Correlating Spam Activity with IP Address Characteristics

Correlating Spam Activity with IP Address Characteristics

Wilcox, Chris and Papadopoulos, Christos and Heidemann, John
USC/Information Sciences Institute

Chris Wilcox, Christos Papadopoulos and John Heidemann 2010. Correlating Spam Activity with IP Address Characteristics. Proceedings of the IEEE Global Internet Symposium (San Diego, California, USA, Mar. 2010), 1–6.

Abstract

It is well known that spam bots mostly utilize compromised machines with certain address characteristics, such as dynamically allocated addresses, machines in specific geographic areas and IP ranges from AS’ with more tolerant spam policies. Such machines tend to be less diligently administered and may exhibit less stability, more volatility, and shorter uptimes. However, few studies have attempted to quantify how such spam bot address characteristics compare with non-spamming hosts. Quantifying these characteristics may help provide important information for comprehensive spam mitigation. We use two large datasets, namely a commercial blacklist and an Internet-wide address visibility study to quantify address characteristics of spam and non-spam networks. We find that spam networks exhibit significantly less availability and uptime, and higher volatility than non-spam networks. In addition, we conduct a collateral damage study of a common practice where an ISP blocks the entire /24 prefix if spammers are detected in that range. We find that such a policy blacklists a significant portion of legitimate mail servers belonging to the same prefix.

Reference

@inproceedings{Wilcox10a,
  author = {Wilcox, Chris and Papadopoulos, Christos and Heidemann, John},
  title = {Correlating Spam Activity with IP Address Characteristics},
  booktitle = {Proceedings of the  IEEE Global Internet Symposium},
  year = {2010},
  sortdate = {2010-03-01},
  project = {ant, lander, madcat},
  jsubject = {network_security},
  pages = {1--6},
  address = {San Diego, California, USA},
  month = mar,
  publisher = {IEEE},
  doi = {http://dx.doi.org/10.1109/INFCOMW.2010.5466660},
  url = {http://www.isi.edu/%7ejohnh/PAPERS/Wilcox10a.html},
  pdfurl = {http://www.isi.edu/%7ejohnh/PAPERS/Wilcox10a.pdf},
  myorganization = {USC/Information Sciences Institute},
  location = {johnh: pafile},
  keywords = {spam, IP address analysis, correlation,
                    collateral damage},
  copyrightholder = {IEEE},
  copyrightterms = {
  	Personal use of this material is permitted.  However,
  	permission to reprint/republish this material for advertising
  	or promotional purposes or for creating new collective works
          for resale or redistribution to servers or lists,
  	or to reuse any copyrighted component of this work in other works
  	must be obtained from the IEEE.
  }
}

Copyright

Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.