Transcription

1 Incremental Learnng wth Feature Shft Detecton for Personalzed E-mal Spam Flterng Gop Sanghan 1, Dr. Ketan Kotecha 2 1 Computer Engneerng Department, Nrma Unversty, Ahmedabad , Inda. 2 Parul Unversty, Waghoda, Vadodara , Inda. gopsanghan@gmal.com, drketankotecha@gmal.com Abstract:An ever ncreasng rato of spam e-mals over legtmate e-mals and adversaral nature of spam e-mals lead to the requrement of employng spam flter that can be updated dynamcally. Moreover, the dscrmnaton crtera of spam and legtmate e-mals may vary for dfferent users. Ths leads to the personalzaton of e-mal spam flter whch automatcally adapts ndvdual user s characterstcs. We present an ncremental learnng model usng support vector machne for personalzed e-mal spam flterng. We propose a novel feature dstrbuton shft detecton functon to determne the necessty of updatng the feature set and dentfyng new features wth hgher dscrmnatng ablty from an ncomng set of e-mals. The proposed classfer s evaluated on ECML datasets. The results confrm the applcablty of our model n the presence of feature dstrbuton shft. Our ncremental model acheves superor performance over a conventonal batch learnng model. Keywords:Feature dstrbuton shft, Incremental Learnng, Personalzed e-mal spam flter, Support Vector Machne. 1. Introducton One of the major parameters n the success of Artfcal Intellgence applcatons n real lfe s adaptablty of algorthms towards ncremental learnng process. In a learnng process, the current knowledge base s updated contnually or at a regular nterval of tme that may modfy the state of the current decson model. Ths requrement leads to the ncluson of ncremental learnng process wth conventonal learnng algorthms. Incremental learnng s a machne learnng paradgm where the current model s modfed whenever new example(s) appear over a perod of tme and contrbute some dfferent knowledge to the exstng hypothess. A very sgnfcant conventonal formulaton of machne learnng algorthms s classfcaton problems. Machne learnng approaches for classfcaton follow the generaton of a dscrmnatve model whch learns from the avalable knowledge (the tranng set) and apples the learned hypothess to classfy unseen data (the test set). The ablty to nclude addtonal tranng data when t becomes avalable and to re-learn from them s a promnent feature of the ncremental learnng process. In many of the real lfe classfcaton problems, the nput s gven n the form of data streams, whch eventually lead to the applcaton of ncremental learnng process. The data stream classfcaton technques have to deal wth the dynamcally changng data dstrbutons whch cause the phenomenon of dstrbuton shft or concept drft. In real concept drft the nput data dstrbuton.e. feature dstrbuton may not change, only the class label changes. And the vrtual concept drft occurs as a result of the change n the underlyng data dstrbuton or unavalablty of tranng data [11, 28]. In ths research, we present an ncremental learnng framework for personalzed e-mal spam flter wth dynamc feature shft detecton. Machne learnng algorthms are extensvely used n text classfcaton problems. Personalzed e-mal spam flter s the most prevalent applcaton of automated bnary text classfcaton problems. Gven a tranng set of n labeled sample e-mals T = {t1, t2,, tn} and C = {cl, cs} denotes e-mal categores: legtmate and spam. The task s to learn dscrmnant functon, whch classfes prevously unseen e-mals nto one of the two categores based on ther content. E-mal remans to be hghly formalzed, offcal and ndspensable communcaton medum even after ncreasng use of socal networkng applcatons. However, the nevtable downsde of t s a contnuously growng rato of unwanted and useless e-mals. A huge number of unsolcted e-mals are delvered to the nternet users regardless of a personal or commercal level of nterests. Content based e-mal spam flter s one of the hghly challengng tasks due to two major reasons, the content of spam e-mals changes over a tme, as a result of whch feature dstrbuton shft occurs n spam e-mals and dfferng crtera of ndvdual users for spam and legtmate e-mal dscrmnaton. The research work presented here addresses these challenges by applyng ncremental learnng model wth detecton of feature dstrbuton shft. The major outlne of our work s gven as follows: 1. To propose an ncremental learnng framework usng support vector machne. 2. To propose a novel feature dstrbuton shft detecton functon based on normalzed average dscrmnatve weght. The rest of the paper s organzed as follows. In Secton 2 we summarze related work on personalzed e-mal spam flter, ncremental learnng and concept drft detecton. We present our ncremental framework wth dynamc feature shft detecton for personalzed e-mal spam flter algorthm n Secton 3. Secton 4 descrbes the n-depth experments we perform and the dscusson on results obtaned. Secton 5 concludes the paper wth an nsght nto the future work. A UGC Recommended Journal Page 34

2 2. Related work For a personalzed e-mal spam flterng, a flter s employed by a sngle user as a clent-sde flter and messages dentfed as spam are usually sent to spam folder. Fltron [5], a personalzed ant-spam flter based on machne learnng text categorzaton paradgm, had been evaluated n real lfe scenaro that confrmed the promnent role of machne learnng technques for ant-spam flterng. Gray & Haahr [1] present the concept of personalzed, collaboratve spam flterng named as CASSANDRA archtecture. Cheng & L [29] proposed combned supervsed and sem-supervsed Classfer usng SVM for Personalzed Spam Flterng. In the Two-ter Spam Flter Structure presented by Teng & Teng [27], e-mals classfed as legtmate mals by the legtmate mal flter may pass, whle the remanng e-mals are processed by the spam flter n an ordnary way. Chang, Yh, & McCann [17] desgned a lght-weght user model that s hghly scalable and can be easly combned wth a tradtonal global spam flter. Youn & McLeod [26] proposed an effcent spam e- mal flterng method usng ontologes n whch user profle ontology creates a blacklst of contacts and topc words. A personalzed spam flter s presented by Junejo & Karm [16] usng an automatc approach whch bult a statstcal model of spam and non-spam words from the labeled tranng dataset and then updates t n two passes over the unlabeled ndvdual user s nbox. The flter presented by Shams & Mercer [24] usng natural language attrbutes, the majorty of them beng connected to stylometry aspects of wrtng. Ghanbar & Begy [4] proposed the algorthm called ncremental RotBoost, an ncremental learnng algorthm based on ensemble learnng. Hsao and Chang [30] developed ncremental cluster-based classfcaton method, called ICBC wth two phases. In the frst phase, t clusters emals n each gven class nto several groups, and an equal number of features are extracted from each group. In the second phase, ICBC s capactatng wth an ncremental learnng mechansm that can adapt tself to accommodate the changes of the envronment n a fast and low-cost manner. Georgala, Kosmopoulos, and Palouras [15] proposed Actve Learnng Approach usng Incremental Clusterng for spam flterng. The user provdes the correct categores (labels) for the messages of the frst batch and from then on the algorthm decdes when to ask for a new label, based on a clusterng of the messages that s ncrementally updated. Tannpong and Ngamsuryaroj [23] proposed an ncremental spam mal flterng usng Naïve Bayesan classfcaton n whch the sldng wndow concept s appled to keep the tranng set to a lmted sze and the tranng set s updated when new emals are receved. In effect, features n the tranng set are ncrementally updated so, the model would be adaptve to a new spam pattern. Incremental tranng algorthm usng SVM has been successfully evaluated for personalzed spam flterng n [7]. The performance of content based classfcaton algorthms strongly reles upon the selecton of most relevant and dscrmnatve features. Over a tme, relevancy of features vares n the presence of concept drft. Kataks et al. [9] proposed the ncremental feature selecton and feature based classfcaton for textual data streams. The work of Delany et al. [25] present spam flterng system that uses example based machne learnng technques to track concept drft. In [10] kataks et al. presented ensemble classfers to track recurrng contexts whch occur n e-mal spam flterng. Gomes et al. [12] presented a data stream classfcaton system to address the challenges of learnng recurrng concepts n a dynamc feature space. Henke et al. [19] analyzed the evoluton of features n the presence of concept drft for spam detecton. Kmecak and Stefanowsk [18] ntroduced an approach to detect drft n unlabeled data and retran a classfer usng a lmted number of labeled examples. Sheu et al. [14] presented a wndow based ncremental learnng technque for trackng concept drft n spam flterng by checkng only header secton of e-mals. 3. Proposed algorthm for feature shft detecton n ncremental learnng Over the past few years, many effcent e-mal spam flters are bult and appled to block spam e-mals. Tradtonal server based spam flters are traned on generc mal corpus and then, commonly appled to a user s nbox to detect spam and legtmate e-mals. Many mal boxes facltate user defned settngs for the categorzaton of the mportant e-mals. Stll, the end user remans hghly dependent on the dscrmnaton of e-mals characterzed by the general tranng corpus. The essental advantage s users are releved from the burden of processng thousands of unsolcted e-mals. But only global flters cannot optmally reflect ndvdual user s characterstcs whle dscrmnatng e-mals. As an extensve model, the personalzed e-mal spam flter s requred whch facltate robustness and should be adaptve to ndvdual user s preferences. The dscrmnaton crtera tend to change over a perod of tme. Also, the content pattern of spam e-mals can be descrbed by the nature and appearance characterstcs of e-mals. It can be characterzed as regularly appearng spam e-mals, appearng for a short duraton of tme and appearng at some nterval.e. recurrng context. So, there s a need to update the flter dynamcally to tackle feature dstrbuton shft that occurs because of adversaral patterns of spam e-mals. 3.1 Incremental Learnng wth SVM Conventonal learnng models follow the assumpton that tranng and test data observe the same statstcal dstrbuton of data. But n the presence of dstrbuton shft, the decson model learned from the tranng data A UGC Recommended Journal Page 35

3 may not approprately classfy the new examples and so, the classfer performance s degraded. The ncreased error rate ndcates the requrement of updatng the classfcaton model. Our ncremental learnng framework enables the classfer to learn new nformaton derved from the ncomng set of examples and at the same tme, t holds the prevously acqured knowledge. Our algorthm s developed as follows: the flterng process s carred out over three passes. The frst pass s performed usng conventonal batch tranng, wth n labeled examples, that generates the dscrmnant functon F(x). Pass II comprses a seres of testng phases n whch small batches of ncomng unlabeled e-mals are gven to dentfy true labels. Pass III s carred out by actvatng ncremental retranng whenever the performance crtera are volated. In order to handle the feature dstrbuton shft, we propose a novel feature shft detecton functon to be appled before actvatng an ncremental tranng, whch s explaned n the subsequent subsecton. The flow of our ncremental algorthm s presented n fg. 1. Many content based spam flters apply machne learnng technques, of whch support vector machnes have shown consstently superor performance. SVM was ntally appled for spam categorzaton by Drucker, Wu, and Vapnk [8]. Snce then varous extensons and onlne and actve learnng approaches have been presented by many researchers because of SVM s good generalzaton ablty and hgher classfcaton accuracy. Support vector machnes [3] are supervsed machne learnng algorthm also known as optmal margn classfers. SVM algorthm maps nput vectors nto a feature space of hgher dmenson and constructs an optmzed hyper plane for generalzaton. In bnary classfcaton problem, a data set X contans n labeled example vectors {(x1, y1)... (xn, yn)}, where x be the nput vector n the nput space, wth correspondng bnary labels y ϵ {-1, 1}. Let φ(x) be the correspondng vectors n feature space, where φ(x) s the mplct kernel mappng and let k(x, xj) = φ(x). φ(xj) be the kernel functon, mplyng a dot product n the feature space. The optmzaton problem for a soft-margn SVM s, mn w C. (1) w, b Subject to the constrants y (w.x + b) = 1 ξ and ξ 0 where w s the normal vector of the separatng hyper plane n feature space and C > 0 s a regularzaton parameter controllng the penalty for msclassfcaton. Equaton (1) s referred to as the prmal equaton. From that, the Lagrangan form of the dual problem s: w max 0.5 y y k x, x (2) Subject to 0 α C. Ths s a quadratc optmzaton problem that can be solved effcently usng algorthms such as Sequental Mnmal Optmzaton (SMO) [13]. Many α go to zero durng optmzaton and the remanng x correspondng to those α > 0 are called support vectors. If l s the number of support vectors and α > 0 for all, wth ths formulaton, the normal vector of the separatng plane w s calculated as:, j j j j w (3) y x The classfcaton f(x) for a new sample vector x can be determned by computng the kernel functon of x wth every support vector: f x sgn yk x, x b (4) Fgure 1. Incremental model wth feature shft detecton for personalzed e-mal spam flterng A UGC Recommended Journal Page 36

4 Syed et al. [20, 21] proposed the framework for ncremental learnng of support vector machne wth a new batch of data and set of support vectors, whch precsely represents the separatng hyper plane. In ths research, we present the ncremental algorthm by applyng perodc retranng of support vector machne wth a small number of addtonal tranng examples and an exstng support vector set. An mportant property SVM possesses s, a set of support vectors represents the feature space and class boundares n a very concse manner. So, ncremental SVM can be traned by preservng support vectors and addng them to the next batch of ncomng examples [2, 22] Feature shft detecton and feature set update Due to a constant change n the spam patterns, the classfcaton model requres the dynamc updates to mantan and upgrade the flter performance. Our ncremental learnng framework ncorporates the feature shft detecton functon before actvatng re-tranng of a classfer. Ths functon dentfes the necessty of updatng the feature set, also t derves new features to be ncluded n the orgnal feature set. Thereby reducng the overhead whch may otherwse be caused every tme before re-tranng. The feature shft detecton & feature set update algorthm s descrbed n fg. 2. The algorthm generates a new subset of features from the re-tranng set of spam and legtmate e-mals wth true labels. From ths set dstnct features are found wth ther respectve dscrmnatve weght. Each such dstnct feature s dscrmnatve weght s compared wth the average dscrmnatve weght avdm of the feature set used durng prevous tranng of the classfer. If features wth hgher dscrmnatve weght than avdm exst than the current feature set s updated as shown n step 5 n table 1. Modfyng the feature set causes the classfer to effectvely re-learn the change of data dstrbuton from the new set of examples. In the case of e-mals, spammers also try to elude flters and frequently change spammy features, though over a long span of tme tradtonal features and latest features both are essental for effcent flterng. Updatng feature space before actvatng ncremental tranng s requred to nclude new features wth hgher dscrmnatng ablty. The re-tranng wth updated feature set results n modfed dscrmnant functon F (x), whch further classfes the ncomng examples. 4. Experments and Results The proposed ncremental learnng model usng SVM for personalzed e-mal spam flter has been evaluated by performng detaled experments on ECML datasets [6]. Support vector machne s a dscrmnatve classfer that drectly learns the boundary between classes. It learns a decson boundary that maxmzes the dstance between samples of the two classes. Input: 1. Current feature set FS current 2. Re-tranng set RS +1 = MCM SV TSk Where, MCM mss-classfed e-mals wth true labels SV Set of support vectors TSk Set of testng e-mals for whch ncremental tranng s to be actvated Output: Updated feature set FS updated 1 Intalze FS updated =FS current 2 Generate new subset of features FS new from retranng set RS +1 3 Calculate the average dscrmnatve weght per feature avdm from FS current 4 Fnd each dstnct feature F d from FS new such that, F d FS new \FS current Add the feature to the another set call dstnct feature set FS dstnct as follows: If dm(f d ) avdm then FS dstnct = FS dstnct F d 5 If FS dstnct NULL then update FS updated as, For each feature F j n FS dstnct FS updated = FS updated F j FS updated = FS updated {F k F k has the lowest dscrmnatve weght} 6 Return FS updated Fgure 2. Algorthm for Feature Shft Detecton and Feature Set Update A UGC Recommended Journal Page 37

5 4.1. Expermental Data and Implementaton Detal The ECML task-a and task-b datasets were made publcally avalable durng 2006 ECML-PKDD Dscovery Challenge. The dataset contans the processed form of e-mals where each feature n an e-mal s represented by an d-count par. Features are extracted n form of token d and emal s represented as a feature vector wth term frequences. We apply sequental mnmal optmzaton (SMO) algorthm for tranng SVM. SMO algorthm s desgned and used to avod solvng a quadratc programmng (QP) problem of SVM model. SMO algorthm follows decomposton approach and at every step, t analytcally updates the coeffcent of two vectors selected heurstcally. To fnd the dscrmnatve weght of features we use Informaton Gan [31] feature selecton functon Results and Dscussons Experments on ECML datasets are conducted to analyze the ncremental personalzed e-mal spam flter performance n the presence of dstrbuton shft. ECML task-a dataset contans 4000 emals wth 2000 spam and 2000 legtmate emals. The sze of tranng dataset ECML task-b s 100 only wth 50 spam and 50 legtmate emals. Test data for task-a contans 3 user nboxes wth 2500 emals each. And task-b test data conssts of 15 dfferent user nboxes wth 400 emals each. Both ECML task-a and task-b tranng and test datasets follow the smlarty n the proporton of spam and legtmate e-mals only. The source of data n tranng and testng follow a dfferent dstrbuton. We conduct our experments n two parts. The frst part focuses on observng the behavor of the ncremental learnng model over a conventonal batch learnng model. Generally, the classfer learns the statstcal dstrbuton of data durng tranng and the dscrmnant functon s generated. The dscrmnant functon can effcently classfy un-labeled e-mals from testng data tll the test data follows the same dstrbuton. When dstrbuton shft occurs, the dscrmnant functon s updated by actvatng ncremental tranng to mantan and mprove the flter performance. In ECML Datasets tranng data and testng data follow a completely dfferent dstrbuton. So, SVM s conventonal tranng results nto a statc flter, whch perform less effcently n classfyng the test datasets. But f the flter s ncrementally updated by addng a small number of addtonal examples taken from test data, the flter performance s sgnfcantly mproved. Fgure 3(a). ECML Dataset - Classfcaton Accuracy Results Fgure 3(b). ECML Dataset - ROC Fgure 4(a). ECML Dataset - False postve rate Results Fgure 4(b). ECML Dataset - False negatve rate Results A UGC Recommended Journal Page 38

6 Fg. 3(a) shows the comparson of accuracy n batch learnng and ncremental learnng model usng SVM. Another tradtonal characterstc usually requres the comparatvely large number of tranng examples to tran dscrmnatve functon completely. ECML task-b contans only 100 tranng examples though; the ncremental tranng enables the flter to substantally mprove the results.the second part of an experment s carred out wth an am of detectng the feature shft dstrbuton that occurs when the dstrbuton of data s non-statonary and the test data s generated from dfferent underlyng dstrbutons than the tranng data. The dscrmnatve models have strong dscrmnaton ablty but ther modelng capablty s lmted snce they are focusng on classfcaton boundares as n SVM. In ECML datasets test datasets are taken from ndvdual user s malbox. The feature space representng each ndvdual test data folder s dfferent than the feature space generated from tranng data. Therefore, the need arses to personalze the flter and to retran t n an updated feature space. Our proposed feature shft detecton functon determnes the necessty for updatng feature set and dentfes new features wth hgher dscrmnatve ablty. These new features are ncluded n the feature set by replacng the old features wth lowest dscrmnatve weght n order to keep the same feature dmenson. Fgure5 (a). Error Rate for ECML B dataset Fgure5 (b). Error Rate for ECML A dataset Dataset ECML TASK-A ECML TASK-B Table 1: ECML Datasets Results Inbox SVM Incremental Tranng wth updated Feature Set SVM Conventonal Batch Tranng Precson Recall F1 Measure Precson Recall F1 Measure USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER USER The second part of an experment s carred out wth an am of detectng the feature shft dstrbuton that occurs when the dstrbuton of data s non-statonary and the test data s generated from dfferent underlyng dstrbutons than the tranng data. The dscrmnatve models have strong dscrmnaton ablty but ther modelng capablty s lmted snce they are focusng on classfcaton boundares as n SVM. In A UGC Recommended Journal Page 39

7 ECML datasets test datasets are taken from ndvdual user s malbox. The feature space representng each ndvdual test data folder s dfferent than the feature space generated from tranng data. Therefore, the need arses to personalze the flter and to retran t n an updated feature space. Our proposed feature shft detecton functon determnes the necessty for updatng feature set and dentfes new features wth hgher dscrmnatve ablty. These new features are ncluded n the feature set by replacng the old features wth lowest dscrmnatve weght n order to keep the same feature dmenson. Classfcaton results show that ncremental tranng of SVM on a set of support vectors and a new set of examples allows obtanng and sgnfcantly mprovng the accuracy of the flter. Ths also confrms the role of support vectors for ncrementally tranng SVM by usng the old soluton as a startng pont to fnd an updated soluton. Table 1 shows precson, recall and F1 measure, the most common performance measures n bnary classfcaton. Fg. 3(a) shows the comparson of accuracy acheved n ncremental tranng and conventonal batch tranng of SVM. Fg. 3(b) shows ROC curve for comparson of true postve rate (TPR) vs. false postve rate (FPR). The occurrence of False Postves (FP),.e. legtmate emals classfed ncorrectly as spam degrades the flter performance. An FP s sgnfcantly more harmful than a False Negatve (FN).e. a spam emal ncorrectly classfed as legtmate. Very low FPR s acheved n ncremental SVM learnng. Fg. 4(a) and (b) show the precse comparson for FPR and FNR n both the ncremental and batch learnng models. Fg. 5(a) and (b) present the error rate n ncremental learnng model. The error rate decreases over tme as a number of testng phases ncreases. 5 Concluson and Future work Emal spam flterng on a personalzed level has been one of the most challengng classfcaton tasks n the presence of dstrbuton shft. We employed ncremental learnng model so, the dscrmnant functon learns the modfed dstrbuton of data and the flter s updated dynamcally. The proposed ncremental learnng algorthm outperforms over a batch learnng model and acheved very low false postve rate. Also, the feature dstrbuton shft detecton functon effectvely determnes when to update the feature set and new features wth hgher dscrmnatve ablty. Expermental results confrm the applcablty of our unque approach usng ncremental learnng of SVM wth the heurstcally updatng feature set for mprovng the effcency and consstently mantanng the performance of the classfer. The future work addresses to develop an algorthm whch derves a feature dscrmnaton weght and contnually montors the change n feature patterns for the predcton of a shft. Acknowledgment We are thankful to the Nrma Unversty for provdng resources and other facltes to carry out ths research work. References [1]. A. Gray and M. Haahr, Personalsed, collaboratve spam flterng, n Proceedngs of 1st Conference on Emal and Ant-Spam, [2]. A. Shlton and M. Palanswanm, Incremental learnng of Support Vector Machnes, IEEE transactons on neural networks, vol. 16, pp , [3]. C. Cortes and V. Vapnk, Support-vector networks. Machne Learnng, 20, , [4]. E. Ghanbar and H. Begy, Incremental RotBoost algorthm: An applcaton for spam flterng. Journal Intellgent Data Analyss archve, 19 (2), 2015, pp , IOS Press Amsterdam, The Netherlands. [5]. E. Mchelaks, I. Androutsopoulos, G. Palouras, G. Sakks, and P. Stamatopoulos, Fltron: a learnng-based antspam flter, In Proc.1st Conf. on Emal and Ant-Spam; [6]. ECML-PKDD: Dscovery challenge. (2006). [7]. G. Sanghan and K. Kotecha, Personalzed spam flterng usng ncremental tranng of support vector machne, Internatonal Conference on Computng, Analytcs and Securty Trends (CAST), Pune, pp [8]. H. Drucker, D. Wu, and V. Vapnk, Support vector machnes for spam categorzaton, IEEE Transactons on Neural Networks, 10(5), , [9]. I. Kataks, G. Tsoumakas, and I. Vlahavas, On the utlty of ncremental feature selecton for the classfcaton of textual data streams. In 10th Panhellenc Conference on Informatcs (PCI 2005), pages Sprnger-Verlag. [10]. I. Kataks, G. Tsoumakas, and I. Vlahavas, Trackng recurrng contexts usng ensemble classfers: An applcaton to emal flterng, Knowledge and Informaton Systems, Sprnger London; 22(3): , IEEE Transactons on Neural Networks and Learnng Systems, 25(1):95 110, [11]. J. Gama, I. Žlobatė, A. Bfet, M. Pechenzky, A. Bouchacha, A survey on concept drft adaptaton. ACM Computng Surveys (CSUR), 46 (2014) [12]. J. Gomes, M. Gaber, P. Sousa, and E. Menasalvas. Mnng recurrng concepts n a dynamc feature space. [13]. J. Platt, Fast tranng of support vector machnes usng sequental mnmal optmzaton," n Advances n Kernel Methods - Support Vector Machnes, MIT Press, Cambrdge, pp , A UGC Recommended Journal Page 40

8 [14]. J-J Sheu, K-T Chu, N-F L, and C-C Lee, An effcent ncremental learnng mechansm for trackng concept drft n spam flterng. PLoS ONE12(2): e [15]. K. Georgala, A. Kosmopoulos, and G. Palouras, Spam Flterng: an Actve Learnng Approach usng Incremental Clusterng. 2014, WIMS Thessalonk, Greece Copyrght s held by the owner/author(s).publcaton rghts lcensed to ACM. [16]. K. Junejo, A. Karm, Robust personalzable spam flterng va local and global dscrmnaton modelng, Knowledge and Informaton Systems, Vol. 34, No. 2, pp , [17]. M. Chang, W. Yh, and R. McCann, Personalzed spam flterng for gray mal. In CEAS-08: Proceedngs of 5th Conference on Emal and Ant-Spam, [18]. M. Kmecak and J. Stefanowsk, Handlng sudden concept drft n Enron message data streams, Control and Cybernetcs, vol. 40, no. 3, pp , [19]. M arca Henke, Eduardo Souto, and Eulanda M dos Santos, Analyss of the evoluton of features n classfcaton problems wth concept drft: Applcaton to spam detecton, n IFIP/IEEE Internatonal Symposum on Integrated Network Management (IM). IEEE, 2015, pp [20]. N. Syed, H. Lu, and K. Sung, Handlng concept drft n ncremental learnng wth support vector machnes, In Proceedngs of the ACM SIGKDD Internatonal Conference on Knowledge Dscovery and Data Mnng (KDD- 99), San Dego, CA, USA. [21]. N. Syed, H. Lu, and K. Sung, Incremental learnng wth support vector machnes. In Proceedngs of the Workshop on Support Vector Machnes at the Internatonal Jont Conference on Artfcal Intellgence (IJCAI-99), Stockholm, Sweden. [22]. P. Laskov, C. Gehl, S. Krüger, and K-R. Müller, Incremental support vector learnng: analyss, mplementaton and applcatons. J Mach Learn Res 7: , [23]. Phmphaka Tannpong and Sudsanguan Ngamsuryaroj, Incremental Adaptve Spam Mal Flterng Usng Naïve Bayesan Classfcaton. Proc. 10th ACIS Internatonal Conference on Software Engneerng, Artfcal Intellgences, Networkng and Parallel/Dstrbuted Computng, 2009, pp [24]. R. Shams and R. Mercer, Personalzed spam flterng usng natural-language attrbutes, 12th IEEE Internatonal Conference on Machne Learnng Applcatons, Florda, USA, [25]. S. J. Delany, P. Cunnngham, A. Tsymbal, and L. Coyle, A case-based technque for trackng concept drft n spam flterng. Knowledge-Based Systems, 18(4 5): , [26]. S. Youn, and D. McLeod, Spam decsons on gray e-mal usng personalzed ontologes, SAC, page , ACM, [27]. Teng We-Lun and Teng, We-Chung, A personalzed spam flterng approach utlzng two separately traned flters, n WI-IAT 08: Proceedngs of the 2008 IEEE/WIC/ACM Internatonal Conference on Web Intellgence and Intellgent Agent Technology, IEEE Computer Socety [28]. Wdmer, G., & Kubat, M. (1996). Learnng n the presence of concept drft and hdden contexts. Machne Learnng, 23(1), [29]. V. Cheng, C. L, Personalzed spam flterng wth sem-supervsed classfer ensemble, n WI-06: Proceedngs of the IEEE/WIC/ACM Internatonal Conference on Web Intellgence, IEEE Computer Socety, pages , [30]. W. -F. Hsao, and T.-M. Chang, An Incremental Cluster-Based Approach to Spam Flterng. Expert Systems wth Applcatons, 34(3), , [31]. Y. Yang and J. Pedersen, A comparatve study on feature selecton n text categorzaton, n Proceedng ICML '97 Proceedngs of the Fourteenth Internatonal Conference on Machne Learnng, Morgan Kaufmann Publshers, San Francsco, USA, pp , A UGC Recommended Journal Page 41