Application of Social Relation Graphs for Early Detection of Transient Spammers

Transcription

1 Radolaw rendel and Henryk Krawczyk Application of Social Relation raph for Early Detection of Tranient Spammer RADOSLAW RENDEL and HENRYK KRAWCZYK Electronic, Telecommunication and Informatic Department dank Univerity of Technology Narutowicza / dank POLAND radolaw.brendel@eti.pg.gda.pl, henryk.krawczyk@eti.pg.gda.pl Abtract - Early detection of ocial threat and anomalie i a real challenge in today dynamic ocietie. The people form many complex ocial relation that can be hown by variou type of graph in which the node would repreent the ubect (individual or group of people) and the link would indicate pecific relation between them. The analyi of thee contantly changing relation can point out pecific ocial threat that are imminent. Oberving the tendency of change in the ocial relation graph, uch threat can be early detected and adequate preventative tep can be taken. In the paper we preent how thi approach can be efficiently ued to early detect imminent threat of pam to a local ociety and iolate group of pammer before their meage reach the uer inboxe. Key-Word: - ocial graph, imminent threat, graph pattern, pam detection, ecurity Introduction Human ocietie developed pecific ocial relation in many field of their activitie. Much reearch ha been done o far in analyzing complex relation between individual and organization in real world [][8][]. We can eaily oberve them in one of their poible repreentation ocial relation graph. In uch graph node uually repreent individual or whole organization wherea link between the node have the meaning of relation of different type that we want to tudy. Social relation graph are characterized by everal pecific propertie. One of them i the mall world phenomenon. It mean that two node in the graph are related with each another by relation of mall amount of other intermediate node. For intance, an experiment made in 967 by pychologit Stanley Milgram howed that the chain of ocial acquaintance connecting one arbitrary peron to another arbitrary peron required on average only five intermediate (the experiment wa carried out on US individual). Moreover, the analyi on ocial relation graph uually allow u to ditinguih a certain et of node (repreenting ocial obect) that play main role in the tudied community []. Oberving the behavior of a certain community for a long enough time and collecting the data about relation between it member, it i poible to create a group of pattern graph repreenting typical and abnormal relation in the community. After that we poe the knowledge of what are the typical and abnormal relation in the community being analyzed and any exception to thee pattern can be ditinguihed and meaured in ome way. Detection of thee exception i crucial from ecurity point of view becaue their preence uually indicate ome anomalie in relation between the member that in conequence caue threat to the community. In the paper we will how how the method of early detection of incoming threat can be effectively performed taking into account the propertie of ocial relation graph and the aement of congruity level between thee graph and relation pattern graph. We will alo preent how the method can be ued to efficiently detect pammer in one of the mot famou ocial network - Internet community. Effectively, every e- mail uer will be identified a a pammer or a regular uer. Social Relation raph In order to perform detection of imminent threat to a certain community we defined two categorie of graph. The firt category i compound of directed ocial relation graph that decribe the current activity tate of all the member of the community. The econd category conit of pattern graph decribing typical and abnormal behavior of the member. 67 Iue, Volume 5, March 008

2 Radolaw rendel and Henryk Krawczyk The ocial relation graph are the tructure that repreent actual relation between community member after a pecified period of time. The relation graph are dynamic in the ene that they are contantly changing over time to reflect the current tate of relation etablihed between the member. Thi dependence on time will be indicated in many beneath formula by ubcript k, i.e. D k would indicate digraph at a certain moment of k or after the k-th event. Now, let' aume we conider a ocial network that can be repreented in form of the digraph D k (V k,r k ), where V k ={v, v,..., v,.., v p } repreent a et of node (actor in a real ocial network) and R k V k V k repreenting the relation R between the node (actor). Auming binary relation between the actor the digraph can be decribed by the following correponding binary matrix = [, ] where: R k r i p p if vi R v ri, = () 0 otherwie Of coure depending on the ocial network ometime it may be important to expre in ome way the trength of the relationhip between the actor. In uch cae r i, would take a value real number (mot often nonnegative natural number). The neighborhood of the node v (i.e. the relation between the actor and it neighbor in the digraph can be decribed by another matrix R k that in fact i a ubmatrix (block) of the matrix R k. Auming that the et of node N V, k = { v i : v i Rv } { v } repreent all the neighbor of the node v and v itelf, the neighborhood matrix N = [ r, ] where = can be defined a R k i t t follow: v t V, k if v Rv N i v V, k ri = () 0 otherwie i,, We hould underline that a relation graph i changing over time thu the relation between community member in the graph are different depending on the moment in which we decide to draw it. Let u look at Fig., where it i hown an example of relation graph of a ample community in three different moment (t, t and t ). We aumed that member of the community repreent mobile phone uer, the relation we conider are made phone call between the member and the weight of the relation will indicate how many time one uer made a phone call to another (if a uer made more than one phonecall). We can notice that after time t everal relation were etablihed (phone call made) but we have not got clear image of typical relation in the community yet. We cannot ditinguih yet any group of people that form a local community (member that maintain very cloe relation in repect to other). After time t one local community wa formed (indicated by circled dahed area). Finally after time t we ee that in the tudied community three different local group of member developed very cloed relation between their member. enerally it i difficult to ay for how long we need to oberve a community in order to get a compete image of the relation in it. It ut depend on the activity of it member. time t t t t 0 Fig. Change a in ample relation graph over time; t, t and t are the moment of obervation (t < t < t ). Relation Pattern raph We mentioned that to effectively detect imminent threat to a community it i required to define a et of pecial graph that we call relation pattern graph, hortly pattern graph. Their goal i to decribe typical and abnormal behavior of the community member. We are able to create them only after getting familiar with the community 68 Iue, Volume 5, March 008

3 Radolaw rendel and Henryk Krawczyk epecially deeply tudying the relation between it member. Of coure thee pattern graph will be different for every community they decribe. For example, conidering the Internet community an activity of one member (one uer) that tarted hundred relation with other member probably indicate abnormal behavior typical for pammer, preading huge amount of advertiing . (u,...,u m ) every time utaining it identity (p). In the lat Fig. iii we ee a group of node (numbered p,...,p n ) that ent to a fixed group of uer (u,...,u m ) from which nobody ha reponded (did not want to tart relation with the ender). Probably all thee ender node repreent ame pammer that every time he end an he change (forge) hi appearance. Of coure with only a certain probability we can tate it but taking into account i) p ii) p p iii)... p n u u u... u m u u... u m Fig.. Relation pattern graph for three clae of pammer (p): i) OO-OF; ii) MT-OF; iii) MT-MF elow, a an example, we preent poible relation pattern graph that can be ditinguihed for Internet ociety. The propoed pattern graph decribe typical and abnormal behavior of uer in regard to the problem of pam in the Internet community. Thee two type of behavior (typical and abnormal) have been naturally aigned to pammer and o-called regular uer accordingly. The node of the pattern graph are uer, wherea the link repreent relation tarted by ending an between two member ( uer). Conidering pattern graph for pammer we ditinguihed three type of them repreenting three different clae of pammer. Thee are: OOOF Only-Once One-Face; pammer of thi cla come up in the network only once and with only one identity; MTOF Multiple-Time One-Face pammer of thi cla come up in the e- mail network everal time during a period of obervation every time having the ame identity; MTMF Multiple-Time Multiple-Face pammer of thi cla come up in the e- mail network everal time during a period of obervation every time changing it identity. It i a typical cla of tranient pammer. Fig. preent three type of pattern graph correponding to each cla of pammer. In Fig. i we ee a ituation where a pammer ent only one e- mail to one regular uer and never came up in the network again. Fig ii how another type of pammer that ent to a et of recipient other attribute of the (further analyzing the header of the for intance) can enure our aement. Fig. preent two non-pam pattern graph. With high probability it can be tated that node ru on both graph repreent regular uer (nonpammer). In Fig. i node ru ent an to a cloely tied group of uer (u,...,u m ). Mot of them exchanged at leat one with another uer o they mut know well each other forming a local mall community (like in a real ociety). Auming that pammer do not know local relation between uer, the directed to a cloely tied group of uer allow u with high probability to claify the ender a a regular uer. i) ru u u u u 4 u m... Fig.. Relation pattern graph for regular uer (ru): i) ru ent to a well-known group of uer; ii) ent by ru have been reciprocated. In Fig. ii we ee another pattern graph where node u, u, u 4 (recipient) anwered to the ent by node ru. Uually we do not anwer to e- mail ent by pammer (epecially that their addree are often forged). Thu thi act of reponding to the lend credence to the ender claifying it with high probability a a regular uer. ii) ru u u u... u m 69 Iue, Volume 5, March 008

4 Radolaw rendel and Henryk Krawczyk 4 Imminent Threat Recognition Approach In mot cae the efficiency of reaction to anomalie in community member behavior trongly depend on the moment in which the anomalie will be detected. Uually ooner the anomalie are detected, more efficient the taken countermeaure will be. So it i extremely important to develop a olution for early recognition of imminent threat to the community. The propoed recognition approach begin from the build of the relation graph that decribe the current community member activity. The graph i build from hitorical data collected for a long enough time letting all the typical relation between the community member to be etablihed. We prepared a collection of perl cript and program that analyze log generated on mail erver ytem[4][5]. After that we need to ditinguih relation pattern graph decribing typical and abnormal behavior of the community member. In general we can create different et of uch pattern graph according to exiting real threat. Having thee two type of graph prepared we are ready to implement the threat recognition procedure. Initial load of hitorical data Initial evaluation of all the member node Updating the relation graph according to the incoming event. Aement of the congruity between pattern graph and neighborhood of all the node affected by the event. Analyze the tendency of congruity change over time and ae whether any of threat defined by pattern graph are imminent. Fig. 4. eneral imminent threat recognition approach The recognition procedure i baed on the following aumption. If we imply want to tate whether a certain community i under one of the previouly defined threat (in the form of a relation pattern graph) we could perform a earch to check whether any of the pattern graph i already included in the relation graph. Having found any of the pattern graph in the relation graph it would indicate that the community i already a victim of thi pecific threat (for example, in the cae of communication graph it would mean that pam meage have already reached the uer mailboxe). However, our goal i to find a method of early recognition of imminent threat. That i why, it i neceary to predict the creation of uch pattern graph in the relation graph before they appear in it in full form. We can achieve it by creating pecial pattern graph imilarity function calculating the congruity between the pattern graph and part of the relation graph. Such function are pecific to each pattern graph. The congruity evaluation can take place on regular bai or on every event that change the neighborhood of any node repreenting a community member in the relation graph. Taking into account all the evaluation (after lat event and from the pat) it i poible to indicate the tendency of change in evaluation reult. Every time when a certain part of the relation graph become more and more imilar to one of the pattern graph repreenting actual threat we can tate with certain probability that the threat i imminent. Formally thi approach i realized by the imminent threat recognition algorithm that we preent in the next chapter. However, the general imminent threat recognition approach i hown in Fig Imminent Threat Recognition (Role Indentification) Algorithm efore introducing the imminent threat recognition algorithm let u aume that we already defined a ocial community according to the formula () and that it i alo defined a et of relation pattern graph decribing good (poitive) and bad (negative) behavior of one actor in the ocial network. ood pattern are indicated a i where i=...n and bad pattern are indicated a where =..m. Then for i each and we define the pattern graph imilarity function that evaluate the imilarity between the neighborhood of one node and the correponding relation pattern graph. It i defined a follow: i (, Rk ) where i = n (, R ) where = n ρ i... () ρ... k 70 Iue, Volume 5, March 008

5 Radolaw rendel and Henryk Krawczyk and ha the following feature: i : ρ : ρ The pattern graph can be defined in many form but one of the implet and mot natural would be to define them by mean of a et of matrice. The form in which the pattern graph i defined i not important. The only requirement i that the imilarity function ha to be able to handle the form and make the evaluation between the correponding relation pattern graph and the neighborhood matrix R k. The above definition of the pattern graph imilarity function allow to calculate the imilarity of one node' neighborhood in regard to one of the predefined pattern graph. However there i alo a need to define another imilarity function that etimate the overall imilarity level between one node' neighborhood and all of the relation pattern graph. Such a function, taking into account all the relation pattern graph, would anwer the quetion: i the neighborhood (the relation) of the conidered node v more imilar to a group of good or bad relation pattern graph. In other word, we want to aign a role to the actor. If the actor repreented by the node v behave regularly (conform to poitive pattern) we can ay he play a poitive role in the ocial network and analogically if the actor behave rather abnormally (having the relation more like in negative pattern) hi role i negative. Thi function, called the node' neighborhood imilarity function i defined a follow: l, k max = for i=..n and =..m. i 0; 0; i ( ρ ) max( ρ ) + (4) The above formula i defined in uch a way that it conform the following retriction:, k :, l k Now we are ready to introduce the imminent threat recognition algorithm that in practice identifie role of actor of the conidered ocial network. Practically two type of role of actor are identified: poitive and negative one depending on which type of the relation pattern graph an actor' relation are look like. The algorithm ue the node' neighborhood 0; imilarity function (formula (4)). However, it might happen that the formula (4) return a value that doe not allow to definitely identify the role played by the actor. In thi cae the role of the actor remain unclaified (unidentified). enerally, the algorithm during the role aignment proce ue everal level of node' neighborhood imilarity function that are hown in fig. 5. level l l min 0.5 l max l 0 arbitrary poitive role area Poitive role area Unclaified role area Negative role area arbitrary negative role area Figure 5. Variou level of imilarity ued by the role identification algorithm. The algorithm i defined in peudocode and i hown if fig.6. A an input it take the following value: l - minimum level of imilarity that ha to be reached by the imilarity function l, k for letting the correponding node v to be arbitrary identified a repreenting poitive role; l - maximum level of imilarity that can be reached by the imilarity function l, k for letting the correponding node v to be arbitrary identified a repreenting negative role; l min - the minimum level of imilarity that ha to be achieved by the imilarity function l,k for letting the correponding node v to be conidered a behaving normally, i.e. if the imilarity function l l ; the, k min l node v can be claified a behaving normally depending on the tendency of pat value of the node' neighborhood imilarity function; 7 Iue, Volume 5, March 008

6 Radolaw rendel and Henryk Krawczyk lmax - the maximum level of imilarity that can be achieved by the imilarity function l, k for letting the correponding node v to be conidered a behaving abnormally, i.e. if the imilarity function l, k l ; lmax the node v can be claified a behaving abnormally depending on the tendency of pat value of the node' neighborhood imilarity function; Δl - the maximum increment of imilarity level toward good behavior for node v that can be oberved during the lat event; the level i calculated in uch a way that it value are alway greater than or equal to 0 (zero). The exact procedure that calculate value of Δl i preented below in Fig. 7; Δl - the maximum increment of imilarity level toward bad behavior for node v that can be oberved during the lat event; the level i calculated in uch a way that it value are alway le or equal to 0 (zero). The exact procedure that calculate value of Δl i preented below in Fig. 8. CALCULATE l, k, Δl and IF l, k > l THEN node v ELSE IF l < THEN Δl i behaving normally, k l node v i behaving abnormally ELSE IF l, k lmin AND Δl > lmin THEN node v i behaving normally ELSE IF l, k lmax AND Δl < lmax THEN node v i behaving abnormally END IF Figure 6. Role identification algorithm IF ( Δl + ( l,k l, k )) > 0 Δl = Δl + ( l l ) new ELSE Δl new = 0 END IF LET Δl = Δl THEN new,k, k Figure 7. Calculating the value of Δl IF ( Δl + ( l,k l, k )) < 0 Δl = Δl + ( l l ) new ELSE Δl new = 0 END IF LET Δl = Δl THEN new,k, k Figure 8. Calculating the value of Δl A an example of how the role identification algorithm work, let u aume that in a certain ocial tructure we wanted to identify the role of one node, let u aume v 7. Let u alo aume that we have created four relation pattern graph: two for poitive role ( and, normal behavior) and two for negative role ( and, abnormal behavior). We oberved how the relation of the node v 7 were changing during three conecutive event (k=,,) and after each of them we calculated pattern graph imilarity function ( ρ, ρ, ρ, ρ ) and of coure the neighborhood imilarity function ( l, k ). The hypothetic reult are preented in Tab.. The graphical repreentation of the reult i hown in Fig. 9. Table. Sample evaluation of imilarity function for the hypothetic node v 7 after three conecutive event. # of event (k) ρ (,R 7 k) ρ (,R 7 k) ρ (,R 7 k) ρ (,R 7 k) l 7,k In Fig. 9 apart from value of l 7, k (k=0,,,) there are alo indicated value of Δl new and Δl after the k= event that allowed the role identification algorithm to identify node v 7 a a actor playing probably negative role in the conidered network. Preciely, the algorithm claified the uer identified a node v 7 a behaving abnormally becaue it node' imilarity function l 7, < l max and Δlnew Δl. The property of thi algorithm i that it i able to identify the role of an actor even if not all of the typical propertie of the role he or he tend to play have not been revealed yet. 7 Iue, Volume 5, March 008

7 Radolaw rendel and Henryk Krawczyk l,k (level) l l min 0.5 l max l 0 0 Δl new Δl 6 Spammer Identification Uing Imminent Threat Recognition Approach A an example of practical implementation of the propoed recognition approach we decided to ue it in identification of pammer. The goal wa to identify potential pammer in an network to prevent regular uer inboxe from being flooded with pam meage. Reearch on ing in Internet indicated that graph have propertie of typical ocial relation network [9][]. Thu, group of people ( uer) tend to form local communitie, where their member are tightly connected between each other. However, occaionally ome anomalie can be oberved that diturbance the regularitie in the graph. Thee diturbance can be the firt ymptom of unuual traffic that we ued to call pam. In the war of pam the probability of a victory i highly related to the early detection of pammer activitie. That i becaue pammer tend to act by urprie and dynamically. If the detection time of pammer activity i not hort enough, they will reach the goal, i.e. their will arrive at their detination. Following the recognition approach decribed in the previou paragraph we etablihed a five-tep algorithm that let u identify role of uer and claify them into one of the following lit: SL (Spammer Lit), RL (Regular Uer Lit) and UL (Unidentified Uer Lit). It conit of the following tep:. Initial load of hitorical data to tart the role identification of uer we need to load l l k (event) Figure 9. Early identification of actor' negative role. hitorical data collected for a certain period of time.. Initial identification of all the node it erve a a reference point for all the further evaluation.. Add the incoming to the graph every e- mail that come i added to the relation graph and the ender clutering coefficient (CC [9]) value i updated (CC i often ued in pattern graph imilarity function). 4. Calculate adequate imilarity function for each ender node whoe neighborhood ha been changed by the event here come all the evaluation of imilarity function aociated with each relation pattern graph; 5. Identify role of all the uer whoe neighborhood ha been changed by the event uing role identification algorithm. In our cae the relation graph repreent exchanged by the uer for a certain period of time. The time ha to be long enough to let all the typical relation between the uer to be etablihed. In our tet we oberved traffic related to one of the facultie of the dank Univerity of Technology. It turned out that one-month period of obervation of traffic between local uer and outide world wa enough. Further collecting of data did not change the graph ignificantly. It mean that after one month maor relation between uer were already etablihed. Next, we ditinguihed typical pammer and regular uer behavior and decribed them in the form of relation pattern graph. Finding right pattern graph i probably the mot crucial part of the whole proce. It alo point out how well we know the community we want to protect and whether we are able to decribe preciely the threat againt which we intend to protect the community. Of coure a et of the pattern graph i dynamic in the ene that once iolated graph can change over time and new once can come out. For every pattern graph it i required to create a pattern graph imilarity function ( ρ or ρ ) that will calculate a congruity between the pattern graph and an indicated part of the relation graph. elow we preent a ample pattern graph imilarity function that can be aociated with one of the pammer pattern graph preented in Fig. ii. Thi type of pammer we claified a MT-OF (Multiple-Time One-Face) and it characteritic property i ending to many regular uer alway being preented under the ame identity. The other property of thi kind of pammer i that it direct hi meage to a looely coupled group of 7 Iue, Volume 5, March 008

8 Radolaw rendel and Henryk Krawczyk uer that uually do not know each other. The imilarity function ue clutering coefficient value of a node calculated according to the formula propoed by Watt and Strogatz [9]. Thu, the ample pattern graph formula can be of the form: CCk N for V CC CC, k 5 k min ρ (, Rk ) = CCmin (5) 0 otherwie where CCk - clutering coefficient for v after k-th event, CC min - minimum value of clutering coefficient required for the node to be claified a nonpammer. Let u aume CC min = 0.. According to thi evaluation one node can be claified to a certain group of uer where each group would repreent a level of upicion of it member. If we make the calculation over all the node at the certain time, it i alo poible to ae the overall ecurity level for a whole community. Of coure the formula calculating thi level i tied with the pecific community taking into account not only the imilarity level calculated for each node but alo, for intance, the importance (or power) each node ha in the community. event v In Fig. 0 it i preented a part of the relation graph illutrating how the neighborhood of the node v wa changing over time becoming more and more imilar to the defined pattern graph. Let u aume that the ender repreented by the node v ent at three different moment that correpond to event marked in Fig. 0 a, and. Evaluating the pattern graph imilarity function ( ρ ) after every event we obtain: ρ, ( R ) = / v v ρ ρ, ( R ) = / , ( R ) = / The lat calculation indicate that the node v in the relation graph repreent a pammer with the level of imilarity equal to We can confirm in our belief looking at the tendency of change of the imilarity value over time. Of coure to make our aement more truty we have to take into account reult for all the imilarity function aociated with relation pattern graph, both pammer pattern graph and regular uer pattern graph in repect to the node v. Analyzing how the imilarity value change over time for all the pattern graph for every node we can early point out the node that tend to behave like pammer and with a certain probability mark incoming a pam meage. Our imple example howed how we can identify one node to be a pammer by etimating how hi behavior i different from (or cloe to) a typical behavior decribed by a pecific pattern graph. Fig. 0. The neighborhood of node v become more imilar to pam pattern graph over time. 7 Tet and reult Uing the role identification algorithm preented above we made a tet with a local community coniting of uer of one of the facultie of dank Univerity of Technology including other external uer communicating with thi faculty member. Initial load of the relation graph wa made on the bai of ytem erver log file with regitered traffic related to the uer of the faculty. After that we made an initial role identification of all the node repreenting ender we are going to claify over time. Initial evaluation erve a the firt referencing point when analyzing tendency of change in value of the pattern graph imilarity function. After the initial one-month period, we collected all the incoming for one-week making the on-line role identification of uer. Almot meage were collected containing pam 74 Iue, Volume 5, March 008

9 Radolaw rendel and Henryk Krawczyk and regular meage. When an arrived the ender wa firt claified a pammer or regular uer according to the reult obtained from the node' neighborhood imilarity function. ecaue the role identification wa baed on value repreenting level of imilarity of one node to be a pammer or regular uer, it wa neceary to etablih ome threhold ued then in role identification algorithm. Finally, every uer ha been claified on one of three lit: RL (Regular Uer Lit), SL (Spammer Lit) and UL (Unrecognized Uer Lit). The reult of the tet are hown in Fig.. Non-pammer 50 uer [0% of all] Non-pammer RL 95% Spammer Role identification procedure SL 5% SL 77% Legend: SL=Spammer Lit; RL=Regular Uer Lit UL=Unidentified Uer Lit 805 uer [70% of all] Spammer UL 4% RL 9% Fig.. The reult of role identification proce. During the tet we claified the amount of 55 uer of Internet community. 0% of them were regular uer, the ret repreented a group of pammer. Conidering regular group of uer, 95% of them were correctly identified a non-pammer and only 5% wa miclaified a pammer. Contrarily about 9% of pammer were identified a regular ( poitive ) uer and 77% ha been aigned the correct role of pammer. Only 4% of uer wa left unclaified (the procedure could not uniquely aign any role to them). 8 Concluion The paper preented the general recognition approach of imminent threat to a community uing ocial relation graph. The critical part of thi approach refer to the proce of building relation pattern graph that decribe what i typical (acceptable) and abnormal behavior of the certain community. We need pecial monitoring technique and identification algorithm to define uch graph. Moreover, the pattern graph can alo change over time what make behavior claification much more difficult. We want to underline, that our propoition i flexible to conider the mot difficult to detect cla of pammer called tranient pammer. It allow for taking into account the dynamic apect of relation between actor that tend to change over time. From the ecurity point of view a tate in which every part of the relation graph matche one of the pattern graph repreenting typical relation can be treated a ecure one and any exception to thi tate can indicate ecurity compromie. Of coure exact matching happen rarely o it i more practical to meaure the level of congruity between pattern graph and the relation graph. The graphical repreentation of uch ituation (ee Fig. 9) allow an expert to take final deciion. We howed how the recognition approach can be ued in role identification proce. We identified each uer of a ample Internet community a pammer, regular uer, ome of them leaving them unidentified, however. Nonpammer uer were claified efficiently, only 5% of them were miclaified. Unfortunately a ignificant part (about 0%) of pammer were claified a regular uer (role identification failed). The main reaon of it wa that pammer were able to reach local communitie of uer. It mean that although thi method i very efficient in recognizing typical activity of uer, abnormal behavior require additional pattern graph to be created. Thee could take into account domain name of ender, IP addree of e- mail erver and the poibility that generally the ender can forge their name. In repect to uer identification the propoed recognition trategy can give epecially good reult when we combine it with other technique like content-baed antipam tool. The propoed method correctly recognize about 80% of all the uer. After further improvement in pam claification thi method can become a very effective tool in the initial pam recognition proce leaving only a mall part of all meage to be claified finally by heavy load content-baed analyi tool. 75 Iue, Volume 5, March 008

10 Radolaw rendel and Henryk Krawczyk Reference: [] L. A. Adamic, Zipf, power-law, and Pareto a ranking tutorial ng/ranking.html. [] P.O. oykin, V. P. Roychowdhury, Leveraging ocial network to fight pam, IEEE Computer, April 005 [] U. rande, T. Erlebach, Network Analyi. Methodological Foundation, Springer, 005 [4] R.rendel, H.Krawczyk, Spam claification method baed on uer communication graph, Proceeding of The Second IEEE International Conference on Technologie for Homeland Security and Safety, Kadir Ha Univerity 006 [5] R.rendel, H.Krawczyk, Detection Method of Dynamic Spammer' ehavior, Proceeding Of International Conference on Dependability of Computer Sytem, Szklarka Poreba, Poland 007, [6] P. J. Carrington, J. Scott, S. Waerman, Model and Method in Social Network Analyi, Cambridge Univerity Pre, 007 [7] R. Dietel, raph Theory, Electronic Edition 005, Springer-Verlag Heidelberg, New York 997, 000, 005 [8] H. Ebel, L-I. Mielch, and S. ornholdt, Scale-free topology of network, Phyical Review E 66, 050(R) (00) [9] Z. yongyi, H. arcia-molina, Spam: it not ut for inboxe anymore, IEEE Computer, October 005 [0] M.E.J. Newman, The tructure and function of complex network, March 00 [] M.E.J. Newman, S. Forret, and J. althrop, network and the pread of computer virue, Phyical Review E 66, 050(R) (00) []. Whitworth, E. Whitworth, Spam and the ocial-technical gap, IEEE Computer, October 004 [] S. Waerman, K. Faut, Social Network Analyi. Method and Application, Cambridge Univerity Pre, Iue, Volume 5, March 008