NDLI: Botnet spam campaigns can be long lasting:evidence, implications, and analysis

Content Provider	ACM Digital Library
Author	Qian, Feng Mao, Z. Morley Hu, Y. Charlie Ranjan, Supranamaya Pathak, Abhinav
Abstract	Accurately identifying spam campaigns launched by a large number of bots in a botnet allows for accurate spam campaign signature generation and hence is critical to defeating spamming botnets. The straight-forward approach of clustering all spam containing the same label such as an URL into a campaign can be easily defeated by techniques such as simple obfuscations of URLs. In this paper, we perform a comprehensive study of content-agnostic characteristics of spam campaigns, e.g. duration and source-network distribution of spammers, in order to ascertain whether and how they can assist the simple label-based clustering methods in identifying campaigns and generating campaign signatures. In particular, from a five-month trace collected by a relay sinkhole, we manually identified and then analyzed seven URL-based botnet spam campaigns consisting of 52 million spam messages sent over 2.09 million SMTP connections originated from over 150,000 non-proxy spamming hosts and destined to about 200,000 end domains. Our analysis shows that the spam campaigns, when observed from large destination domains, exhibit durations far longer than the five-day period as reported in a recent study. We analyze the implications of this finding on spam campaign signature generation. We further study other characteristics of these long-lasting campaigns. Our analysis reveals several new findings regarding workload distribution, sending patterns, and coordination among the spamming machines.
Starting Page	13
Ending Page	24
Page Count	12
File Format	PDF
ISSN	01635999
DOI	10.1145/2492101.1555352
Journal	ACM SIGMETRICS Performance Evaluation Review (PERV)
Volume Number	37
Issue Number	1
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-01-10
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Spam campaign Botnet Distributedness Open relay Burstiness
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Hardware and Architecture Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Botnet spam campaigns can be long lasting: evidence, implications, and analysis

Botnet spam campaigns can be long lasting: evidence, implications, and analysis.

A case for unsupervised-learning-based spam filtering

Detecting Spam and Promoting Campaigns in Twitter

Bound analysis of closed queueing networks with workload burstiness

Spamming botnets:signatures and characteristics

Poster:on capacity maximization in wireless relay networks

A measurement analysis of Internet traffic over frame relay

Fast statistical spam filter by approximate classifications

Botnet spam campaigns can be long lasting:evidence, implications, and analysis

Similar Documents

Botnet spam campaigns can be long lasting: evidence, implications, and analysis

Botnet spam campaigns can be long lasting: evidence, implications, and analysis.

A case for unsupervised-learning-based spam filtering

Detecting Spam and Promoting Campaigns in Twitter

Bound analysis of closed queueing networks with workload burstiness

Spamming botnets:signatures and characteristics

Poster:on capacity maximization in wireless relay networks

A measurement analysis of Internet traffic over frame relay

Fast statistical spam filter by approximate classifications

Botnet spam campaigns can be long lasting:evidence, implications, and analysis