Detecting compromised email accounts from the perspective of graph topology

While email plays a growingly important role on the In-ternet, we are faced with more severe challenges brought by compromised email accounts, especially for the admin-istrators of institutional email service providers. Inspired by the previous experience on spam filtering and compro-mised accounts detection, we propose several criteria, like Success Outdegree Proportion, Reverse Pagerank, Recipient Clustering Coefficient and Legitimate Recipient Proportion, for compromised email accounts detection from the perspective of graph topology in this paper. Specifically, several widely used social network analysis metrics are used and adapted according to the characteristics of mail log analy-sis. We evaluate our methods on a dataset constructed by mining the one month (30 days) mail log from an univer-sity with 118,617 local users and 11,460,399 mail log en-tries. The experimental results demonstrate that our methods achieve very positive performance, and we also prove that these methods can be efficiently applied on even larger datasets. ? Copyright 2016 ACM.EI76-8215-17-June-201