Neighborhoods and bands: an analysis of the origins of spam

Abstract

Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands.

A cyber kill chain based taxonomy of banking Trojans for evolutionary computational intelligence

“…Email Signatures; Trojans can spoof sender's address to reflect well known organisations such as banks, power companies and post office. A signature based on these known malicious trends can be created along with a blocking rule on an IDS to prevent users from receiving such emails [111], [112]. Although this strategy can be easily bypassed by adversaries, it is still effective in the absence of adversaries' knowledge of being shunned.…”

“…As Trojans are mostly delivered though unsolicited emails (referred to as spam) [125], analysis of these emails can lead to establishment of a pattern or a detection matrix . Filters can be set to scan for specific fingerprints from subject headers, message bodies, white and even black lists email addresses [111], [112].…”

SMS spam filtering and thread identification using bi-level text classification and clustering techniques

“…Another approach of email thread reassembly using similarity matching is presented by Yeh and Harnly [39]. Fonseca et al presented a technique to reduce spam messages based on neighbourhoods by classifying it into good or bad neighbourhoods and source of spam [40].…”