Revealing social networks of spammers through spectral clustering
  To date, most studies on spam have focused only on the spamming phase of the
spam cycle and have ignored the harvesting phase, which consists of the mass
acquisition of email addresses. It has been observed that spammers conceal
their identity to a lesser degree in the harvesting phase, so it may be
possible to gain new insights into spammers' behavior by studying the behavior
of harvesters, which are individuals or bots that collect email addresses. In
this paper, we reveal social networks of spammers by identifying communities of
harvesters with high behavioral similarity using spectral clustering. The data
analyzed was collected through Project Honey Pot, a distributed system for
monitoring harvesting and spamming. Our main findings are (1) that most
spammers either send only phishing emails or no phishing emails at all, (2)
that most communities of spammers also send only phishing emails or no phishing
emails at all, and (3) that several groups of spammers within communities
exhibit coherent temporal behavior and have similar IP addresses. Our findings
reveal some previously unknown behavior of spammers and suggest that there is
indeed social structure between spammers to be discovered.
