2026-10-10T20:12:28Zhttps://iris.cnr.it/oai/request

oai:iris.cnr.it:20.500.14243/1394822024-04-10T12:08:50Zcom_20.500.14243_29com_20.500.14243_21col_20.500.14243_30ou_ou198ou_ou239ou_ou627

Analysis, Development and Deployment of Statistical Anomaly Detection Techniques for real e-mail Traffic G Papaleo D Chiarella M Aiello L Caviglione Papaleo, G Chiarella, D Aiello, M Caviglione, L Even if new interaction paradigms, such as the Voice over IP (VoIP), are becoming popular and widely adopted, the e-mail is still one of the most utilized ways to communicate across the Internet. However, many malicious threats are conveyed via e-mails. Usually, the authors can exploit two different approaches: i) analyzing the logs produced by e-mail servers or ii) reconstruct the e-mail flows by capturing data directly from the network by placing ad-hoc probes. In this vein, this Chapter discusses the analysis, development and deployment of statistical detection techniques aimed at the detection of Internet worms. For what concerns i), they introduce a tool called Log Mail Analyzer (LMA), which allows to overcome the complexity of inspecting multiple logs created from a heterogeneous population of mail servers. In the perspective of ii) they briefly discuss an alternative solution, based on ad-hoc network probes, to be properly placed to collect traffic and then reconstruct the e-mail flow to be monitored. Lastly, the authors introduce a threshold mechanism, based on a simple statistical framework, to automatically detect and identify different worm activities. 2011 info:eu-repo/semantics/bookPart https://hdl.handle.net/20.500.14243/139482 10.4018/978-1-61350-507-6.ch003 info:eu-repo/semantics/altIdentifier/scopus/2-s2.0-84898396318 http://www.igi-global.com/chapter/attacks-systems-categories-motives/61218 eng ispartofbook:Information Assurance and Security Technologies for Risk Assessment and Threat Management: Advances firstpage:47 lastpage:71 IGI Global country:USA place:Hershey