Peeking into Spammer Behavior from a Unique Vantage Point

Understanding the spammer behavior is a critical step in the long-lasting battle against email spams. Previous studies have focused on setting up honeypots or email sinkholes containing destination mailboxes for spam collection. A spam trace collected this way offers the limited viewpoint from a single organizational domain and hence is short of reflecting the global behavior of spammers. In this paper, we present a spam analysis study using sinkholes based on open relays. A relay sinkhole offers a unique vantage point in spam collection: it has the broader view of spam originated from multiple spam origins destined to mailboxes belonging to multiple organizational domains. The trace collected using this methodology opens the door to study spammer behaviors that were difficult to do using spam collected from a single organization. Seeing the aggregate behavior of spammers allows us to systematically separate High-Volume Spammers (HVS, e.g. direct spammers) from Low-Volume Spammers (LV...

• Type: Conference
• Year: 2008
• Where: NSDI
• Authors: Abhinav Pathak, Y. Charlie Hu, Zhuoqing Morley Mao
• Keywords: Computer Networks, NSDI 2008, Spam Campaign, Spam Collection, Spammer Behaviors