To date, most studies on spam have focused only on the spamming phase of the spam cycle and have ignored the harvesting phase, which consists of the mass acquisition of email addresses. It has been observed that spammers conceal their identity to a lesser degree in the harvesting phase, so it may be possible to gain new insights into spammers' behavior by studying the behavior of harvesters, which are individuals or bots that collect email addresses. In this paper, we reveal social networks of spammers by identifying communities of harvesters with high behavioral similarity using spectral clustering. The data analyzed was collected through Project Honey Pot, a distributed system for monitoring harvesting and spamming. Our main findings are (1) that most spammers either send only phishing emails or no phishing emails at all, (2) that most communities of spammers also send only phishing emails or no phishing emails at all, and (3) that several groups of spammers within communities exhibit coherent temporal behavior and have similar IP addresses. Our findings reveal some previously unknown behavior of spammers and suggest that there is indeed social structure between spammers to be discovered.

本研究通过谱聚类方法识别社区中存在高行为相似性的Email地址收集者，透露了垃圾邮件发送者之间的社交网络，并确定了垃圾邮件发送者的行为特征。发现大多数垃圾邮件发送者要么只发送网络钓鱼邮件，要么根本不发送，社区内的大多数垃圾邮件发送者也只发送网络钓鱼邮件或根本不发送，部分垃圾邮件发送者组也表现出了一致的时间行为和相似的IP地址。

通过谱聚类揭示垃圾邮件发送者的社交网络