Analyzing Behavioral Features for Email Classification

Many researchers have applied statistical analysis techniques to email for classification purposes, such as identifying spam messages. Such approaches can be highly effective, however many examine incoming email exclusively — which does not provide detailed information about an individual user’s behavior. Only by analyzing outgoing messages can a user’s behavior be ascertained. Our contributions are: the use of empirical analysis to select an optimum, novel collection of behavioral features of a user’s email traffic that enables the rapid detection of abnormal email activity; and a demonstration of the effectiveness of outgoing email analysis using an application that detects worm propagation.