Who is sending a spam email: Clustering and characterizing spamming hosts

Jiyoung Woo, Hyun Jae Kang, Ah Reum Kang, Hyukmin Kwon, Huy Kang Kim

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    In this work, we propose a spam analyzing system that clusters the spamming hosts, characterizes and visualizes the spammers’ behaviors, and detects malicious clusters. The proposed system integrates behavior profiling in IP address level, IP address based clustering, characterizing spammer clusters, examining the maliciousness of embedded URLs, and deriving visual signatures for future detection of malicious spammers. We classify spamming hosts into botnet, worm, or individual spammers and derive their characteristics. We then design a clustering scheme to automatically classify the host IP addresses and to identify malicious groups according to known characteristics of each type of host. For rapid decision making in identifying botnets, we derive visual signatures using a parallel coordinates. We validate the proposed system using these spam email data collected by the spam trap system operated by the Korea Internet and Security Agency.

    Original languageEnglish
    Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
    PublisherSpringer Verlag
    Pages469-482
    Number of pages14
    Volume8565
    ISBN (Print)9783319121598
    DOIs
    Publication statusPublished - 2014 Jan 1
    Event10th IFIP WG 11.9 International Conference on Digital Forensics - Vienna, Austria
    Duration: 2014 Jan 82014 Jan 10

    Publication series

    NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
    Volume8565
    ISSN (Print)03029743
    ISSN (Electronic)16113349

    Other

    Other10th IFIP WG 11.9 International Conference on Digital Forensics
    Country/TerritoryAustria
    CityVienna
    Period14/1/814/1/10

    ASJC Scopus subject areas

    • Computer Science(all)
    • Theoretical Computer Science

    Fingerprint

    Dive into the research topics of 'Who is sending a spam email: Clustering and characterizing spamming hosts'. Together they form a unique fingerprint.

    Cite this