Spamalytics: an empirical analysis of spam marketing conversion

ABSTRACT

The "conversion rate" of spam--the probability that an unsolicited e-mail will ultimately elicit a "sale"--underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet's infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing on-line pharmaceuticals. For nearly a half billion spam e-mails we identify the number that are successfully delivered, the number that pass through popular anti-spam filters, the number that elicit user visits to the advertised sites, and the number of "sales" and "infections" produced.

REFERENCES

• 1: Composite Blocking List (CBL). http://cbl.abuseat.org/, March 2008.
• 2: C. Akass. Storm worm 'making millions a day'. http://www.pcw.co.uk/personal-computer-world/news/2209293/strom-worm-making-millions-day, February 2008.
• 3: David S. Anderson , Chris Fleizach , Stefan Savage , Geoffrey M. Voelker, Spamscatter: characterizing internet scam hosting infrastructure, Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium, p.1-14, August 06-10, 2007, Boston, MA
• 4: J. Angwin. Elusive Spammer Sends EarthLink on Long Chase. http://online.wsj.com/article_email/SB105225593382372600.html, May 2003.
• 5: D.M. Association. DMA Releases 5th Annual 'Response Rate Trends Report'. http://www.the--dma.org/cgi/disppressrelease?article=1008, October 2007.
• 6: J. Aycock and N. Friess. Spam Zombies from Outer Space, January 2006.
• 7: R. Boehme and T. Ho. The Effect of Stock Spam on Financial Markets. In Proceedings of the Fifth Workshop on the Economics of Information Security (WEIS), June 2006.
• 8: L. Frieder and J. Zittrain. Spam Works: Evidence from Stock Touts and Corresponding Market Activity. Berkman Center Research Publication, 2006.
• 9: Joshua T. Goodman , Robert Rounthwaite, Stopping outgoing spam, Proceedings of the 5th ACM conference on Electronic commerce, May 17-20, 2004, New York, NY, USA [doi>10.1145/988772.988779]
• 10: M. Hanke and F. Hauser. On the Effects of Stock Spam E-mails. Journal of Financial Markets, 11(1):57--83, 2008.
• 11: Ironport. 2008 Internet Security Trends. http://www.ironport.com/securitytrends/, 2008.
• 12: Chris Kanich , Kirill Levchenko , Brandon Enright , Geoffrey M. Voelker , Stefan Savage, The heisenbot uncertainty problem: challenges in separating bots from chaff, Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, p.1-9, April 15-15, 2008, San Francisco, California
• 13: D. Khong. An Economic Analysis of Spam Law. Erasmus Law and Economics Review, 1(1), 2004.
• 14: J. Kirk. Former spammer: 'I know I'm going to hell'. http://www.macworld.com/article/58997/2007/07/spammer.html, July 2007.
• 15: Christian Kreibich , Chris Kanich , Kirill Levchenko , Brandon Enright , Geoffrey M. Voelker , Vern Paxson , Stefan Savage, On the spam campaign trail, Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, p.1-9, April 15-15, 2008, San Francisco, California
• 16: Petar Maymounkov , David Mazières, Kademlia: A Peer-to-Peer Information System Based on the XOR Metric, Revised Papers from the First International Workshop on Peer-to-Peer Systems, p.53-65, March 07-08, 2002
• 17: W.Y.P. Judge, D. Alperovitch. Understanding and Reversing the Profit Model of Spam. In Workshop on Economics of Information Security 2005. (WEIS 2005), Boston, MA, USA, June 2005.
• 18: Anirudh Ramachandran , Nick Feamster , David Dagon, Revealing botnet membership using DNSBL counter-intelligence, Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet, p.8-8, July 07, 2006, San Jose, CA
• 19: A. Serjantov and R. Clayton. Modeling Incentives for Email Blocking Strategies. Workshop on the Economics of Information Security (WEIS05), 2005.
• 20: Yi-Min Wang , Ming Ma , Yuan Niu , Hao Chen, Spam double-funnel: connecting web spammers with advertisers, Proceedings of the 16th international conference on World Wide Web, May 08-12, 2007, Banff, Alberta, Canada [doi>10.1145/1242572.1242612]
• 21: D. Watson. All Spammers Go to Hell (posting to funsec list). http://www.mail-archive.com/funsec%40linuxbox.org/msg03346.html, July 2007.
• 22: T. Wilson. Competition May be Driving Surge in Botnets, Spam. http://www.darkreading.com/document.asp?doc_id=142690, 2008.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Abuse and crime involving computers

General Terms:
Economics, Measurement, Security

Keywords:
conversion, spam, unsolicited email