Spamming botnets

TLDR

The study aims to characterize spamming botnets by analyzing spam payloads and server traffic. To achieve this, the authors developed AutoRE, a spam signature generation framework that detects botnet‑based spam emails and identifies botnet membership. AutoRE, which requires no pre‑classified data or white lists, produced high‑quality regex signatures with low false‑positive rates, identified 7,721 botnet‑based spam campaigns and 340,050 unique botnet host IPs from a three‑month Hotmail sample, and revealed insights into email obfuscation, botnet IP characteristics, sending patterns, and their link to network scanning traffic that can inform botnet detection schemes.

Abstract

In this paper, we focus on characterizing spamming botnets by leveraging both spam payload and spam server traffic properties. Towards this goal, we developed a spam signature generation framework called AutoRE to detect botnet-based spam emails and botnet membership. AutoRE does not require pre-classified training data or white lists. Moreover, it outputs high quality regular expression signatures that can detect botnet spam with a low false positive rate. Using a three-month sample of emails from Hotmail, AutoRE successfully identified 7,721 botnet-based spam campaigns together with 340,050 unique botnet host IP addresses. Our in-depth analysis of the identified botnets revealed several interesting findings regarding the degree of email obfuscation, properties of botnet IP addresses, sending patterns, and their correlation with network scanning traffic. We believe these observations are useful information in the design of botnet detection schemes.