A strategic analysis of spam botnets operations

ACM International Conference Proceeding Series

Volumn , Issue , 2011, Pages 162-171

  Thonnard, Olivier ^a   Dacier, Marc ^a  

^a SYMANTEC RESEARCH LABS   (United States)

Author keywords

Botnet intelligence; Rustock take down; Spam botnets

Indexed keywords

ATTACK ATTRIBUTION; BOTNET INTELLIGENCE; BOTNETS; DATA SETS; IN-DEPTH ANALYSIS; INTER-RELATIONSHIPS; MODUS OPERANDI; MULTI-CRITERIA DECISION ANALYSIS; RUSTOCK TAKE-DOWN; STRATEGIC ANALYSIS; STRATEGIC BEHAVIOR;

DATA FUSION;

INTERNET;

EID: 80053642264     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2030376.2030395     Document Type: Conference Paper

References (26)

1. G. Beliakov, A. Pradera, and T. Calvo. Aggregation Functions: A Guide for Practitioners. Springer, Berlin, New York, 2007.
2. M. P. Collins, T. J. Shimeall, S. Faber, J. Janies, R. Weaver, M. D. Shon, and J. Kadane. Using uncleanliness to predict future botnet addresses. In IMC '07: Proc. of the 7th ACM SIGCOMM conference on Internet measurement, pages 93-104, New York, NY, USA, 2007. ACM.
3. Composite Blocking List. http://cbl.abuseat.org.
4. M. Cova, C. Leita, O. Thonnard, A. D. Keromytis, and M. Dacier. An Analysis of Rogue AV Campaigns. In Proceedings of the 13th international conference on Recent advances in intrusion detection, RAID'10, pages 442-463, Berlin, Heidelberg, 2010. Springer-Verlag.
5. M. Dacier, V. Pham, and O. Thonnard. The WOMBAT Attack Attribution Method: Some Results. In Proc. of the 5th International Conference on Information Systems Security (ICISS 2009), Kolkata, India, Dec 2009.
6. B. Fuglede and F. Topsoe. Jensen-shannon divergence and hilbert space embedding. pages 31-, June-2 July 2004.
7. H. Husna, S. Phithakkitnukoon, S. Palla, and R. Dantu. Behavior analysis of spam botnets. In COMSWARE, pages 246-253. IEEE, 2008.
8. B. Krebs. Rustock Botnet Flatlined, Spam Volumes Plummet. http://krebsonsecurity.com/2011/03/ rustock-botnet-flatlined-spam-volumes- plummet/, March 2011.
9. F. Li and M.-H. Hsieh. An empirical study of clustering behavior of spammers and group-based anti-spam strategies. In CEAS, 2006.
10. T. Mori, H. Esquivel, A. Akella, A. Shimoda, and S. Goto. Understanding Large-Scale Spamming Botnets From Internet Edge Sites. In CEAS, 2010.
11. P. Muncaster. V3.co.uk Blog. Bagle fills botnet hole as spam drops by third after Rustock takedown. http://www.v3.co.uk/, March 29, 2011.
12. E. Park. Rustock Takedown's Effect on Global Spam Volume. http://www.symantec.com/connect/blogs/ rustock-takedown-s-effect-global-spam- volume, March 2011.
13. M. Pavan and M. Pelillo. A new graph-theoretic approach to clustering and segmentation. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, 2003.
14. A. Ramachandran and N. Feamster. Understanding the network-level behavior of spammers. In Proc. of the 2006 conference on applications, technologies, architectures, and protocols for computer communications, SIGCOMM '06, pages 291-302, New York, USA, 2006. ACM.
15. R. N. Shepard. Multidimensional scaling, tree fitting, and clustering. Science, 210:390-398, 1980.
16. J. Stewart. Top Spam Botnets Exposed. Malware Research, SecureWorks, April 2008. http: //www.secureworks.com/research/threats/topbotnets/.
17. Symantec Corporation. Symantec Report on Rogue Security Software. http://www.symantec.com/business/ theme.jsp?themeid=threatreport, October 2009.
18. Symantec.cloud. Messagelabs Intelligence: 2010 Annual Security Report. http://www.messagelabs.com/globalthreats.
19. The Wall Street Journal. Spam Network Shut Down. http://online.wsj.com/ article/ SB10001424052748703328404576207173861008758.html, March 18, 2011.
20. O. Thonnard. A multi-criteria clustering approach to support attack attribution in cyberspace. PhD thesis, École Doctorale d'Informatique, Télécommunications et Électronique de Paris,March 2010.
21. O. Thonnard, W. Mees, and M. Dacier. On a multicriteria clustering approach for attack attribution. SIGKDD Explor. Newsl., 12:11-20, November 2010.
22. WOMBAT Project. Worldwide Observatory of Malicious Behaviors and Attack Threats. Deliverable D22 (D5.2). Root Causes Analysis: Experimental Report. http://www.wombat-project.eu, May 2011.
23. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov. Spamming botnets: signatures and characteristics. In Proceedings of the ACM SIGCOMM 2008 conference on Data communication, SIGCOMM '08, pages 171-182, New York, NY, USA, 2008. ACM.
24. R. Yager. On ordered weighted averaging aggregation operators in multicriteria decision-making. IEEE Trans. Syst. Man Cybern., 18(1):183-190, 1988.
25. T. Zink. Has anyone stepped in to fill Rustock's gap? http://blogs.msdn.com/b/tzink/, May 23, 2011.
26. T. Zink. Who has taken over as the most prolific botnet since Rustock was taken down? http://blogs.msdn.com/b/tzink/, March 29, 2011.