Stolfo Salvatore author Columbia University. Computer Science Hershkop Shlomo author Columbia University. Computer Science Hu Chia-wei author Columbia University. Industrial Engineering and Operations Research Li Wei-Jen author Columbia University. Computer Science Nimeskern Olivier author Columbia University. Computer Science Wang Ke author Columbia University. Computer Science Columbia University. Computer Science originator text Articles 2006 English The Email Mining Toolkit (EMT) is a data mining system that computes behavior profiles or models of user email accounts. These models may be used for a multitude of tasks including forensic analyses and detection tasks of value to law enforcement and intelligence agencies, as well for as other typical tasks such as virus and spam detection. To demonstrate the power of the methods, we focus on the application of these models to detect the early onset of a viral propagation without "content-base" (or signature-based) analysis in common use in virus scanners. We present several experiments using real email from 15 users with injected simulated viral emails and describe how the combination of different behavior models improves overall detection rates. The performance results vary depending upon parameter settings, approaching 99% true positive (TP) (percentage of viral emails caught) in general cases and with 0.38% false positive (FP) (percentage of emails with attachments that are mislabeled as viral). The models used for this study are based upon volume and velocity statistics of a user's email rate and an analysis of the user's (social) cliques revealed in the person's email behavior. We show by way of simulation that virus propagations are detectable since viruses may emit emails at rates different than human behavior suggests is normal, and email is directed to groups of recipients in ways that violate the users' typical communications with their social groups. ACM Transactions on Internet Technology, vol. 6, no. 2 (May 2006), pp. 187-221. Computer science 10.1145/1149121.1149125 http://hdl.handle.net/10022/AC:P:8686 NNC NNC 2010-04-28 12:52:39 -0400 2011-09-15 15:51:15 -0400 1187 eng