Who is sending a spam email: Clustering and characterizing spamming hosts

Jiyoung Woo, Hyun Jae Kang, Ah Reum Kang, Hyukmin Kwon, Huy Kang Kim

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

In this work, we propose a spam analyzing system that clusters the spamming hosts, characterizes and visualizes the spammers’ behaviors, and detects malicious clusters. The proposed system integrates behavior profiling in IP address level, IP address based clustering, characterizing spammer clusters, examining the maliciousness of embedded URLs, and deriving visual signatures for future detection of malicious spammers. We classify spamming hosts into botnet, worm, or individual spammers and derive their characteristics. We then design a clustering scheme to automatically classify the host IP addresses and to identify malicious groups according to known characteristics of each type of host. For rapid decision making in identifying botnets, we derive visual signatures using a parallel coordinates. We validate the proposed system using these spam email data collected by the spam trap system operated by the Korea Internet and Security Agency.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
PublisherSpringer Verlag
Pages469-482
Number of pages14
Volume8565
ISBN (Print)9783319121598
DOIs
Publication statusPublished - 2014 Jan 1
Event10th IFIP WG 11.9 International Conference on Digital Forensics - Vienna, Austria
Duration: 2014 Jan 82014 Jan 10

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume8565
ISSN (Print)03029743
ISSN (Electronic)16113349

Other

Other10th IFIP WG 11.9 International Conference on Digital Forensics
CountryAustria
CityVienna
Period14/1/814/1/10

ASJC Scopus subject areas

  • Computer Science(all)
  • Theoretical Computer Science

Fingerprint Dive into the research topics of 'Who is sending a spam email: Clustering and characterizing spamming hosts'. Together they form a unique fingerprint.

  • Cite this

    Woo, J., Kang, H. J., Kang, A. R., Kwon, H., & Kim, H. K. (2014). Who is sending a spam email: Clustering and characterizing spamming hosts. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 8565, pp. 469-482). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 8565). Springer Verlag. https://doi.org/10.1007/978-3-319-12160-4_28