Improving the efficiency of spam filtering through cache architecture

Ashok Khanal; Bahman Motlagh; T Kocak

doi:10.1109/MASCOTS.2007.27

Improving the efficiency of spam filtering through cache architecture

Ashok Khanal, Bahman Motlagh, T Kocak

Department of Electrical & Electronic Engineering

Research output: Contribution to conference › Conference Abstract

1 Citation (Scopus)

445 Downloads (Pure)

Abstract

Blacklists (BLs), also called domain name system-based blackhole list (DNSBLs) are the databases of known internet addresses used by the spammers to send out the spam mails. Mail servers use these lists to filter out the e-mails coming from different spam sources. In contrary, Whitelists (WLs) are the explicit list of senders from whom e-mail can be accepted or delivered. Mail transport agent (MTA) is usually configured to reject, challenge or flag the messages which have been sent from the sources listed on one or more DNSBLs and to allow the messages from the sources listed on the WLs. In this paper, we are demonstrating how the bandwidth (the overall requests and responses that need to go over the network) performance is improved by using local caches for BLs and WLs. The actual sender's IP addresses are extracted from the e-mail log. These are then compared with the list in the local caches to find out if they should be accepted or not, before they are checked against the global DNSBLs by running 'DNSBL queries' (if required). Around three quarters of the e-mail sources have been observed to be filtered locally through caches with this method. Provision of local control over the lists and lower search (filtering) time are the other related benefits

Original language	English
Pages	303 - 309
DOIs	https://doi.org/10.1109/MASCOTS.2007.27
Publication status	Published - Oct 2007

Bibliographical note

Terms of use: Copyright © 2007 IEEE. Reprinted from 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, 2007 (MASCOTS '07)
This material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Bristol's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubs-permissions@ieee.org.

By choosing to view this document, you agree to all provisions of the copyright laws protecting it.

Name of Conference: 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS)
Venue of Conference: Istanbul, Turkey

Keywords

cache
blacklist
DNSBL
spam
whitelist

Access to Document

10.1109/MASCOTS.2007.27

Khanal IEEE MASCOTS 2007Accepted author manuscript, 610 KB

http://hdl.handle.net/1983/1478

Handle.net

Persistent link

Cite this

@conference{3e816757b9294317b01c36ebabea96ff,

title = "Improving the efficiency of spam filtering through cache architecture",

abstract = "Blacklists (BLs), also called domain name system-based blackhole list (DNSBLs) are the databases of known internet addresses used by the spammers to send out the spam mails. Mail servers use these lists to filter out the e-mails coming from different spam sources. In contrary, Whitelists (WLs) are the explicit list of senders from whom e-mail can be accepted or delivered. Mail transport agent (MTA) is usually configured to reject, challenge or flag the messages which have been sent from the sources listed on one or more DNSBLs and to allow the messages from the sources listed on the WLs. In this paper, we are demonstrating how the bandwidth (the overall requests and responses that need to go over the network) performance is improved by using local caches for BLs and WLs. The actual sender's IP addresses are extracted from the e-mail log. These are then compared with the list in the local caches to find out if they should be accepted or not, before they are checked against the global DNSBLs by running 'DNSBL queries' (if required). Around three quarters of the e-mail sources have been observed to be filtered locally through caches with this method. Provision of local control over the lists and lower search (filtering) time are the other related benefits",

keywords = "cache, blacklist, DNSBL, spam, whitelist",

author = "Ashok Khanal and Bahman Motlagh and T Kocak",

note = "Terms of use: Copyright {\textcopyright} 2007 IEEE. Reprinted from 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, 2007 (MASCOTS '07) This material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Bristol's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this document, you agree to all provisions of the copyright laws protecting it. Name of Conference: 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) Venue of Conference: Istanbul, Turkey",

year = "2007",

month = oct,

doi = "10.1109/MASCOTS.2007.27",

language = "English",

pages = "303 -- 309",

}

TY - CONF

T1 - Improving the efficiency of spam filtering through cache architecture

AU - Khanal, Ashok

AU - Motlagh, Bahman

AU - Kocak, T

N1 - Terms of use: Copyright © 2007 IEEE. Reprinted from 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, 2007 (MASCOTS '07) This material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Bristol's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this document, you agree to all provisions of the copyright laws protecting it. Name of Conference: 15th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) Venue of Conference: Istanbul, Turkey

PY - 2007/10

Y1 - 2007/10

N2 - Blacklists (BLs), also called domain name system-based blackhole list (DNSBLs) are the databases of known internet addresses used by the spammers to send out the spam mails. Mail servers use these lists to filter out the e-mails coming from different spam sources. In contrary, Whitelists (WLs) are the explicit list of senders from whom e-mail can be accepted or delivered. Mail transport agent (MTA) is usually configured to reject, challenge or flag the messages which have been sent from the sources listed on one or more DNSBLs and to allow the messages from the sources listed on the WLs. In this paper, we are demonstrating how the bandwidth (the overall requests and responses that need to go over the network) performance is improved by using local caches for BLs and WLs. The actual sender's IP addresses are extracted from the e-mail log. These are then compared with the list in the local caches to find out if they should be accepted or not, before they are checked against the global DNSBLs by running 'DNSBL queries' (if required). Around three quarters of the e-mail sources have been observed to be filtered locally through caches with this method. Provision of local control over the lists and lower search (filtering) time are the other related benefits

AB - Blacklists (BLs), also called domain name system-based blackhole list (DNSBLs) are the databases of known internet addresses used by the spammers to send out the spam mails. Mail servers use these lists to filter out the e-mails coming from different spam sources. In contrary, Whitelists (WLs) are the explicit list of senders from whom e-mail can be accepted or delivered. Mail transport agent (MTA) is usually configured to reject, challenge or flag the messages which have been sent from the sources listed on one or more DNSBLs and to allow the messages from the sources listed on the WLs. In this paper, we are demonstrating how the bandwidth (the overall requests and responses that need to go over the network) performance is improved by using local caches for BLs and WLs. The actual sender's IP addresses are extracted from the e-mail log. These are then compared with the list in the local caches to find out if they should be accepted or not, before they are checked against the global DNSBLs by running 'DNSBL queries' (if required). Around three quarters of the e-mail sources have been observed to be filtered locally through caches with this method. Provision of local control over the lists and lower search (filtering) time are the other related benefits

KW - cache

KW - blacklist

KW - DNSBL

KW - spam

KW - whitelist

U2 - 10.1109/MASCOTS.2007.27

DO - 10.1109/MASCOTS.2007.27

M3 - Conference Abstract

SP - 303

EP - 309

ER -

Improving the efficiency of spam filtering through cache architecture

Abstract

Bibliographical note

Keywords

Access to Document

Handle.net

Fingerprint

Cite this