{"id":"https://openalex.org/W2169300738","doi":"https://doi.org/10.1145/1149121.1149125","title":"Behavior-based modeling and its application to Email analysis","display_name":"Behavior-based modeling and its application to Email analysis","publication_year":2006,"publication_date":"2006-05-01","ids":{"openalex":"https://openalex.org/W2169300738","doi":"https://doi.org/10.1145/1149121.1149125","mag":"2169300738"},"language":"en","primary_location":{"id":"doi:10.1145/1149121.1149125","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1149121.1149125","pdf_url":null,"source":{"id":"https://openalex.org/S97833917","display_name":"ACM Transactions on Internet Technology","issn_l":"1533-5399","issn":["1533-5399","1557-6051"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Internet Technology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.7916/d8v98fsm","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5084213178","display_name":"Salvatore J. Stolfo","orcid":"https://orcid.org/0000-0003-1611-0100"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Salvatore J. Stolfo","raw_affiliation_strings":["Columbia University, New York, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082220966","display_name":"Shlomo Hershkop","orcid":"https://orcid.org/0000-0003-2311-5268"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shlomo Hershkop","raw_affiliation_strings":["Columbia University, New York, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089428934","display_name":"Chia-Wei Hu","orcid":null},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chia-Wei Hu","raw_affiliation_strings":["Columbia University, New York, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063000433","display_name":"Wei\u2010Jen Li","orcid":null},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wei-Jen Li","raw_affiliation_strings":["Columbia University, New York, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017190756","display_name":"Olivier Nimeskern","orcid":null},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Olivier Nimeskern","raw_affiliation_strings":["Columbia University, New York, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5056300354","display_name":"Ke Wang","orcid":"https://orcid.org/0000-0002-0895-4445"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ke Wang","raw_affiliation_strings":["Columbia University, New York, NY"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY","institution_ids":["https://openalex.org/I78577930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":9.7787,"has_fulltext":false,"cited_by_count":104,"citation_normalized_percentile":{"value":0.98232129,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":"6","issue":"2","first_page":"187","last_page":"221"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8047803044319153},{"id":"https://openalex.org/keywords/law-enforcement","display_name":"Law enforcement","score":0.5087960362434387},{"id":"https://openalex.org/keywords/viral-marketing","display_name":"Viral marketing","score":0.47257745265960693},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.46982860565185547},{"id":"https://openalex.org/keywords/social-media","display_name":"Social media","score":0.4473089277744293},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.38316109776496887},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.28530818223953247}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8047803044319153},{"id":"https://openalex.org/C2780262971","wikidata":"https://www.wikidata.org/wiki/Q44554","display_name":"Law enforcement","level":2,"score":0.5087960362434387},{"id":"https://openalex.org/C187008535","wikidata":"https://www.wikidata.org/wiki/Q204255","display_name":"Viral marketing","level":3,"score":0.47257745265960693},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.46982860565185547},{"id":"https://openalex.org/C518677369","wikidata":"https://www.wikidata.org/wiki/Q202833","display_name":"Social media","level":2,"score":0.4473089277744293},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38316109776496887},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.28530818223953247},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1145/1149121.1149125","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1149121.1149125","pdf_url":null,"source":{"id":"https://openalex.org/S97833917","display_name":"ACM Transactions on Internet Technology","issn_l":"1533-5399","issn":["1533-5399","1557-6051"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Internet Technology","raw_type":"journal-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.87.86","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.87.86","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://sneakers.cs.columbia.edu/ids/publications/TOIT-EMT.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.91.6064","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.91.6064","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.albany.edu/acc/courses/acc522fall2007/behaviormodelingemail.pdf","raw_type":"text"},{"id":"pmh:oai:academiccommons.columbia.edu:10.7916/D8V98FSM","is_oa":false,"landing_page_url":"https://doi.org/10.7916/D8V98FSM","pdf_url":null,"source":{"id":"https://openalex.org/S4306402601","display_name":"Columbia Academic Commons (Columbia University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I78577930","host_organization_name":"Columbia University","host_organization_lineage":["https://openalex.org/I78577930"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Articles"},{"id":"doi:10.7916/d8v98fsm","is_oa":true,"landing_page_url":"https://doi.org/10.7916/d8v98fsm","pdf_url":null,"source":{"id":"https://openalex.org/S4306402601","display_name":"Columbia Academic Commons (Columbia University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I78577930","host_organization_name":"Columbia University","host_organization_lineage":["https://openalex.org/I78577930"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"doi:10.7916/d8v98fsm","is_oa":true,"landing_page_url":"https://doi.org/10.7916/d8v98fsm","pdf_url":null,"source":{"id":"https://openalex.org/S4306402601","display_name":"Columbia Academic Commons (Columbia University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I78577930","host_organization_name":"Columbia University","host_organization_lineage":["https://openalex.org/I78577930"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7799999713897705,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":51,"referenced_works":["https://openalex.org/W14760367","https://openalex.org/W178169250","https://openalex.org/W182621726","https://openalex.org/W336063547","https://openalex.org/W1497249636","https://openalex.org/W1535065339","https://openalex.org/W1543388142","https://openalex.org/W1554085250","https://openalex.org/W1565388971","https://openalex.org/W1566480186","https://openalex.org/W1569393825","https://openalex.org/W1587265799","https://openalex.org/W1592090113","https://openalex.org/W1647135810","https://openalex.org/W1653253285","https://openalex.org/W1912123407","https://openalex.org/W1941427975","https://openalex.org/W1973704753","https://openalex.org/W1981589225","https://openalex.org/W2012568697","https://openalex.org/W2021767337","https://openalex.org/W2026302857","https://openalex.org/W2078396547","https://openalex.org/W2082600559","https://openalex.org/W2085305295","https://openalex.org/W2093191240","https://openalex.org/W2096847629","https://openalex.org/W2103040786","https://openalex.org/W2116007667","https://openalex.org/W2125735062","https://openalex.org/W2129860818","https://openalex.org/W2130087897","https://openalex.org/W2135143063","https://openalex.org/W2143840553","https://openalex.org/W2144242878","https://openalex.org/W2150147654","https://openalex.org/W2150847526","https://openalex.org/W2159919478","https://openalex.org/W2160150610","https://openalex.org/W2166559705","https://openalex.org/W2559773779","https://openalex.org/W2560674852","https://openalex.org/W4205655685","https://openalex.org/W4206109607","https://openalex.org/W4229853139","https://openalex.org/W4242876994","https://openalex.org/W4248949446","https://openalex.org/W4290757805","https://openalex.org/W4297970464","https://openalex.org/W6631875860","https://openalex.org/W6656872237"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W1968064866","https://openalex.org/W2913870229","https://openalex.org/W2009647787","https://openalex.org/W2770232349","https://openalex.org/W810849147","https://openalex.org/W181064621","https://openalex.org/W2186792794","https://openalex.org/W2542758684","https://openalex.org/W1976474726"],"abstract_inverted_index":{"The":[0,121,160],"Email":[1],"Mining":[2],"Toolkit":[3],"(EMT)":[4],"is":[5,215,219],"a":[6,26,78,174],"data":[7],"mining":[8],"system":[9],"that":[10,155,198,227],"computes":[11],"behavior":[12,115,213],"profiles":[13],"or":[14],"models":[15,21,71,116,161],"of":[16,28,36,61,69,77,113,136,151,173,181,196,223],"user":[17],"email":[18,99,176,190,218],"accounts.":[19],"These":[20],"may":[22,205],"be":[23],"used":[24,162],"for":[25,46,163],"multitude":[27],"tasks":[29,35,50],"including":[30],"forensic":[31],"analyses":[32],"and":[33,41,54,108,143,170,178,217],"detection":[34,119],"value":[37],"to":[38,72,221],"law":[39],"enforcement":[40],"intelligence":[42],"agencies,":[43],"as":[44,47,52,158],"well":[45],"other":[48],"typical":[49,231],"such":[51],"virus":[53,91,199],"spam":[55],"detection.":[56],"To":[57],"demonstrate":[58],"the":[59,62,67,74,111,182,188,229],"power":[60],"methods,":[63],"we":[64],"focus":[65],"on":[66],"application":[68],"these":[70],"detect":[73],"early":[75],"onset":[76],"viral":[79,106,137],"propagation":[80],"without":[81],"\u201ccontent-base":[82],"\u201d":[83],"(or":[84],"signature-based)":[85],"analysis":[86,180],"in":[87,90,140,187,225],"common":[88],"use":[89],"scanners.":[92],"We":[93,192],"present":[94],"several":[95],"experiments":[96],"using":[97],"real":[98],"from":[100],"15":[101],"users":[102],"with":[103,144,153,233],"injected":[104],"simulated":[105],"emails":[107,138,152,207],"describe":[109],"how":[110],"combination":[112],"different":[114,210],"improves":[117],"overall":[118],"rates.":[120],"performance":[122],"results":[123],"vary":[124],"depending":[125],"upon":[126,168],"parameter":[127],"settings,":[128],"approaching":[129],"99":[130],"%":[131,146],"true":[132],"positive":[133,148],"(TP)":[134],"(percentage":[135,150],"caught)":[139],"general":[141],"cases":[142],"0.38":[145],"false":[147],"(FP)":[149],"attachments":[154],"are":[156,166,201],"mislabeled":[157],"viral).":[159],"this":[164],"study":[165],"based":[167],"volume":[169],"velocity":[171],"statistics":[172],"user's":[175,183],"rate":[177],"an":[179],"(social)":[184],"cliques":[185],"revealed":[186],"person's":[189],"behavior.":[191],"show":[193],"by":[194],"way":[195],"simulation":[197],"propagations":[200],"detectable":[202],"since":[203],"viruses":[204],"emit":[206],"at":[208],"rates":[209],"than":[211],"human":[212],"suggests":[214],"normal,":[216],"directed":[220],"groups":[222],"recipients":[224],"ways":[226],"violate":[228],"users'":[230],"communications":[232],"their":[234],"social":[235],"groups.":[236]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":3},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":20},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":2},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":5},{"year":2013,"cited_by_count":6},{"year":2012,"cited_by_count":5}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}