among these unsolicited emails, they include commercial advertisements, virus, Trojan, to name a few. Spam mails not only consume network resources but also cost receivers’ valuable time to handle them. A lot of anti-spam software is developed. Many of them deploy Bayesian filter mechanism. In this thesis study, we would like to explore the efficiency of Bayesian filter mechanism for spam detection. We also discuss detailed implementation issues. With public spam benchmark, we trained and evaluated our Bayesian-based spam filter. Our primitive experiment results showed that our Bayesian-based spam filter performs quite well with respect to a large range of threshold setting. The performance we got in terms of spam detection accuracy is quite close as some similar studies reported in literature.

碩士
國立暨南國際大學
資訊管理學系
96
In recent years, people suffer the pain from having too much information. It is different from the past where people always worry about having less information. Nowadays, it is obvious that the amount of information that one man can handle is limited. When it exceeds the information rate that one can handle, they will make mistakes easily. Therefore, data mining techniques are needed. Spam filter is an application using data mining technique. There are some troubles for users when they use their e-mails. For instance, the mix of normal and junk mails let user lose important information or delete wrong mails easily. In the business environment, costs for information processing, especially in dealing with junk mails, will increase. Hence, many techniques are proposed for anti-spam. K-mean, Back-Propagation Network (BP), Decision Tree, Bayesian approach, and Support Vector Machine (SVM) are some of the many techniques used. In the past, there are few studies that concerns about Chinese characters compared with English in spam filter. This study will focus on the Chinese e-mails for spam filter. This study compares with the four data mining techniques, which are rough set theory (RST), back-propagation neural network, combing Taguchi with SVM, and combining particle swarm optimization (PSO) with SVM. We will discuss the capability of them in this study. Additionally, this study will combine it with the discretization and feature selection method. In short, there are two important key points in this paper. First, the selection of key words will influence the accuracy of the data mining method. On the other words, the key words must have distinguishing features that can stand for the original e-mail. Second, this study discusses the optimization of parameters and the influence of using the ChiMerge algorithm for the discretization method.

碩士
國立交通大學
資訊科學系所
92
Network content security has become a critical issue for the Internet. We selected five popular open-source packages to solve the problems of intrusions, viruses, spam, and inappropriate Web pages. However, simply installing these packages brings four kinds of overheads: (1) process forking, (2) redundant IPCs, (3) redundant user/kernel space interactions, and (4) duplicate packet reassembly. To reduce the above overheads, we propose a tightly-integrated architecture. This architecture uses multi-thread and the system call, select(), to eliminate the overhead in (1), and is integrated with cooperating packages into a single proxy to eliminate the overheads in (2), (3) and (4). The external benchmark reveals that the improvement of performance is from 7.16 Mbps to 13.11 Mbps in content filtering and intrusion detection, and is from 2.85 Mbps to 5.82 Mbps in anti-virus and anti-spam. It shows that the dominating overhead in the original architecture is process forking. The internal benchmark shows that the main bottlenecks of the content processing are string matching in HTTP and file system access in SMTP, 48% and 62%, respectively. Finally, to scale up this architecture, we suggest directions of improvement, including faster string matching algorithms, hardware accelerators, and more protocol support.

碩士
輔仁大學
電子工程學系
96
In this paper we propose a new multi-filter firewall method instead of only a single e-mail server to enhance the efficiency of the processing of spam. The idea of a multi-filter firewall is to combine firewall, mail frontier and mail server, and with their different functions such as virus scan, anti-spam find, link brush-off in IP blacklist of unwelcome senders to ensure the safety of the mail server and efficient lift-up. In addition, to estimate system performance, we use a serial equivalent model representing a multi-filter firewall. Due to the use of the multi-filter firewall when processing e-mail our method stops spam by a cooperation method and reduces the workload of the actual mail server. For the receiving and sending nodes we use a Firewall Virtual Private Network (VPN) to share the loading for mail processing. Because the VPN is not only a virtual private Internet established between two nodes but also the use of Multi-Protocol Label Switching (MPLS), it is like an interior Internet passing data quickly between two nodes. MPLS supports Multi-Protocol Networks Transfer Protocol and core networks transfer with efficient label switching. MPLS VPN is also compatible with many communication protocols and supports free safety services.