Method and apparatus for spam message detection

• US 9,059,951 B2
• Filed: 06/21/2013
• Issued: 06/16/2015
• Est. Priority Date: 06/30/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Xiao Yan, Wang, Chen, Ying, Chun, Zhang, Yi Bo, Zhu, Yanfeng
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US13/924,044
• Publication Number:
  US 20140156766A1
• Time in Patent Office: 725 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method, apparatus and computer program product for spam message detection. The method includes collecting time domain transmission characteristic of a message source; computing frequency domain transmission characteristic of the message source with the time domain transmission characteristic of the message source; and identifying the message source to be a spammer in response to the frequency domain transmission characteristic of the message source satisfying predefined criteria; wherein the steps of the method are carried out using a computer device. An apparatus and computer program product for carrying out the above method is also provided.

Claims

1. A method for detecting a spam message, the method comprising:

computing a frequency domain transmission characteristic of a message source using a time domain transmission characteristic of the message source; and

identifying the message source as being a spammer based on the frequency domain transmission characteristic;

wherein the steps of the method are carried out using a computer device.

2. The method of claim 1, further comprising:

identifying the message source as a spammer in response to the frequency domain transmission characteristic of the message source not matching a frequency domain transmission characteristic of a non-spammer template.

3. The method of claim 1, further comprising:

identifying the message source as a spammer in response to the variance of a parameter of the frequency domain transmission characteristic of the message source being greater than a variance threshold.

4. The method of claim 1, further comprising:

computing an average power of the message source with the time domain transmission characteristic of the message source;

identifying the message source as a spammer in response to the average power being greater than an average power threshold; and

exiting the process.

5. The method of claim 1, further comprising:

determining that a received message has established a new session in accordance with the time domain transmission characteristic of the message source; and

computing the frequency domain transmission characteristic of the message source with the time domain transmission characteristic of the message source in response to the received message having established a new session.

6. The method of claim 1, further comprising:

identifying the message source as a spammer in response to the frequency domain transmission characteristic of the message source matching a frequency domain transmission characteristic of a spammer template.

7. The method of claim 6, further comprising:

estimating the parameter set of the model corresponding to the message source with the time domain transmission characteristic of the message source; and

identifying the message source as a spammer in response to the parameter set of the model corresponding to the message source matching the parameter set of the model corresponding to the spammer template;

wherein models having the same form are built for the message source and the spammer template, and the frequency domain transmission characteristic is represented by a parameter set of the model.

8. The method of claim 6, further comprising:

estimating at least two parameter sets of the model corresponding to the message source with the time domain transmission characteristic of the message source by taking at least two different values as length of time domain sample intervals, respectively; and

determining that the message source is a spammer in response to any one of the at least two parameter sets of the model corresponding to the message source matching any one of the parameter set of the model corresponding to the first spammer template and the parameter set of the model corresponding to the second spammer template;

wherein the spammer template comprises at least a first spammer template and a second spammer template, and models having the same form are built for the message source, the first spammer template and the second spammer template.

9. The method of claim 8, wherein one of the at least two different values is a positive integer multiple of the other.

10. An apparatus for detecting a spam message, the apparatus comprising:

computation means configured to compute a frequency domain transmission characteristic of a message source using a time domain transmission characteristic of the message source; and

identification means configured to identify said message source as being a spammer based on the frequency domain transmission characteristic.

11. The apparatus of claim 10, further comprising:

means configured to identify the message source as a spammer in response to the frequency domain transmission characteristic of the message source not matching the frequency domain transmission characteristic of a non-spammer template.

12. The apparatus of claim 10, further comprising:

means configured to identify the message source as a spammer in response to a variance of parameter of the frequency domain transmission characteristic of the message source being greater than a variance threshold.

13. The apparatus of claim 10, further comprising:

means configured to compute average power of the message source with the time domain transmission characteristic of the message source; and

means configured to;

identify the message source as a spammer in response to the average power being greater than an average power threshold; and

exit the flow.

14. The apparatus of claim 10, further comprising:

means configured to identify whether arrived message has established a new session according to the time domain transmission characteristic of the message source; and

means configured to initiate the computation means in response to the arrived message having established a new session.

15. The apparatus of claim 10, further comprising:

means configured to identify the message source as a spammer in response to the frequency domain transmission characteristic of the message source matching a frequency domain transmission characteristic of a spammer template.

16. The apparatus of claim 15, further comprising:

means configured to estimate the parameter set of the model corresponding to the message source with the time domain transmission characteristic of the message source; and

means configured to identifying the message source as a spammer in response to the parameter set of the model corresponding to the message source matching the parameter set of the model corresponding to the spammer template;

wherein models having the same form are built for the message source and the spammer template, and the frequency domain transmission characteristic is represented by a parameter set of the model.

17. The apparatus of claim 15, further comprising:

means configured to estimate at least two parameter sets of the model corresponding to the message source with the time domain transmission characteristic of the message source, taking at least two different values as length of time domain sample intervals, respectively; and

means configured to identify the message source as a spammer in response to any one of the at least two parameter sets of the model corresponding to the message source matching any one of the parameter set of the model corresponding to the first spammer template and the parameter set of the model corresponding to the second spammer template;

wherein the spammer template comprises at least a first spammer template and a second spammer template, and models having the same form are built for the message source, the first spammer template and the second spammer template.

18. The apparatus of claim 17, wherein one of the at least two different values is a positive integer multiple of the other.

19. A computer program product for detecting a spam message, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising computer readable program code configured to execute a method, the method comprising;

computing a frequency domain transmission characteristic of a message source using a time domain transmission characteristic of the message source; and

identifying said message source as being a spammer based on the frequency domain transmission characteristic.