Humans and bots in internet chat: Measurement, analysis, and automated classification

IEEE/ACM Transactions on Networking

Volumn 19, Issue 5, 2011, Pages 1557-1571

  Gianvecchio, Steven ^a   Xie, Mengjun ^b   Wu, Zhenyu ^c   Wang, Haining ^c  

^a MITRE CORPORATION   (United States)

^b University of Arkansas at Little Rock ^*  (United States)

^c Dept of Economics and Thomas Jefferson Program in Public Policy at the College of William and Mary   (United States)

Author keywords

Bots; classification; Internet chat; measurement

Indexed keywords

AUTOMATED CLASSIFICATION; BOT DETECTIONS; BOTS; CLASSIFICATION SYSTEM; EXPERIMENTAL EVALUATION; HUMAN BEHAVIORS; HUMAN USERS; INTERNET CHAT; INTERNET USERS; MALWARES; MEASUREMENT STUDY; TWO-COMPONENT;

BEHAVIORAL RESEARCH; ENTROPY; TELECOMMUNICATION NETWORKS;

INTERNET;

EID: 80054091651     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2011.2126591     Document Type: Article

References (43)

1. C. Dewes, A. Wichmann, and A. Feldmann, "An analysis of Internet chat systems," in Proc. ACM SIGCOMM IMC, Miami, FL, Oct. 2003, pp. 51-64. (Pubitemid 40730639)
2. J. Hu, "AOL spam petitions cut both ways," CNET News Dec. 22, 2010 [Online]. Available: http://news.cnet.com/AOL-spam-petitionscut-both-ways/ 2100-1024-3-1015385.html
3. B. Krebs, "Yahoo! Messenger network overrun by bots," Washington Post Dec. 18, 2007 [Online]. Available: http://blog.washingtonpost. com/securityfix/2007/08/yahoo-messenger-network-overru.html
4. A. Mohta, "Yahoo Chat: CAPTCHA check to remove bots," Technospot.Net Dec. 18, 2007 [Online]. Available: http://www. technospot.net/blogs/yahoo-chat-captcha-check-to-remove-bots/
5. A. Mohta, "Bots are back in Yahoo chat rooms," Technospot.Net Dec. 18, 2007 [Online]. Available: http://www.technospot.net/blogs/botsare-back- in-yahoo-chat-room/
6. V. Hinze-Hoare, "Should cyberspace chat rooms be closed to protect children?," Comput. Res. Repository, 2004.
7. S. Bono, D. Caselden, G. Landau, and C. Miller, "Reducing the attack surface in massively multiplayer online role-playing games," IEEE Security Privacy, vol. 7, no. 3, pp. 13-19, May-Jun. 2009.
8. "YahElite chat client," Yahelite.org, Jan. 8, 2008 [Online]. Available: http://www.yahelite.org/
9. L. V. Ahn, M. Blum, N. Hopper, and J. Langford, "CAPTCHA: Using hard AI problems for security," in Proc. Eurocrypt, Warsaw, Poland, May 2003, pp. 294-311.
10. R. B. Jennings, III, E. M. Nahum, D. P. Olshefski, D. Saha, Z.-Y. Shae, and C. Waters, "A study of internet instant messaging and chat protocols," IEEE Netw., vol. 20, no. 4, pp. 16-21, Jul.-Aug. 2006. (Pubitemid 44270226)
11. E. Mills, "Yahoo closes chat rooms over child sex concerns," CNET News Jan. 27, 2008 [Online]. Available: http://news.cnet.com/2100-1025-3- 5759705.html
12. Z. Liu, W. Lin, N. Li, and D. Lee, "Detecting and filtering instant messaging spam-a global and personalized approach," in Proc. NPSEC, Boston, MA, Nov. 2005, pp. 19-24. (Pubitemid 44461870)
13. M. Mannan and P. C. van Oorschot, "On instant messaging worms, analysis and countermeasures," in Proc. ACM WORM, Fairfax, VA, Nov. 2005, pp. 2-11. (Pubitemid 43183505)
14. M. Xie, Z. Wu, and H. Wang, "HoneyIM: Fast detection and suppression of instant messaging malware in enterprise-like networks," in Proc. ACSAC, Miami Beach, FL, Dec. 2007, pp. 64-73.
15. A. J. Trivedi, P. Q. Judge, and S. Krasser, "Analyzing network and content characteristics of spim using honeypots," presented at the USENIX SRUTI, Santa Clara, CA, Jun. 2007.
16. P. J. Y. Jonathan, C. C. Fung, and K. W.Wong, "Devious chatbots-Interactive malware with a plot," Commun. Comput. Inf. Sci., vol. 44, pp. 110-118, 2009.
17. J. Goebel and T. Holz, "Rishi: Identify bot contaminated hosts by IRC nickname evaluation," presented at the USENIX HotBots, Cambridge, MA, Apr. 2007.
18. D. Dagon, G. Gu, C. P. Lee, and W. Lee, "A taxonomy of botnet structures," in Proc. ACSAC, Miami, FL, Dec. 2007, pp. 325-339.
19. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee, "Bothunter: Detecting malware infection through IDS-driven dialog correlation," in Proc. USENIX Security, Boston, MA, Aug. 2007, pp. 167-182.
20. G. Gu, J. Zhang, and W. Lee, "Botsniffer: Detecting botnet command and control channels in network traffic," presented at the NDSS, San Diego, CA, Feb. 2008.
21. J. Nazario, "Botnet tracking: Tools, techniques, and lessons learned," presented at the BlackHat, Washington, DC, Feb.-Mar. 2007.
22. B. B. Kang, E. Chan-Tin, C. P. Lee, J. Tyra, H. J. Kang, C. Nunnery, Z. Wadler, G. Sinclair, N. Hopper, D. Dagon, and Y. Kim, "Towards complete node enumeration in a peer-to-peer botnet," in Proc. ASIACCS, Sydney, Australia, 2009, pp. 23-34.
23. S. Nagaraja, P. Mittal, C.-Y. Hong, M. Caesar, and N. Borisov, "Botgrep: Findingp P2P bots with structured graph analysis," in Proc. USENIX Security Symp., Washington, DC, Aug. 2010, p. 2.
24. W. Yerazunis, "Sparse binary polynomial hashing and the CRM114 discriminator," presented at the MIT Spam Conf., Cambridge, MA, Jan. 2003.
25. J. Blosser and D. Josephsen, "Scalable centralized Bayesian spam mitigation with bogofilter," in Proc. USENIX LISA, Atlanta, GA, Nov. 2004, pp. 1-20.
26. J. A. Zdziarski, Ending Spam: Bayesian Content Filtering and the Art of Statistical Language Classification. San Francisco, CA: No Starch Press, 2005.
27. K. Li and Z. Zhong, "Fast statistical spam filter by approximate classifications," in Proc. ACM SIGMETRICS, St. Malo, France, Jun. 2006, pp. 347-358. (Pubitemid 44619104)
28. G. L. Wittel and S. F. Wu, "On attacking statistical spam filters," presented at the CEAS, Mountain View, CA, Jul. 2004.
29. D. Lowd and C. Meek, "Good word attacks on statistical spam filters," presented at the CEAS, Mountain View, CA, Jul. 2005.
30. C. Karlberger, G. Bayler, C. Kruegel, and E. Kirda, "Exploiting redundancy in natural language to penetrate Bayesian spam filters," presented at the USENIX WOOT, Boston, MA, Aug. 2007.
31. S. Bacon, "New entry process for chat rooms," Yahoo! Messenger Blog Aug. 29, 2007 [Online]. Available: http://www.ymessengerblog.com/blog/2007/ 08/29/new-entry-process-for-chat-rooms/
32. S. Bacon, "Chat rooms follow-up," Yahoo! Messenger Blog Aug. 21, 2007 [Online]. Available: http://www.ymessengerblog.com/blog/2007/08/21/ chat-rooms-follow-up/
33. S. Bacon, "Chat rooms update," Yahoo! Messenger Blog Aug. 24, 2007 [Online]. Available: http://www.ymessengerblog.com/blog/2007/08/24/chat- rooms-update-2/
34. A. M. Turing, "Computing machinery and intelligence," Mind, vol. 59, pp. 433-460, 1950.
35. L. Floridi, M. Taddeo, and M. Turilli, "Turing's imitation game: Still an impossible challenge for all machines and some judges-An evaluation of the 2008 Loebner contest," Minds Mach., vol. 19, no. 1, pp. 145-150, 2009.
36. "Symantec security response, W32.Imaut.AS worm," Symantec, Mountain View, CA, Jan. 25, 2008 [Online]. Available: http://www. symantec.com/security-response/writeup.jsp?docid=2007-080114-2713-99
37. "Yahoo! responder bot," Uber-Geek.com, Jan. 18, 2008 [Online]. Available: http://www.uber-geek.com/bot.shtml
38. A. Porta, G. Baselli, D. Liberati, N. Montano, C. Cogliati, T. Gnecchi-Ruscone, A. Malliani, and S. Cerutti, "Measuring regularity by means of a corrected conditional entropy in sympathetic outflow," Biol. Cybernet., vol. 78, no. 1, pp. 71-78, Jan. 1998. (Pubitemid 128636376)
39. R. Rosipal, "Kernel-based regression and objective nonlinear measures to assess brain functioning," Ph.D. dissertation, Dept. Comput. Inf. Syst., Univ. Paisley, Paisley, U.K., 2001.
40. S. Gianvecchio and H. Wang, "Detecting covert timing channels: An entropy-based approach," in Proc. ACM CCS, Alexandria, VA, Oct. 2007, pp. 307-316.
41. F. Sebastiani, "Machine learning in automated text categorization," ACM Comput. Surveys, vol. 34, no. 1, pp. 1-47, 2002.
42. Y. Zhou, M. S. Mulekar, and P. Nerellapalli, "Adaptive spam filtering using dynamic feature space," in Proc. Int. Conf. Tools Artif. Intell., Hong Kong, China, Nov. 2005, pp. 302-309. (Pubitemid 46016435)
43. T. Lauinger, V. Pankakoski, and E. Kirda, "Honeybot, your man in the middle for automated social engineering," presented at the USENIX LEET, Apr. 2010.