^ Top

NANOG Meeting Presentation Abstract

Understanding the Network-Level Behavior of Spammers
Meeting: NANOG37
Date / Time: 2006-06-06 9:30am - 10:00am
Room: Exhibit Hall 3
Presenters: Speakers:
Nick Feamster, Georgia Tech University.
Anirudh Ramachandran, Georgia Tech University.
Abstract: We study the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent (in time) each spamming host is, botnet spamming characteristics, and techniques for harvesting email addresses. This presentation studies these questions by analyzing an 18-month trace of over 10 million spam messages collected at one Internet \"spam sinkhole,\" and by correlating these messages with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet \"command and control\" traces.

We find that a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked addresses. Most spam was received from a few regions of IP address space. Spammers appear to make use of transient \"bots\" that send only a few pieces of email over the course of a few minutes at most. These patterns suggest that developing algorithms to identify botnet membership, filtering email messages based on network-level properties (which are less variable than an email\'s contents), and improving the security of the Internet routing infrastructure may be prove extremely effective for combating spam.
Files: pdfNick Feamster Presentation(PDF)
youtubeUnderstanding the Network-Level Behavior of Spammers
Sponsors: None.

Back to NANOG37 agenda.

NANOG37 Abstracts

  • NANOG Community Meeting
    Moderators:
    Randy BushIIJ; .
    Panelists:
    Steve FeldmanCNET; .
    Betty BurkeMerit Network; .
    Rob SeastromClueTrust; .
  • NANOG Community Meeting
    Moderators:
    Randy BushIIJ; .
    Panelists:
    Steve FeldmanCNET; .
    Betty BurkeMerit Network; .
    Rob SeastromClueTrust; .
  • NANOG Community Meeting
    Moderators:
    Randy BushIIJ; .
    Panelists:
    Steve FeldmanCNET; .
    Betty BurkeMerit Network; .
    Rob SeastromClueTrust; .
  • NANOG Community Meeting
    Moderators:
    Randy BushIIJ; .
    Panelists:
    Steve FeldmanCNET; .
    Betty BurkeMerit Network; .
    Rob SeastromClueTrust; .
  • BGP Tools
    Speakers:
    Dan MasseyColorado State University; .
    Nick FeamsterMIT; .
    Lixiz ZhangUCLA; .
  • BGP Tools
    Speakers:
    Dan MasseyColorado State University; .
    Nick FeamsterMIT; .
    Lixiz ZhangUCLA; .
  • BGP Tools
    Speakers:
    Dan MasseyColorado State University; .
    Nick FeamsterMIT; .
    Lixiz ZhangUCLA; .
  • OPSEC WG
    Moderators:
    Ross Callon, Juniper; Panelists:
    Merike Kaeo, Double Shot Security; Chris Morrow, Verizon Business;
  • OPSEC WG
    Moderators:
    Ross Callon, Juniper; Panelists:
    Merike Kaeo, Double Shot Security; Chris Morrow, Verizon Business;
  • OPSEC WG
    Moderators:
    Ross Callon, Juniper; Panelists:
    Merike Kaeo, Double Shot Security; Chris Morrow, Verizon Business;
  • Security
    Moderators:
    Danny McPhersonArbor Networks; .
    Roland DobbinsCisco Systems; .
  • Security
    Moderators:
    Danny McPhersonArbor Networks; .
    Roland DobbinsCisco Systems; .

 
^ Back to Top