基于行为与时间特征的垃圾邮件检测方法

垃圾邮件数量庞大、伪装形式多种多样，给反垃圾邮件带来了巨大的挑战。提出了一个基于行为和时间特征的垃圾邮件检测方法。根据邮件收发记录分析基于社会网络的行为特征和基于邮件发送间隔的时间特征，采用步进式判别分析方法，选择具有较强判别能力的行为特征，形成特征子空间，将训练样本投影到特征子空间。使用带标签的训练样本训练支持向量机SVM，形成邮件决策信息，以此检测出垃圾邮件。利用最近3年真实邮件数据，从不同的角度进行了对比实验。结果证明，提出的行为与时间特征能有效提升垃圾邮件检测的准确率和查全率，其整体性能优于其他的基于行为的垃圾邮件检测方法。

Method for email spam detection based on behavioral and temporal features

The large number of email spam and their various counterfeits pose a great challenge to anti spam. An email spam detection method was proposed based on behavioral and temporal features. According to the emails’ sending and receiving records, behavioral features were analyzed based on email social network and a temporal feature analyzed based on email delivery interval. Then, a stepwise discriminant analysis was employed to select discriminative features to form a feature sub space where all training samples were projected into this feature sub space. Finally, those projected training samples with labels were used to train the support vector machine (SVM) classifier, and decision criteria were generated so as to identify email spam. Based on real email data in recent 3 years, comparative experiments were performed to evaluate the effectiveness of the features and performance of the proposed method. Experimental results show that the behavioral and temporal features proposed in this paper can significantly increase the accuracy and recall of spam detection, and that the overall performance of this method is superior to that of other email spam detection methods which are based on behavioral features.