Understanding the network-level behavior of spammers

By Anirudh Ramachandran, N. Feamster. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2006

661 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/d0c09c4212b8b56710be11d5658dccee31a601cf

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

SybilLimit: A Near-Optimal Social Network Defense Against Sybil Attacks (2010, background): “P. B. Gibbons and M. Kaminsky are with Intel Labs Pittsburgh, Pittsburgh, PA 15213 USA (e-mail: phillip.b.gibbons@intel.com; michael.e.kaminsky@intel. com).”
Filtering spam with behavioral blacklisting (2007, background): “Spammers cannot evade SpamTracker merely by using fresh IP addresses because blacklisting decisions are based on sending patterns, which tend to remain more invariant.”
A Survey of BGP Security Issues and Solutions (2010, background): “In addition, B spammers [ (i.e., people sending spam e-mail) sometimes introduce false information into BGP to enable them to exchange e-mail with mail servers using unallocated IP addresses that are hard to trace [8].”
An Advanced Hybrid Peer-to-Peer Botnet (2007, background): “As pointed out by [25], 80% of current spam is listed in some DNS blacklists (DNSBLs), which are used “to track IP addresses that originate spam, so that future emails sent from these IP addresses can be rejected.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “…are effectively a collection of slave computing and data assets to be sold or traded for a variety of illicit activities, including information and computing resource theft, SPAM production , hosting phishing attacks, or for mounting distributed denial-of-service (DDoS) attacks [12] [34] [20].”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, result): “While some of the works proposed anomaly detection methods to detect specific kinds of malware such as worms [34] or spamming botnets [28], others tried to propose more general approaches to distinguish malicious traffic from benign traffic [8,13,30].”
Emerging phishing trends and effectiveness of the anti-phishing landing page (2014, background): “studied the network level behaviour of spammers, like IP address ranges that send out the most spam, common spamming modes, persistence of spamming hosts, and botnet spamming characteristics [35].”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “, worms [37] or spammers [32]), recent attempts at malware detection mainly focus on detection of botnets.”
Behind Phishing: An Examination of Phisher Modi Operandi (2008, methodology): “The network characteristics of spam has been examined by both Anderson et al. [2] and Ramachandran et al. [21].”
A Survey of Botnet and Botnet Detection (2009, background): “Bot infection methods are similar to other classes of malware that recruit vulnerable systems by exploiting software vulnerabilities, trojan insertion, as well as social engineering techniques leading to download malicious bot code [4,6,7].”
Accountable internet protocol (aip) (2008, background): “…Koponen4, Daekyeong Moon5, and Scott Shenker5 1 Carnegie Mellon University, 2 MIT, 3 Georgia Tech, 4 ICSI & HIIT, 5 University of California, Berkeley ABSTRACT This paper presentsAIP(Accountable InternetProtocol), a network architecture that provides accountability as a .rst-order property.”
SybilGuard: Defending Against Sybil Attacks via Social Networks (2006, background): “Spammers, for example, are known to harvest a wide variety of IP addresses to hide the source of their messages, by advertising BGP routes for unused blocks of IP addresses [19].”
PHAS: A Prefix Hijack Alert System (2006, background): “A recent study has also found that spammers hijack BGP preﬁxes to send spam mail [14].”
A study of prefix hijacking and interception in the internet (2007, neutral): “Finally, while we fail to detect ongoing pre.x interception, the detection exercise highlights some of the challenges posed by the pre.x interception problem.”