Internet Bad Neighborhoods: the Spam Case

Giovane Moreira Moura, R. Sadre, Aiko Pras

Research output: Chapter in Book/Report/Conference proceedingConference contribution

  • 9 Citations

Abstract

A significant part of current attacks on the Internet comes from compromised hosts that, usually, take part in botnets. Even though bots themselves can be distributed all over the world, there is evidence that most of the malicious hosts are, in fact, concentrated in small fractions of the IP address space, on certain networks. Based on that, the Bad Neighborhood concept was introduced. The general idea of Bad Neighborhoods is to rate a subnetwork by the number of malicious hosts that have been observed in that subnetwork. Even though Bad Neighborhoods were successfully employed in mail filtering, the very concept was not investigated in further details. Therefore, in this work we provide a closer look on it, by proposing four definitions for spam-based Bad Neighborhoods that take into account the way spammers operate. We apply the definitions to real world data sets and show that they provide valuable insight into the behavior of spammers and the networks hosting them. Among our findings, we show that 10% of the Bad Neighborhoods are responsible for the majority of spam.
LanguageUndefined
Title of host publication7th International Conference on Network and Services Management (CNSM 2011)
EditorsOlivier Festor, Emil Lupu
Place of PublicationUSA
PublisherIEEE Communications Society
Pages1-8
Number of pages8
ISBN (Print)978-1-4577-1588-4
StatePublished - Oct 2011

Publication series

Name
PublisherIEEE Communications Society

Keywords

  • METIS-277737
  • EWI-20379
  • EC Grant Agreement nr.: FP7/257513
  • IR-77802

Cite this

Moreira Moura, G., Sadre, R., & Pras, A. (2011). Internet Bad Neighborhoods: the Spam Case. In O. Festor, & E. Lupu (Eds.), 7th International Conference on Network and Services Management (CNSM 2011) (pp. 1-8). USA: IEEE Communications Society.
Moreira Moura, Giovane ; Sadre, R. ; Pras, Aiko. / Internet Bad Neighborhoods: the Spam Case. 7th International Conference on Network and Services Management (CNSM 2011). editor / Olivier Festor ; Emil Lupu. USA : IEEE Communications Society, 2011. pp. 1-8
@inproceedings{1e34a3d69e1944c5931043349e4d8b0a,
title = "Internet Bad Neighborhoods: the Spam Case",
abstract = "A significant part of current attacks on the Internet comes from compromised hosts that, usually, take part in botnets. Even though bots themselves can be distributed all over the world, there is evidence that most of the malicious hosts are, in fact, concentrated in small fractions of the IP address space, on certain networks. Based on that, the Bad Neighborhood concept was introduced. The general idea of Bad Neighborhoods is to rate a subnetwork by the number of malicious hosts that have been observed in that subnetwork. Even though Bad Neighborhoods were successfully employed in mail filtering, the very concept was not investigated in further details. Therefore, in this work we provide a closer look on it, by proposing four definitions for spam-based Bad Neighborhoods that take into account the way spammers operate. We apply the definitions to real world data sets and show that they provide valuable insight into the behavior of spammers and the networks hosting them. Among our findings, we show that 10{\%} of the Bad Neighborhoods are responsible for the majority of spam.",
keywords = "METIS-277737, EWI-20379, EC Grant Agreement nr.: FP7/257513, IR-77802",
author = "{Moreira Moura}, Giovane and R. Sadre and Aiko Pras",
year = "2011",
month = "10",
language = "Undefined",
isbn = "978-1-4577-1588-4",
publisher = "IEEE Communications Society",
pages = "1--8",
editor = "Olivier Festor and Emil Lupu",
booktitle = "7th International Conference on Network and Services Management (CNSM 2011)",
address = "United States",

}

Moreira Moura, G, Sadre, R & Pras, A 2011, Internet Bad Neighborhoods: the Spam Case. in O Festor & E Lupu (eds), 7th International Conference on Network and Services Management (CNSM 2011). IEEE Communications Society, USA, pp. 1-8.

Internet Bad Neighborhoods: the Spam Case. / Moreira Moura, Giovane; Sadre, R.; Pras, Aiko.

7th International Conference on Network and Services Management (CNSM 2011). ed. / Olivier Festor; Emil Lupu. USA : IEEE Communications Society, 2011. p. 1-8.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - Internet Bad Neighborhoods: the Spam Case

AU - Moreira Moura,Giovane

AU - Sadre,R.

AU - Pras,Aiko

PY - 2011/10

Y1 - 2011/10

N2 - A significant part of current attacks on the Internet comes from compromised hosts that, usually, take part in botnets. Even though bots themselves can be distributed all over the world, there is evidence that most of the malicious hosts are, in fact, concentrated in small fractions of the IP address space, on certain networks. Based on that, the Bad Neighborhood concept was introduced. The general idea of Bad Neighborhoods is to rate a subnetwork by the number of malicious hosts that have been observed in that subnetwork. Even though Bad Neighborhoods were successfully employed in mail filtering, the very concept was not investigated in further details. Therefore, in this work we provide a closer look on it, by proposing four definitions for spam-based Bad Neighborhoods that take into account the way spammers operate. We apply the definitions to real world data sets and show that they provide valuable insight into the behavior of spammers and the networks hosting them. Among our findings, we show that 10% of the Bad Neighborhoods are responsible for the majority of spam.

AB - A significant part of current attacks on the Internet comes from compromised hosts that, usually, take part in botnets. Even though bots themselves can be distributed all over the world, there is evidence that most of the malicious hosts are, in fact, concentrated in small fractions of the IP address space, on certain networks. Based on that, the Bad Neighborhood concept was introduced. The general idea of Bad Neighborhoods is to rate a subnetwork by the number of malicious hosts that have been observed in that subnetwork. Even though Bad Neighborhoods were successfully employed in mail filtering, the very concept was not investigated in further details. Therefore, in this work we provide a closer look on it, by proposing four definitions for spam-based Bad Neighborhoods that take into account the way spammers operate. We apply the definitions to real world data sets and show that they provide valuable insight into the behavior of spammers and the networks hosting them. Among our findings, we show that 10% of the Bad Neighborhoods are responsible for the majority of spam.

KW - METIS-277737

KW - EWI-20379

KW - EC Grant Agreement nr.: FP7/257513

KW - IR-77802

M3 - Conference contribution

SN - 978-1-4577-1588-4

SP - 1

EP - 8

BT - 7th International Conference on Network and Services Management (CNSM 2011)

PB - IEEE Communications Society

CY - USA

ER -

Moreira Moura G, Sadre R, Pras A. Internet Bad Neighborhoods: the Spam Case. In Festor O, Lupu E, editors, 7th International Conference on Network and Services Management (CNSM 2011). USA: IEEE Communications Society. 2011. p. 1-8.