Incremental SVM Model for Spam Detection on Dynamic Email Social Networks

Recently, the huge number of email spams has caused serious problems in essential email communication. Traditional spam filters aim at analyzing email content to characterize the features that are commonly included in spams. However, it is observed that crafty tricks designed to avoid content-based filters will be endless owing to the economic benefits of sending spams. In view of this situation, there has been much research effort toward doing spam detection based on the reputation of senders rather than what is contained in emails. Motivated by the fact that spammers are prone to have unusual behavior and specific patterns of email communication, exploring email social networks to detect spams has received much attention. Nevertheless, previous works generally suffer from two problems: (1) the system is not robust in diverse environments, and (2) no update scheme is provided to catch the feature changes of evolving networks. In this paper, we propose an incremental support vector machine (SVM) model for spam detection on dynamic email social networks. A complete spam detection system MailNET is devised to better adjust to diverse networks. Several features of each user in the network are extracted to train an SVM model. Moreover, to catch the evolving nature of email communication, we present an incremental update scheme to efficiently re-train an SVM model. We evaluate MailNET on a live data set from a university-scale email server and show that the proposed model is efficient and effective, thus applicable to the real world.