Click trajectories: End-to-end analysis of the spam value chain

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2011, Pages 431-446

  Levchenko, Kirill ^a   Pitsillidis, Andreas ^a   Chachra, Neha ^a   Enright, Brandon ^a   Félegyházi, Márk ^d   Grier, Chris ^b   Halvorson, Tristan ^a   Kanich, Chris ^a   Kreibich, Christian ^b,c   Liu, He ^a   McCoy, Damon ^a   Weaver, Nicholas ^b,c   Paxson, Vern ^b,c   Voelker, Geoffrey M ^a   Savage, Stefan ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c INTERNATIONAL COMPUTER SCIENCE INSTITUTE   (United States)

^d BUDAPEST UNIVERSITY OF TECHNOLOGY AND ECONOMICS   (Hungary)

Author keywords

[No Author keywords available]

Indexed keywords

ADVERTIZING; ANTI-SPAM; END-TO-END ANALYSIS; HOLISTIC ANALYSIS; MEASUREMENTS OF; PHARMACEUTICAL PRODUCTS; SOFTWARE PRODUCTS; SPAM E-MAILS; SPAM FILTERING; VALUE CHAINS;

CHAINS;

EID: 80051960199     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2011.24     Document Type: Conference Paper

References (59)

1. D. S. Anderson, C. Fleizach, S. Savage, and G. M. Voelker. Spamscatter: Characterizing Internet Scam Hosting Infrastructure. In Proc. of 16th USENIX Security, 2007.
2. I. Androutsopoulos, J. Koutsias, K. Chandrinos, G. Paliouras, and C. D. Spyropoulos. An Evaluation of Naive Bayesian Anti-Spam Filtering. In Proc. of 1st MLNIA, 2000.
3. J. Armin, J. McQuaid, and M. Jonkman. Atrivo - Cyber Crime USA. http://fserror.com/pdf/Atrivo.pdf, 2008.
4. Behind Online Pharma. From Mumbai to Riga to New York: Our Investigative Class Follows the Trail of Illegal Pharma. http://behindonlinepharma.com, 2009.
5. C. Castelluccia, M. A. Kaafar, P. Manils, and D. Perito. Geolocalization of Proxied Services and its Application to Fast-Flux Hidden Servers. In Proc. of 9th IMC, 2009.
6. R. Clayton. How much did shutting down McColo help? In Proc. of 6th CEAS, 2009.
7. Dancho Danchev's Blog - Mind Streams of Information Security Knowledge. The Avalanche Botnet and the TROYAK-AS Connection. http://ddanchev.blogspot.com/ 2010/05/avalanche-botnet-and-troyak-as.html, 2010.
8. Federal Trade Commission. FTC Shuts Down, Freezes Assets of Vast International Spam E-Mail Network. http://ftc.gov/opa/2008/10/herbalkings.shtm, 2008.
9. W. Feng and E. Kaiser. kaPoW Webmail: Effective Disincentives Against Spam. In Proc. of 7th CEAS, 2010.
10. J. Franklin, V. Paxson, A. Perrig, and S. Savage. An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants. In Proc. of 14th ACM CCS, 2007.
11. Gamblingplanet.org. Visa blocks gaming transactions for US players. http://www.gamblingplanet.org/news/Visa-blocks-gaming-transactions-for-US- players/022310, 2010.
12. C. Grier, K. Thomas, V. Paxson, and M. Zhang. @spam: The Underground on 140 Characters or Less. In Proc. of 17th ACM CCS, 2010.
13. G. Gu, J. Zhang, and W. Lee. BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic. In Proc. of 15th NDSS, 2008.
14. S. Hao, N. Feamster, A. Gray, N. Syed, and S. Krasser. Detecting Spammers with SNARE: Spatio-Temporal NetworkLevel Automated Reputation Engine. In Proc. of 18th USENIX Security, 2009.
15. C. Herley and D. Florencio. Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy. In Proc. of 8th WEIS, 2009.
16. T. Holz, M. Engelberth, and F. Freiling. Learning More About the Underground Economy: A Case-Study of Keyloggers and Dropzones. In Proc. of 15th ESORICS, 2009.
17. T. Holz, C. Gorecki, K. Rieck, and F. C. Freiling. Measuring and Detecting Fast-Flux Service Networks. In Proc. of 15th NDSS, 2008.
18. X. Hu, M. Knysz, and K. G. Shin. RB-Seeker: Auto-detection of Redirection Botnets. In Proc. of 16th NDSS, 2009.
19. D. Irani, S. Webb, J. Giffin, and C. Pu. Evolutionary Study of Phishing. In eCrime Researchers Summit, pages 1-10, 2008.
20. J. P. John, A. Moshchuk, S. D. Gribble, and A. Krishnamurthy. Studying Spamming Botnets Using Botlab. In Proc. of 6th NSDI, 2009.
21. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. M. Voelker, V. Paxson, and S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. In Proc. of 15th ACM CCS, 2008.
22. M. Konte, N. Feamster, and J. Jung. Dynamics of Online Scam Hosting Infrastructure. In Proc. of 10th PAM, 2009.
23. Krebs on Security. Body Armor for Bad Web Sites. http://krebsonsecurity. com/2010/11/body-armor-for-bad-web-sites/, 2010.
24. C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G. M. Voelker, V. Paxson, and S. Savage. Spamcraft: An Inside Look at Spam Campaign Orchestration. In Proc. of 2nd USENIX LEET, 2009.
25. LegitScript and eNom. LegitScript Welcomes Agreement with eNom (Demand Media). http://www.legitscript.com/blog/142, 2010.
26. LegitScript and KnujOn. No Prescription Required: Bing.com Prescription Drug Ads. http://www.legitscript.com/download/BingRxReport.pdf, 2009.
27. LegitScript and KnujOn. Yahoo! Internet Pharmacy Advertisements. http://www.legitscript.com/download/YahooRxAnalysis.pdf, 2009.
28. LegitScript and KnujOn. Rogues and Registrars: Are some Domain Name Registrars safe havens for Internet drug rings? http://www.legitscript.com/ download/Rogues-and-Registrars-Report.pdf, 2010.
29. H. Liu, K. Levchenko, M. Félegyházi, C. Kreibich, G. Maier, G. M. Voelker, and S. Savage. On the Effects of Registrarlevel Intervention. In Proc. of 4th USENIX LEET, 2011.
30. B. Livingston. Web registrars may take back your domain name. http://news.cnet.com/2010-1071-281311.html, 2000.
31. M86 Security Labs. Top Spam Affiliate Programs. http://www.m86security. com/labs/traceitem.asp?article=1070, 2009.
32. J. Ma, L. K. Saul, S. Savage, and G. M. Voelker. Identifying Suspicious URLs: An Application of Large-Scale Online Learning. In Proc. of 26th ICML, 2009.
33. *#?% Enlargements. O'Reilly Media, Sept. 2004.
34. D. Molnar, S. Egelman, and N. Christin. This Is Your Data on Drugs: Lessons Computer Security Can Learn From The Drug War. In Proc. of 13th NSPW, 2010.
35. T. Moore and R. Clayton. The Impact of Incentives on Notice and Take-down. In Proc. of 7th WEIS, 2008.
36. T. Moore, R. Clayton, and H. Stern. Temporal Correlations between Spam and Phishing Websites. In Proc. of 2nd USENIX LEET, 2009.
37. M. Motoyama, K. Levchenko, C. Kanich, D. McCoy, G. M. Voelker, and S. Savage. Re: CAPTCHAs - Understanding CAPTCHA Solving from an Economic Context. In Proc. of 19th USENIX Security, 2010.
38. A. Mutton. Screengrab! http://www.screengrab.org/, 2010.
39. Y. Niu, Y.-M. Wang, H. Chen, M. Ma, and F. Hsu. A Quantitative Study of Forum Spamming Using Context-based Analysis. In Proc. of 14th NDSS, 2007.
40. C. Nunnery, G. Sinclair, and B. B. Kang. Tumbling Down the Rabbit Hole: Exploring the Idiosyncrasies of Botmaster Systems in a Multi-Tier Botnet Infrastructure. In Proc. of 3rd USENIX LEET, 2010.
41. E. Passerini, R. Paleari, L. Martignoni, and D. Bruschi. FluXOR: Detecting and Monitoring Fast-Flux Service Networks. In Proc. of 5th DIMVA, 2008.
42. R. Perdisci, I. Corona, D. Dagon, and W. Lee. Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces. In Proc. of 25th ACSAC, 2009.
43. A. Pitsillidis, K. Levchenko, C. Kreibich, C. Kanich, G. Voelkera, V. Paxson, N. Weaver, and S. Savage. Botnet Judo: Fighting Spam with Itself. In Proc. of 17th NDSS, 2010.
44. Z. Qian, Z. M. Mao, Y. Xie, and F. Yu. On Network-level Clusters for Spam Detection. In Proc. of 17th NDSS, 2010.
45. A. Ramachandran and N. Feamster. Understanding the Network-Level Behavior of Spammers. In Proc. of ACM SIGCOMM, 2006.
46. D. Samosseiko. The Partnerka - What is it, and why should you care? In Proc. of Virus Bulletin Conference, 2009.
47. S. Sinha, M. Bailey, and F. Jahanian. Shades of Grey: On the effectiveness of reputation-based "blacklists". In Proc. of 3rd MALWARE, 2008.
48. S. Sinha, M. Bailey, and F. Jahanian. Improving SPAM Blacklisting through Dynamic Thresholding and Speculative Aggregation. In Proc. of 17th NDSS, 2010.
49. K. Stevens. The Underground Economy of the Pay-Per-Install (PPI) Business. http://www.secureworks.com/research/threats/ppi, 2009.
50. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna. Your Botnet Is My Botnet: Analysis of a Botnet Takeover. In Proc. of 16th ACM CCS, 2009.
51. B. Stone-Gross, C. Kruegel, K. Almeroth, A. Moser, and E. Kirda. FIRE: FInding Rogue nEtworks. In Proc. of 25th ACSAC, 2009.
52. Visa Commercial Solutions. Merchant Category Codes for IRS Form 1099-MISC Reporting. http://usa.visa.com/download/corporate/resources/mcc booklet.pdf.
53. Y.-M. Wang, M. Ma, Y. Niu, and H. Chen. Spam Double-Funnel: Connecting Web Spammers with Advertisers. In Proc. of 16th WWW, 2007.
54. G. Warner. Random Pseudo-URLs Try to Confuse Anti-Spam Solutions. http://garwarner.blogspot.com/2010/09/random-pseudo-urls-try-to-confuse-anti. html, Sept. 2010.
55. C. Whittaker, B. Ryner, and M. Nazif. Large-Scale Automatic Classification of Phishing Pages. In Proc. of 17th NDSS, 2010.
56. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov. Spamming Botnets: Signatures and Characteristics. In Proc. of ACM SIGCOMM, 2008.
57. L. Zhang, J. Zhu, and T. Yao. An Evaluation of Statistical Spam Filtering Techniques. ACM Trans. on ALIP, 3(4), 2004.
58. Y. Zhao, Y. Xie, F. Yu, Q. Ke, Y. Yu, Y. Chen, and E. Gillum. BotGraph: Large-Scale Spamming Botnet Detection. In Proc. of 6th NSDI, 2009.
59. J. Zhuge, T. Holz, C. Song, J. Guo, X. Han, and W. Zou. Studying Malicious Websites and the Underground Economy on the Chinese Web. In Proc. of 7th WEIS, 2008.