Understanding the NetworkLevel Behavior of Spammers

DMCA

Understanding the NetworkLevel Behavior of Spammers (2006)

Cached

Download Links

by Anirudh Ramachandran , Nick Feamster

Citations:

290 - 22 self

BibTeX

@MISC{Ramachandran06understandingthe,
    author = {Anirudh Ramachandran and Nick Feamster},
    title = {Understanding the NetworkLevel Behavior of Spammers },
    year = {2006}
}

OpenURL

Abstract

This paper studies the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent across time each spamming host is, and characteristics of spamming botnets. We try to answer these questions by analyzing a 17-month trace of over 10 million spam messages collected at an Internet “spam sinkhole”, and by correlating this data with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet “command and control ” traces. We find that most spam is being sent from a few regions of IP address space, and that spammers appear to be using transient “bots ” that send only a few pieces of email over very short periods of time. Finally, a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked prefixes. These trends suggest that developing algorithms to identify botnet membership, filtering email messages based on network-level properties (which are less variable than email content), and improving the security of the Internet routing infrastructure, may prove to be extremely effective for combating spam.

Keyphrases

networklevel behavior network-level property internet spam sinkhole ip address space passive tcp fingerprinting information email message control trace spam message short period short-lived bgp route botnet command internet routing infrastructure ip address email content 17-month trace network-level behavior botnet membership paper study ip-based blacklist lookup transient bot bgp route hijacking

DMCA