Behavior-based modeling and its application to Email analysis


The Email Mining Toolkit (EMT) is a data mining system that computes <i>behavior profiles or models</i> of user email accounts. These models may be used for a multitude of tasks including forensic analyses and detection tasks of value to law enforcement and intelligence agencies, as well for as other typical tasks such as virus and spam detection. To demonstrate the power of the methods, we focus on the application of these models to detect the early onset of a viral propagation without &#8220;content-base &#8221; (or signature-based) analysis in common use in virus scanners. We present several experiments using real email from 15 users with injected simulated viral emails and describe how the combination of different behavior models improves overall detection rates. The performance results vary depending upon parameter settings, approaching 99 &percnt; true positive (TP) (percentage of viral emails caught) in general cases and with 0.38 &percnt; false positive (FP) (percentage of emails with attachments that are mislabeled as viral). The models used for this study are based upon volume and velocity statistics of a user's email rate and an analysis of the user's (social) <i>cliques</i> revealed in the person's email behavior. We show by way of simulation that virus propagations are detectable since viruses may emit emails at rates different than human behavior suggests is normal, and email is directed to groups of recipients in ways that violate the users' typical communications with their social groups.

DOI: 10.1145/1149121.1149125

Extracted Key Phrases

18 Figures and Tables


Citations per Year

77 Citations

Semantic Scholar estimates that this publication has 77 citations based on the available data.

See our FAQ for additional information.

Cite this paper

@article{Stolfo2006BehaviorbasedMA, title={Behavior-based modeling and its application to Email analysis}, author={Salvatore J. Stolfo and Shlomo Hershkop and Chia-Wei Hu and Wei-Jen Li and Olivier Nimeskern and Ke Wang}, journal={ACM Trans. Internet Techn.}, year={2006}, volume={6}, pages={187-221} }