A Real-Time System For Abusive Network Traffic Detection

Abstract

Abusive network traffic—to include unsolicited e-mail, malware propagation, and denial-of-service attacks—remains a constant problem in the Internet. Despite extensive research in, and subsequent deployment of, abusive-traffic-detection infrastructure, none of the available techniques addresses the problem effectively or completely. The fundamental failing of existing methods is that spammers and attack perpetrators rapidly adapt to and circumvent new mitigation techniques. Within this framework, we develop a real-time, online system that integrates transport layer characteristics into the existing SpamAssasin tool for detecting unsolicited commercial e-mail (spam)

Keywords

• Network traffic, spam, machine learning, system analysis, auto-learning

A Real-Time System For Abusive Network Traffic Detection

Abstract

Keywords

• -

References

1. [1] Messaging Anti-Abuse working Group (MAAWG), "Email metrics program: The network's operator perspective," Tech. Rep. 13, November. 2010. Available: http://www.maawg.org/sites/maawg/files/news/MAAWG_2010- Q1Q2_Metrics_Report_13.pdf.
2. [2] J. Postel. (1981, September). Internet protocol. Internet RFC 791 Available: http://www.faqs.org/rfcs/rfc791.html.
3. [3] R. Beverly and K. Sollins, "Exploiting transport-level characteristics of spam," in CEAS 2008 - Fifth Conference on Email and Anti-Spam.
4. [4] X. Zhao, D. Pei, L. Wang, D. Massey and A. Mankin, "An analysis of BGP multiple origin AS (MOAS) conflicts." in Proceedings of the First ACM SIGCOMM Workshop on Internet Measurement (IMW), 2001.
5. [5] T. Ouyang, S. Ray, M. Allman and M. Rabinovich, "A Large-Scale Empirical Analysis of Email Spam Detection through Transport-level Characteristics," Technical Report 10-001, International Computer Science Institute., January 2010.
6. [6] Postel. (1981, September). Transmission control protocol. Internet RFC 793 Available: http://www.ietf.org/rfc/rfc793.txt.
7. [7] A. Ramachandran and N. Feamster, "Understanding the network-level behavior of spammers." in Proceedings of ACM SIGCOMM.
8. [8] D. Schatzmann, M. Burkhart and T. Spyropoulos, "Inferring spammers in the network core," in Passive and Active Conference, Seoul,South Corea, 2009, pp. 229–238.

9. [9] S. Hao, N. A. Syed, N. Feamster, A. G. Gray and S. Krasser, "Detecting spammers with SNARE: Spatio-temporal network-level automatic reputation engine." in In Proceedings of the 18th Conference on USENIX Security Symposium.
10. [10] J. Karlin, S. Forest and J. Rexford, "Autonomous security for autonomous systems." Computer Networks, vol. 52, pp. 2908–2923, 2008.
11. [11] J. Klensin. (2001, April). Simple mail transfer protocol. Internet RFC 2821 (Standards Track) Available: http://www.ietf.org/rfc/rfc2821.txt.
12. [12] J. Mason. Filtering spam with SpamAssassin. Presented at HEANet Annual Conference. Available: http://wiki.apache.org/spamassassin/PresentationsAndPapers.
13. [13] V. Jacobson, C. Leres and S. McCanne, "Packet Capture Library (pcap)," vol. 1.0.0, October 27, 2010.
14. [14] D. Crocker, "Mail transfer agent," in Internet RFC 5598-Internet Email Architecture pp. 31.
15. [15] W. Larry. Perl. Available: http://perldoc.perl.org/.
16. [16] D. Winer. (1998, April). XML-RPC specification. Available: http://www.xmlrpc.com/spec.
17. [17] G. Van Rossum. Python. Available: http://www.python.org/
18. [18] Laboratory of Artificial Intelligence, Faculty of Computer and Information Science, University of Ljubljana, Slovenia, "Orange: A Component Based Machine Learning Library for Python," vol. 2.0, 2010.
19. [19] R. O. Duda and P. E. Hart, "Bayes decision theory," in Pattern Classification and Scene AnalysisAnonymous John Wiley & Sons, 1973, pp. 10.
20. [20] T. M. Mitchell, Machine Learning. McGraw-Hill, 1997.
21. [21] J. R. Quinlan, "C4.5: Programs for Machine Learning," 1993.
22. [22] V. N. Vapnik, "Estimation of Dependencies Based on Empirical Data," 1992.
23. [23] M. Carbone and L. Rizzo, "Dummynet Revisited," ACM SIGCOMM Computer Communication Review, vol. 40, pp. 12–20, April 2010.
24. [24] G. Cormack and T. Lynam. 2005 TREC public spam Corpus.
25. [25] L. Rizzo, "Dummynet: A Simple Approach to the Evaluation of Network Protocols," ACM Computer Communication Review, vol. 27, pp. 31–41, 1997.