On the heels of the widespread adoption of web services such as social networks and URL shorteners, scams, phishing, and malware have become regular threats. Despite extensive research, email-based spam filtering techniques generally fall short for protecting other web services. To better address this need, we present Monarch, a real-time system that crawls URLs as they are submitted to web services and determines whether the URLs direct to spam. We evaluate the viability of Monarch and the fundamental challenges that arise due to the diversity of web service spam. We show that Monarch can provide accurate, real-time protection, but that the underlying characteristics of spam do not generalize across web services. In particular, we find that spam targeting email qualitatively differs in significant ways from spam campaigns targeting Twitter. We explore the distinctions between email and Twitter spam, including the abuse of public web hosting and redirector services. Finally, we demonstrate Monarch's scalability, showing our system could protect a service such as Twitterwhich needs to process 15 million URLs/day-for a bit under $800/day.
Thomas et al. REF reported that spam targeting email is significantly different from spam targeting Twitter.
Design and Evaluation of a Real-Time URL Spam Filtering Service
2011 IEEE Symposium on Security and Privacy
2011 IEEE Symposium on Security and Privacy
Computer Science