Innocent by association: early recognition of legitimate users
Spamming botnets: signatures and characteristics