Understanding the network-level behavior of spammers

ABSTRACT

This paper studies the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent across time each spamming host is, and characteristics of spamming botnets. We try to answer these questions by analyzing a 17-month trace of over 10 million spam messages collected at an Internet "spam sinkhole", and by correlating this data with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet "command and control" traces.We find that most spam is being sent from a few regions of IP address space, and that spammers appear to be using transient "bots" that send only a few pieces of email over very short periods of time. Finally, a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked prefixes. These trends suggest that developing algorithms to identify botnet membership, filtering email messages based on network-level properties (which are less variable than email content), and improving the security of the Internet routing infrastructure, may prove to be extremely effective for combating spam.

REFERENCES

• 1: D. Bank and R. Richmond. Where the Dangers Are. The Wall Street Journal, July 2005. http://online.wsj.com/public/article/SB112128442038984802-4qR772hjUeqGT2W0FIcA3FNjE_20060717.html.
• 2: M. Casado, T. Garfinkel, W. Cui, V. Paxson, and S. Savage. Opportunistic measurement: Extracting insight from spurious traffic. In Proc. 4th ACM Workshop on Hot Topics in Networks (Hotnets-IV), College Park, MD, Nov. 2005.
• 3: CNN Technology News. Expert: Botnets No. 1 emerging Internet threat. http://www.cnn.com/2006/TECH/internet/01/31/furst/, Jan. 2006.
• 4: Description of coordinated spamming, Feb. 2005. http://www.waltdnes.org/spam.
• 5: J. Evers. Most spam still coming from the U.S. http://news.com.com/Most+spam+still+coming+from+the+U.S./2100-1029_3-6030758.html, Jan. 2006.
• 6: N. Feamster. Open problems in BGP anomaly detection. In CAIDA Workshop on Internet Signal Processing, San Diego, CA, Nov. 2004.
• 7: Nick Feamster , David G. Andersen , Hari Balakrishnan , M. Frans Kaashoek, Measuring the effects of internet path faults on reactive routing, Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, June 11-14, 2003, San Diego, CA, USA
• 8: Nick Feamster , Jaeyeon Jung , Hari Balakrishnan, An empirical study of "bogon" route advertisements, ACM SIGCOMM Computer Communication Review, v.35 n.1, January 2005 [doi>10.1145/1052812.1052826]
• 9: Goodmail Systems, 2006. http://www.goodmailsystems.com/.
• 10: J. Goodman. IP Addresses in Email Clients. In First Conference on Email and Anti-Spam, Mountain View, CA, July 2004.
• 11: S. Hansell. Postage is due for companies sending email, February 5, 2006. http://www.nytimes.com/2006/02/05/technology/05AOL.html.
• 12: Honeynet Project. Know Your Enemy: Tracking Botnets. http://www.honeynet.org/papers/bots/botnet-commands.html, 2006.
• 13: Jaeyeon Jung , Emil Sit, An empirical study of spam traffic and the use of DNS black lists, Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, October 25-27, 2004, Taormina, Sicily, Italy [doi>10.1145/1028788.1028838]
• 14: A. Kumar, V. Paxson, and N. Weaver. Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event. In Proc. ACM SIGCOMM Internet Measurement Conference, Berkeley, CA, Oct. 2005.
• 15: Ratul Mahajan , David Wetherall , Tom Anderson, Understanding BGP misconfiguration, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 16: MailAvenger, 2005. http://www.mailavenger.org/.
• 17: J. Mason. Spam Forensics: Reverse-Engineering Spammer Tactics. http://spamassassin.apache.org/presentations/2004-09-Toorcon/html/, Sept. 2004.
• 18: Microsoft security bulletin ms04-011. http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx, Apr. 2004.
• 19: David Moore , Colleen Shannon , k claffy, Code-Red: a case study on the spread and victims of an internet worm, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637244]
• 20: Operating System Market Shares. http://marketshare.hitslink.com/report.aspx?qprid=2, Jan. 2006.
• 21: The Open Relay Database, 2006. http://ordb.org/.
• 22: M. Prince, B. Dahl, L. Holloway, A. Keller, and E. Langheinrich. Understanding How Spammers Steal Your E-Mail Address: An Analysis of the First Six Months of Data from Project Honey Pot. In Second Conference on Email and Anti-Spam, Stanford, CA, July 2005.
• 23: Project Honey Pot. http://www.projecthoneypot.org/.
• 24: A. Ramachandran and N. Feamster. Understanding the Network-Level Behavior of Spammers. Technical Report GT-CSS-2006-001, Georgia Tech, Feb. 2006.
• 25: S. Ramasubramanian. Port 25 filters - how many here deploy them bidirectionally? http://www.merit.edu/mail.archives/nanog/2005-01/msg00127.html, Jan. 2005.
• 26: The Spam and Open Relay Blocking System (SORBS), 2006. http://www.sorbs.net/.
• 27: SpamAssassin, 2005. http://www.spamassassin.org/.
• 28: Spammer-X. Inside the Spam Cartel. Syngress, Nov 2004.
• 29: Stuart Staniford , Vern Paxson , Nicholas Weaver, How to Own the Internet in Your Spare Time, Proceedings of the 11th USENIX Security Symposium, p.149-167, August 05-09, 2002
• 30: J. Todd. AS number inconsistencies, July 2002. http://www.merit.edu/mail.archives/nanog/2002-07/msg00259.html.
• 31: ZDNet Security News. Most spam genrated by botnets, expert says. http://news.zdnet.co.uk/internet/security/0,39020375,39167561,00.htm, Sept. 2004.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network management

General Terms:
Design, Management, Reliability, Security

Keywords:
BGP, botnet, network management, security, spam