Characterizing Botnetfrom Email Spam Records.ppt

Characterizing Botnetfrom Email Spam Records Presenter: Yi-Ren Yeh (葉倚任) Authors: L. Zhuang, J. Dunagan, D. R. Simon, H. J. Wang, I. Osipkov, G. Hulten, and J. Tygar. USENIX LEET 2008 Outline Introduction Overview Methodology Metrics and Findings Conclusion Introduction Spam is a driving force in the economics of botnets This work map botnet membership and other characteristics of botnets using spam traces By grouping similar email messages and related spam campaigns, the authors identify a set of botnets A large trace of spam email from Hotmail Web mail service is used Pros and Cons of using Spam The analysis can be done on an existing email trace from one of the small number of large Web mail providers Directly related to the economic motivation behind many botnets Potentially a less ad-hoc and easier task than analyzing IRC/DNS logs Unable to uncover botnets not involved in email spamming Contributions The first one to analyze entire botnets (in contrast to individual bot) behavior from spam email messages The first to study botnet traces based on economic motivation and monetizing activities New findings about botnets involved in email spamming Overview The major steps in the proposed method Cluster email messages into spam campaigns Spam email messages with identical or similar content are sent from the same controlling entity Use fingerprints to cluster email message Assess IP dynamics Extract the average time until an IP address gets reassigned The IP reassignment range (both are under each C-subset) Merge spam campaigns into botnets Via the overlapping of the sending hosts Methodology Datasets and initial processing Identifying spam campaigns Skipping spam from non-bots Assessing IP dynamics Identifying botnets Estimating botnet Size Datasets and Initial Processing Collected from the Hotmail Web mail service (Junk Mail) Randomly sample 5 million spam messages collected over a 9-day period from May 21, 2007 to May 29, 2007 Extract a reliable sender IP addr