Visual spam campaigns analysis using abstract graphs representation

  • Authors:
  • Orestis Tsigkas;Olivier Thonnard;Dimitrios Tzovaras

  • Affiliations:
  • Information Technologies Institute Thessaloniki, Greece;Symantec Research Labs, Sophia Antipolis, France;Information Technologies Institute, Thessaloniki, Greece

  • Venue:
  • Proceedings of the Ninth International Symposium on Visualization for Cyber Security
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this work we present a visual analytics tool introducing a new kind of graph visualization that exploits the nodes' degree to provide a simplified and more abstract, yet accurate, representation of the most important elements of a security data set and their inter-relationships. Our visualization technique is designed to address two shortcomings of existing graph visualization techniques: scalability of visualization and comprehensibility of results. The main goal of our visual analytics tool is to provide security analysts with an effective way to reason interactively about various attack phenomena orchestrated by cyber criminals. We demonstrate the use of our tool on a large corpus of spam emails by visualizing spam campaigns performed by spam botnets. In particular, we focus on the analysis of spam sent in March 2011 to understand the impact of the Rustock takedown on the botnet ecosystem. As spam botnets continue to play a significant role in the worldwide spam problem, we show with this application how security visualization based on abstract graphs can help us gain insights into the strategic behavior of spam botnets, and a better understanding of large-scale spammers operations.