BOTMAGNIFIER: Locating spambots on the internet

Proceedings of the 20th USENIX Security Symposium

Volumn , Issue , 2011, Pages 427-442

  Stringhini, Gianluca ^a   Holz, Thorsten ^b   Stone Gross, Brett ^a   Kruegel, Christopher ^a   Vigna, Giovanni ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b RUHR UNIVERSITY BOCHUM   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

MALWARE; SPAMMING;

CYBERCRIMINALS; DATA STREAM; E-MAIL TRAFFIC; INTERNET USERS; LARGE GROUPS; NOVEL TECHNIQUES; STATE OF THE ART; UNSOLICITED BULK E-MAIL;

BOTNET;

EID: 84876254320     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (43)

1. M. Abu Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A Multifaceted Approach to Understanding the Botnet Phenomenon. In ACM SIGCOMM Conference on Internet Measurement, 2006.
2. D. S. Anderson, C. Fleizach, S. Savage, and G. M. Voelker. Spamscatter: Characterizing Internet Scam Hosting Infrastructure. In USENIX Security Symposium, 2007.
3. Apache Foundation. Spamassassin. http:// spamassassin.apache.org.
4. J. Caballero, P. Poosankam, C. Kreibich, and D. Song. Dispatcher: Enabling Active Botnet Infiltration Using Automatic Protocol Reverseengineering. In ACM Conference on Computer and Communications Security (CCS), 2009.
5. K. Chiang and L. Lloyd. A Case Study of the Rustock Rootkit and Spam Bot. In USENIX Workshop on Hot Topics in Understanding Botnet, 2007.
6. C. Cho, J. Caballero, C. Grier, V. Paxson, and D. Song. Insights from the Inside: A View of Botnet Management from Infiltration. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2010.
7. Cisco Inc. Cisco IOS NetFlow. https: //www.cisco.com/en/US/products/ ps6601/products_ios_protocol_ group_home.html.
8. F. C. Freiling, T. Holz, and G. Wicherski. Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks. In European Symposium on Research in Computer Security (ESORICS), 2005.
9. G. Gu, R. Perdisci, J. Zhang, and W. Lee. Bot-Miner: Clustering Analysis of Network Traffic for Protocol- and Structure-independent Botnet Detection. In USENIX Security Symposium, 2008.
10. S. Hao, N. A. Syed, N. Feamster, A. G. Gray, and S. Krasser. Detecting Spammers with SNARE: Spatio-temporal Network-level Automatic Reputation Engine. In USENIX Security Symposium, 2009.
11. J. P. John, A. Moshchuk, S. D. Gribble, and A. Krishnamurthy. Studying Spamming Botnets Using Botlab. In USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2009.
12. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. In ACM Conference on Computer and Communications Security (CCS), 2008.
13. M. Khmartseva. Email Statistics Report. http://www.radicati.com/wp/wpcontent/ uploads/2009/05/emailstats-report-exec-summary.pdf, 2009.
14. B. Krebs. Taking Stock of Rustock. http://krebsonsecurity.com/2011/ 01/taking-stock-of-rustock/, 2011.
15. C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G. M. Voelker, V. Paxson, and S. Savage. On the Spam Campaign Trail. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2008.
16. C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G. M. Voelker, V. Paxson, and S. Savage. Spamcraft: An Inside Look at Spam Campaign Orchestration. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2009.
17. A. Lelli. Return from the Dead: Waledac/Storm Botnet Back on the Rise. http://www.symantec.com/connect/ blogs/return-dead-waledacstormbotnet-back-rise, 2011.
18. M86. Rustock, the king of spam. http://www.m86security.com/labs/ traceitem.asp?article=1362, July 2010.
19. MaxMind. GeoIP. http://www.maxmind. com/app/ip-location.
20. MessageLabs. MessageLabs Intelligence: 2010 Annual Security Report. http: //www.messagelabs.com/mlireport/ MessageLabsIntelligence_2010_ Annual_Report_FINAL.pdf, 2010.
21. C. Nunnery, G. Sinclair, and B. B. Kang. Tumbling Down the Rabbit Hole: Exploring the Idiosyncrasies of Botmaster Systems in a Multi-Tier Botnet Infrastructure. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2010.
22. A. Pitsillidis, K. Levchenko, C. Kreibich, C. Kanich, G. M. Voelker, V. Paxson, N. Weaver, and S. Savage. Botnet Judo: Fighting Spam with Itself. In Symposium on Network and Distributed System Security (NDSS), 2010.
23. Project Honeypot. http://www. projecthoneypot.org/.
24. N. Provos, P. Mavrommatis, M. A. Rajab, and F. Monrose. All your iFRAMEs point to Us. In USENIX Security Symposium, 2008.
25. Z. Qian, Z. Mao, Y. Xie, and F. Yu. On Networklevel Clusters for Spam Detection. In Symposium on Network and Distributed System Security (NDSS), 2010.
26. A. Ramachandran and N. Feamster. Understanding the Network-level Behavior of Spammers. SIGCOMM Comput. Commun. Rev., 36, August 2006.
27. A. Ramachandran, N. Feamster, and D. Dagon. Revealing Botnet Membership using DNSBL Counter-intelligence. In USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), 2006.
28. A. Ramachandran, N. Feamster, and S. Vempala. Filtering Spam with Behavioral Blacklisting. In ACM Conference on Computer and Communications Security (CCS), 2007.
29. M. B. S. Sinha and F. Jahanian. Improving Spam Blacklisting Through Dynamic Thresholding and Speculative Aggregation. In Symposium on Network and Distributed System Security (NDSS), 2010.
30. SC Magazine. Accused MegaD operator arrested. http://www.scmagazineus.com/ accused-mega-d-botnet-operatorarrested, 2011.
31. Shadowserver. New fast flux botnet for the holidays. http://www.shadowserver.org/ wiki/pmwiki.php/Calendar/20101230, 2011.
32. B. Stock, J. Gobel, M. Engelberth, F. Freiling, and T. Holz. Walowdac Analysis of a Peer-to-Peer Botnet. In European Conference on Computer Network Defense (EC2ND), 2009.
33. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna. Your Botnet is My Botnet: Analysis of a Botnet Takeover. In ACM Conference on Computer and Communications Security (CCS), 2009.
34. B. Stone-Gross, M. Cova, C. Kruegel, and G. Vigna. Peering Through the iFrame. In IEEE Conference on Computer Communications (INFOCOM), 2011.
35. B. Stone-Gross, T. Holz, G. Stringhini, and G. Vigna. The Underground Economy of Spam: A Botmaster's Perspective of Coordinating Large-Scale Spam Campaigns. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2011.
36. Symantec Corp. State of spam & phishing report. http://www.symantec.com/business/ theme.jsp?themeid=state_of_spam, 2010.
37. Symantec. Corp. Rustock hiatus ends with huge surge of pharma spam. http: //www.symantec.com/connect/blogs/ rustock-hiatus-ends-huge-surgepharma-spam, January 2011.
38. S. Venkataraman, S. Sen, O. Spatscheck, P. Haffner, and D. Song. Exploiting Network Structure for Proactive Spam Mitigation. In USENIX Security Symposium, 2007.
39. P. Wurzinger, L. Bilge, T. Holz, J. Goebel, C. Kruegel, and E. Kirda. Automatically Generating Models for Botnet Detection. In European Symposium on Research in Computer Security (ESORICS), 2009.
40. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov. Spamming Botnets: Signatures and Characteristics. SIGCOMM Comput. Commun. Rev., 38, August 2008.
41. T.-F. Yen and M. K. Reiter. Traffic Aggregation for Malware Detection. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), 2008.
42. Y. Zhao, Y. Xie, F. Yu, Q. Ke, Y. Yu, Y. Chen, and E. Gillum. BotGraph: Large Scale Spamming Botnet Detection. In USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2009.
43. L. Zhuang, J. Dunagan, D. R. Simon, H. J. Wang, and J. D. Tygar. Characterizing Botnets From Email Spam Records. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2008.