@inproceedings{facfbbde457c4aaca3370dd84bd52cc3,
title = "Who is sending a spam email: Clustering and characterizing spamming hosts",
abstract = "In this work, we propose a spam analyzing system that clusters the spamming hosts, characterizes and visualizes the spammers{\textquoteright} behaviors, and detects malicious clusters. The proposed system integrates behavior profiling in IP address level, IP address based clustering, characterizing spammer clusters, examining the maliciousness of embedded URLs, and deriving visual signatures for future detection of malicious spammers. We classify spamming hosts into botnet, worm, or individual spammers and derive their characteristics. We then design a clustering scheme to automatically classify the host IP addresses and to identify malicious groups according to known characteristics of each type of host. For rapid decision making in identifying botnets, we derive visual signatures using a parallel coordinates. We validate the proposed system using these spam email data collected by the spam trap system operated by the Korea Internet and Security Agency.",
keywords = "Botnet, Clustering, Spam email, Spamming host, Visualization",
author = "Jiyoung Woo and Kang, {Hyun Jae} and Kang, {Ah Reum} and Hyukmin Kwon and Kim, {Huy Kang}",
year = "2014",
month = jan,
day = "1",
doi = "10.1007/978-3-319-12160-4_28",
language = "English",
isbn = "9783319121598",
volume = "8565",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "469--482",
booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
note = "10th IFIP WG 11.9 International Conference on Digital Forensics ; Conference date: 08-01-2014 Through 10-01-2014",
}