| 摘要 |
We describe a method of computing language-independent metrics (which we term "HideMe" and "HideAll") to associate with selectable domains in electronic messages. We apply these as indicators as to whether a sender address is false, using a graph which we call a Cloaking Diagram. The metrics and the graph can be used to autoclassify domains involved in the transmission of bulk messages, according to the extent that the domains appear to be forging sender addresses and the extent that the domains appear to be acting as distributors of messages pointing to other domains. Also, we present a method of using a graphical analysis of metadata found from one set of electronic messages, or from two such sets, that reveals groupings or correlations between metadata. These groupings can be used to assign an entire group to a same category. It permits for an efficient determination of spam domains. It attacks the economics of spammers making and selling mailing lists to other spammers. We also can search for open relays that are sending us spam. The method can be used in a manual or algorithmic fashion.
|
