SocialFilter：使用社交网络的协作式垃圾邮件缓解
SocialFilter: Collaborative Spam Mitigation using Social Networks
摘要：
垃圾邮件缓解可以大致分为两种主要方法：a）集中式安全基础设施，依赖于有限数量的可信监视器来检测和报告恶意流量;以及b）高度分布式系统，利用不同信任域内多个节点的经验。第一种方法提供了有限的威胁覆盖范围和缓慢的响应时间，并且它通常是专有的。第二种方法没有被广泛采用，部分原因是缺乏关于组成系统的节点的可信度的保证。我们的建议，SocialFilter，旨在实现集中式安全服务的可信度和大规模协作垃圾邮件缓解的广泛覆盖，响应能力和成本。我们提出了一个大规模的分布式系统，使客户端没有电子邮件分类功能，查询网络上的主机的行为。SocialFilter节点通过审核其行为报告和利用SocialFilter管理员的社交网络为其对等节点建立信任。节点将其对等节点在其自己的报告中的置信度与其对对等节点的信任相结合，以得出主机正在发送垃圾邮件的可能性。对我们方法的基于模拟的评估表明了它在现实世界部署下的潜力：在模拟的垃圾邮件活动中，SocialFilternodes以大于50%的置信度表征了92%的垃圾邮件机器人连接，同时不会产生误报
英文摘要：
Spam mitigation can be broadly classified into two main approaches: a) centralized security infrastructures that rely on a limited number of trusted monitors to detect and report malicious traffic; and b) highly distributed systems that leverage the experiences of multiple nodes within distinct trust domains. The first approach offers limited threat coverage and slow response times, and it is often proprietary. The second approach is not widely adopted, partly due to the lack of guarantees regarding the trustworthiness of nodes that comprise the system. Our proposal, SocialFilter, aims to achieve the trustworthiness of centralized security services and the wide coverage, responsiveness and inexpensiveness of large-scale collaborative spam mitigation. We propose a large-scale distributed system that enables clients with no email classification functionality to query the network on the behavior of a host. A SocialFilter node builds trust for its peers by auditing their behavioral reports and by leveraging the social network of SocialFilter administrators. The node combines the confidence its peers have in their own reports and the trust it places on its peers to derive the likelihood that a host is spamming. The simulation-based evaluation of our approach indicates its potential under a real-world deployment: during a simulated spam campaign, SocialFilternodes characterized 92% of spam bot connections with confidence greater than 50%, while yielding no false positives
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
