SpamBands: a Methodology to Identify Sources of Spam Acting in Concert

Elverton Fazzion, Pedro Las-Casas, Osvaldo Fonseca, Dorgival Guedes, Wagner Meira Jr, Cristine Hoepers, Klaus Steding-Jessen, Marcelo Chaves

Abstract


In 2012, estimates indicated that 68.8% of all
e-mail traffic was spam, what suggests this is still a relevant
problem. Recently, some works have focused on the analysis
of spam’s traffic inside the network, analyzing the protocols
used and the AS which originate the traffic. However, those
works usually do not consider the relationships between the
machines used to send spam. Such an analysis could reveal how
different machines may be used by a single spammer to spread
his messages, helping us to understand their behavior. To that
end, this work proposes a methodology to cluster the machines
used by spammers based on the concept of spam campaigns.
The groups identified were characterized to identify different
aspects of the spam dissemination process, which suggest different
orchestration strategies being used.


Keywords


SpamBands

References


D. Crocker, “Challenges in anti-spam efforts,” The Internet

Protocol Journal, vol. 8, no. 4, 2006. [Online]. Available:

"http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_8-

/anti-spam_efforts.html"

Royal Pingdom, “The internet 2012 in numbers,” Artigo

na Web, Visitado em 2014. [Online]. Available:

http://royal.pingdom.com/2013/01/16/internet-2012-in-numbers/

J. C. Sipior, B. T. Ward, and P. G. Bonner, “Should spam be on the

menu?” Commun. ACM, vol. 47, no. 6, pp. 59–63, Jun. 2004. [Online].

Available: http://doi.acm.org/10.1145/990680.990681

G. V. Cormack, “Email spam filtering: A systematic review,” Found.

Trends Inf. Retr., vol. 1, no. 4, pp. 335–455, Apr. 2008. [Online].

Available: http://dx.doi.org/10.1561/1500000006

P. H. B. Las-Casas, D. Guedes, W. M. Jr., C. Hoepers, K. Steding-Jessen,

M. H. P. Chaves, O. Fonseca, E. Fazzion, and R. E. A. Moreira, “Análise

do tráfego de spam coletado ao redor do mundo,” in Anais do Simpósio

Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC).

SBC, 2013.

P. H. C. Guerra, D. Guedes, W. M. Jr., C. Hoepers, and K. Steding-

Jessen, “Caracterização de estratégias de disseminação de spams,” in

Anais do Simpósio Brasileiro de Redes de Computadores e Sistemas

Distribuídos (SBRC). SBC, 2008.

H. Almeida, D. Guedes, W. Meira, and M. J. Zaki, “Is there a

best quality metric for graph clusters?” in Proceedings of the 2011

European Conference on Machine Learning and Knowledge Discovery

in Databases - Volume Part I, Athens, Greece, 2011, pp. 44–59.

P. H. C. Guerra, D. E. V. Pires, D. Guedes, J. Wagner Meira, C. Hoepers,

and K. Steding-Jessen, “A campaign-based characterization of spamming

strategies,” in Proceedings of the 5th Conference on e-mail and antispam

(CEAS), Mountain View, CA, 2008.

A. Ramachandran and N. Feamster, “Understanding the networklevel

behavior of spammers,” SIGCOMM Comput. Commun. Rev.,

vol. 36, no. 4, pp. 291–302, Aug. 2006. [Online]. Available:

http://doi.acm.org/10.1145/1151659.1159947

G. C. Moreira Moura, R. Sadre, and A. Pras, “Internet bad neighborhoods:

the spam case,” in 7th International Conference on Network

and Services Management (CNSM 2011), Paris, France, O. Festor and

E. Lupu, Eds. USA: IEEE Communications Society, October 2011, pp.

–8.

L. Zhuang, J. Dunagan, D. R. Simon, H. J. Wang, I. Osipkov, and

J. D. Tygar, “Characterizing botnets from email spam records.” in LEET,

F. Monrose, Ed. USENIX Association, 2008.

D. Raywood, “The botnet market and what you get for your money,”

SC Magazine UK, 2010.




DOI: https://doi.org/10.17648/enig.v2i1.48

Refbacks

  • There are currently no refbacks.




Licença Creative Commons
This site is licensed with the Creative Commons Atribuição-NãoComercial-SemDerivações 4.0 Internacional

RENASIC Logo1 Logo2 Logo3