Design of a Web-Services Based Spam Filtering

Transcription

1 , pp Design of a Web-Services Based Spam MyoungHwan Joung, Oh-Heum Kwon, Ha-Joo Song Dept. of IT Convergence and Application, Pukyong National University Daeyon-Dong, Nam-Gu, Busan , KOREA looping@ecis.co.kr, ohkwn@pknu.ac.kr, hajoosong@pknu.ac.kr Corresponding Author: hajoosong@pknu.ac.kr Abstract. A board filtering system is a software to protect spam words being written to the web bulletin boards. Since a filtering system needs sophisticated administrative works and sometimes requires modification of server pages, existing board filtering systems are not applicable for web servers for a small and medium businesses who cannot support a dedicated site manager. In this paper, we propose a new architecture for the board filtering systems that is based on a web-services [1] oriented architecture. Proposed architecture exploits the distributed processing such that it can provide ease of maintenance and high scalability. Keywords: spam-filtering, web-services, distributed processing 1 Introduction Lots of researches have been done to identify spam messages on the web [2, 3], but few of them deal with the architectural issues of spam filtering systems. Hence we briefly categorize the architectures and then proposed a new architecture for the filtering system. A board filtering systems is a software and hardware mixed system that protects web message boards from being contaminated by spams using various filtering algorithms. Existing board filtering systems adopt one of two approaches: an in-line architecture and a proxy architecture. Fig. 1 shows overall architecture of the two approaches. ISSN: ASTL Copyright 2015 SERSC

2 (a) In-line Architecure Flow of POST messages (b) Proxy Architecture Fig. 1. Architectures of web board filtering systems. In an in-line architecture a board filtering system is placed in between the web browser and the web server and monitors all the HTTP messages between them removing any spam words sent from the web browser to the server. An in-line board filtering system can be easily deployed into the existing web servers since it requires little modification to the existing server pages. However it introduces communication delay between the client and server since it has to intercept the HTTP message from the web browser, check the content and then forward them to the server. In proxy architecture, the web pages are modified to have some script inside that forwards HTTP POST message to the board filtering system. The filtering system checks the POST messages from the client, removes spam words from the content, and then forwards the message to the web server. Hence the filtering system works more efficiently by intercepting only the interested messages without introducing any delay for most HTTP messages. However it requires modification of existing web pages to insert forwarding script codes. Malicious clients can even bypass the script and send POST message directly to the web server. 2 A based on A Service Oriented Architecture For small and medium sized businesses, ease of maintenance is a very important factor when it comes to the selection of a board filtering system. Hence our system is based on the architecture of an in-line architecture, but the actual filtering functionality is running on a remote system (Fig. 2) as filtering web-services [4]. Therefore board filtering system works as if it is a front-end system for the web server. If the client send POST message to server, the message is intercepted by the filtering system and then forwarded to the remote filtering service by a web-services call. The remote filtering service checks the message content on behalf of the board filtering system, and returns the filtered output back to the board filtering system. Copyright 2015 SERSC 53

3 Filitering Web-Services Fig. 2. Service Oriented Architecture for Spam This architecture has several benefits compared with the previous approaches. First, board filtering system can be as light as a small foot-print web server that can be embedded in a low cost hardware system. This means that the filtering system can be cheap and deployed as easily as a network device such as a WI-FI access point. Second, it is also easy to maintain the filtering system, since major functionality is implemented by the web-services. Therefore after the installation, little administration is needed for the filtering system. Administrative tasks such as updating spam key words and IP addresses of malicious clients are maintained at filtering web-services. Third, the proposed architecture is scalable. POST messages can have attachments which consume lots of computing power and storage bandwidths. Attachments are mostly compressed files so that they have to be uncompressed before further processing. This step alone consumes significant amount of computing power and storage space. Uncompressed files undergo content filtering which in turn needs quite time. Hence if a filtering system has to process several attachments simultaneously, it can be overloaded. In the proposed architecture, filtering system forwards most of the processing to the web-services consuming less computing and storage resources. The filtering system only sends the attachments to the web-services and then waits till the response arrives which means consuming less resources compared with locally processing them. Therefore the filtering system can deal with more concurrent requests. 54 Copyright 2015 SERSC

4 Fig. 3. Interaction sequence to and from client and the spam filtering web-service Fig. 3 shows the interaction sequence between filtering components from the browser to the filtering service. Since we use an open source proxy server Squid as the implementation framework, we extended the Squid functionality via its ecap interface. Every messages from the browser is first sent to Squid and then forwarded to the Cleaner the name of our filtering service. Cleaner checks whether the request message contains any spam words and then send back the original message to the web server if there is no spam. In case there is any spam inside the request message, Cleaner returns appropriate warning message and then it is forwarded to the browser so that the user can modify the request message. To extend the functionality of Squid and to put our extension module into it, we developed a Squid extension module called ecap. Fig. 4 shows the detailed interaction when Squid is first started and our ecap module is registered as the extension of Squid with the specified URL. After ecap is successfully registered, every request messages from the clients are sent to ecap module. Since the request message can be very large, it is delivered from Squid to ecap vi several interactions as it is shown in Fig. 4. Copyright 2015 SERSC 55

5 Fig. 4. Configuration setup and message passing between Squid core and ecap extension 3 Conclusion In this paper, we propose a service oriented board filtering system. Proposed architecture is inexpensive, requires little maintenance, and provides scalability. Therefore we expect the proposed architecture can be a perfect match for needs of small and medium businesses scale servers. References 1. Newcomer, E., Lomow, G.: Understanding SOA with Web services. Addison-Wesley (2005). 2. Gyongyi, Z., Garcia-Molina, H.: Web Spam Taxonomy. In: First International Workshop on Adversarial Information Retrieval on the Web (AIRWeb 2005) (2005). 3. Cormack, G. V: spam filtering: A systematic review. Found. Trends Inf. Retr. 1, (2007). 4. Thomas, E.: Service-oriented architecture: concepts, technology, and design. Prentice Hall. 31, W3C (2005). 56 Copyright 2015 SERSC