Botnet spam campaigns can be long lasting: evidence, implications, and analysis

Authors:
Abhinav Pathak;Feng Qian;Y. Charlie Hu;Z. Morley Mao;Supranamaya Ranjan
Affiliations:
Purdue University, West Lafayette, USA;University of Michigan, Ann Arbor, USA;Purdue University, West Lafayette, USA;University of Michigan, Ann Arbor, USA;Narus, Inc., Mountain View, USA
Venue:
Proceedings of the eleventh international joint conference on Measurement and modeling of computer systems
Year:
2009

Citing 10
Cited 13

Syntactic clustering of the Web

Selected papers from the sixth international conference on World Wide Web
Understanding the network-level behavior of spammers

Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
Characterizing residential broadband networks

Proceedings of the 7th ACM SIGCOMM conference on Internet measurement
Filtering spam with behavioral blacklisting

Proceedings of the 14th ACM conference on Computer and communications security
Spamscatter: characterizing internet scam hosting infrastructure

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
On the spam campaign trail

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
Characterizing botnets from email spam records

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
Peeking into spammer behavior from a unique vantage point

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
Spamming botnets: signatures and characteristics

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Spamalytics: an empirical analysis of spam marketing conversion

Proceedings of the 15th ACM conference on Computer and communications security

A case for unsupervised-learning-based spam filtering

Proceedings of the ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Fighting spam on the sender side: a lightweight approach

EUNICE'10 Proceedings of the 16th EUNICE/IFIP WG 6.6 conference on Networked services and applications: engineering, control and management
Characterizing Intelligence Gathering and Control on an Edge Network

ACM Transactions on Internet Technology (TOIT)
Towards the effective temporal association mining of spam blacklists

Proceedings of the 8th Annual Collaboration, Electronic messaging, Anti-Abuse and Spam Conference
Analysis of token and ticket based mechanisms for current VoIP security issues and enhancement proposal

CMS'10 Proceedings of the 11th IFIP TC 6/TC 11 international conference on Communications and Multimedia Security
Auto-learning of SMTP TCP transport-layer features for spam and abusive message detection

LISA'11 Proceedings of the 25th international conference on Large Installation System Administration
EigenBot: foiling spamming botnets with matrix algebra

Proceedings of the ACM SIGKDD Workshop on Intelligence and Security Informatics
Analysis of a "/0" stealth scan from a botnet

Proceedings of the 2012 ACM conference on Internet measurement conference
Taster's choice: a comparative analysis of spam feeds

Proceedings of the 2012 ACM conference on Internet measurement conference
Longtime behavior of harvesting spam bots

Proceedings of the 2012 ACM conference on Internet measurement conference
Understanding SMS spam in a large cellular network

Proceedings of the ACM SIGMETRICS/international conference on Measurement and modeling of computer systems
UNIK: unsupervised social network spam detection

Proceedings of the 22nd ACM international conference on Conference on information & knowledge management
Greystar: fast and accurate detection of SMS spam numbers in large cellular networks using grey phone space

SEC'13 Proceedings of the 22nd USENIX conference on Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Accurately identifying spam campaigns launched by a large number of bots in a botnet allows for accurate spam campaign signature generation and hence is critical to defeating spamming botnets. The straight-forward approach of clustering all spam containing the same label such as an URL into a campaign can be easily defeated by techniques such as simple obfuscations of URLs. In this paper, we perform a comprehensive study of content-agnostic characteristics of spam campaigns, e.g. duration and source-network distribution of spammers, in order to ascertain whether and how they can assist the simple label-based clustering methods in identifying campaigns and generating campaign signatures. In particular, from a five-month trace collected by a relay sinkhole, we manually identified and then analyzed seven URL-based botnet spam campaigns consisting of 52 million spam messages sent over 2.09 million SMTP connections originated from over 150,000 non-proxy spamming hosts and destined to about 200,000 end domains. Our analysis shows that the spam campaigns, when observed from large destination domains, exhibit durations far longer than the five-day period as reported in a recent study. We analyze the implications of this finding on spam campaign signature generation. We further study other characteristics of these long-lasting campaigns. Our analysis reveals several new findings regarding workload distribution, sending patterns, and coordination among the spamming machines.