System and method for spammer host detection from network flow data profiles

A non-transitory computer readable storage medium storing a program of instructions executable by a machine to perform a method for spammer host detection from network flow data profiles, comprising:

• constructing one or more cluster profiles, comprising:
• observing network flow data from one or more hosts;
• for each host of the one or more hosts, representing the network flow data associated with the host as a multidimensional vector;
• clustering the one or more vectors of the one or more hosts into the plurality of cluster profiles;
• annotating each cluster profile using at least one of one or more black lists and one or more white lists;
• and
• calculating a confidence in each cluster file annotation;
• and
• detecting spammer hosts, comprising:
• observing the network flow data from a new host;
• representing the network flow data associated with the new host as a multidimensional vector;
• and
• placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.

A system for spammer host detection from network flow data profiles, comprising:

• a CPU;
• and
• a module operable to construct one or more cluster profiles and to detect spammer hosts, said construct performed by performing steps of:
• observing network flow data from one or more hosts;
• for each host of the one or more hosts, representing the network flow data associated with the host as a multidimensional vector;
• clustering the one or more vectors of the one or more hosts into the plurality of cluster profiles;
• annotating each cluster profile using at least one of one or more black lists and one or more white lists;
• and
• calculating a confidence in each cluster profile annotation;
• and
• said detect performed by performing steps of:
• observing the network flow data from a new host;
• representing the network flow data associated with the new host as a multidimensional vector;
• and
• placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.