Detecting compromised email accounts via login behavior characterization

Cybersecurity

Table 2 Statistics for 9 datasets

	Unique accounts	Unique IP addrs	Unique subnets (/24)	Account-subnet pairs	Number of logins
					Web	SMTP	POP3	IMAP	Total
Dateset-1	323	15,371	2993	8632	25,875	47,642	320,971	1,682,202	2,076,690
Dateset-2	543	29,619	7876	17,580	119,269	24,227	259,891	5,523,264	5,926,651
Dateset-3	1356	84,522	16,709	46,695	312,523	237,120	981,876	19,139,990	2,0671,509
Dateset-4	1040	38,793	8179	21,886	143,113	82,473	3,212,183	7,392,472	10,830,241
Dateset-5	2910	68,924	17,383	40,035	99,755	23,427	691,813	13,900,911	14,715,906
Dateset-6	923	44,435	9018	23,246	149,160	196,680	4,813,528	7,417,580	12,576,948
Dateset-7	1445	86,592	17,490	45,442	274,772	91,222	1,364,399	16,358,601	18,088,994
Dateset-8	1799	61,992	13,727	47,939	207,303	351,734	1,794,550	14,626,653	16,980,240
Dateset-9	745	61,078	12,747	31,563	123,679	24,894	652,664	6,543,363	7,344,600