Thwarting E-mail Spam Laundering

Abstract

Laundering e-mail spam through open-proxies or compromised PCs is a widely-used trick to conceal real spam sources and reduce spamming cost in the underground e-mail spam industry. Spammers have plagued the Internet by exploiting a large number of spam proxies. The facility of breaking spam laundering and deterring spamming activities close to their sources, which would greatly benefit not only e-mail users but also victim ISPs, is in great demand but still missing. In this article, we reveal one salient characteristic of proxy-based spamming activities, namely packet symmetry, by analyzing protocol semantics and timing causality. Based on the packet symmetry exhibited in spam laundering, we propose a simple and effective technique, DBSpam, to online detect and break spam laundering activities inside a customer network. Monitoring the bidirectional traffic passing through a network gateway, DBSpam utilizes a simple statistical method, Sequential Probability Ratio Test, to detect the occurrence of spam laundering in a timely manner. To balance the goals of promptness and accuracy, we introduce a noise-reduction technique in DBSpam, after which the laundering path can be identified more accurately. Then DBSpam activates its spam suppressing mechanism to break the spam laundering. We implement a prototype of DBSpam based on libpcap, and validate its efficacy on spam detection and suppression through both theoretical analyses and trace-based experiments.

On the effectiveness of IP reputation for spam filtering

“…Many DNSBL projects such as [5], [19], [30] have made great effort in compiling lists of these servers in the wild. As Xie et al indicated, open proxies has been commonly used to launder the sources of email spam [31].…”

Efficient E-mail Management System with Bandwidth Reduction and 3-Level Message Prioritization

“…So, the solution is to upgrade the management system of traditional e-mail such that; the sender can determine the degree of message importance that will be sent, and the receiver can determine the importance of sender e-mail address that the message comes from. This technique is called message prioritization [1], [2], [3], [4], [5], [6], [7]. This paper proceeds as follows; the traditional e-mail system analysis is demonstrated at Section 2.…”