基於校園網路內惡意寄送垃圾郵件的行為偵測

Detection of Anomalous Spamming Activities in a Campus Network

林炳海(Lin, Pinghai)

指導教授 ： 林柏青

國立中正大學/工學院/資訊工程學系/碩士(2012年)

摘要

針對長久以來垃圾郵件的問題，本研究有別於過去在接收端進行偵測過濾的方式，提出一個站在發送端的角度來偵測垃圾郵件發送者，並有效減少垃圾郵件量及解決垃圾郵件帶來的資源浪費等問題。我們透過著名的Bro入侵偵測系統來分析中正大學校園網路內主機對外的SMTP流量，分別擷取出個別主機寄出之每封信件的收件者地址，並記錄於Bloom filter之中，統計出從每部主機所寄出信件之收件者地址的數量與重複情形。我們於施行後之六個月內，透過本文提出的方法找出校園網路內多達六十五部向外寄送垃圾郵件的主機，且偵測之precision與recall分別達到0.91與0.97。我們也觀察到一百五十多萬封對外發送的垃圾郵件紀錄以及校園內高達三分之一的郵件伺服器有帳號盜用的問題。

關鍵字

殭屍網路 ； 垃圾郵件 ； 郵件過濾

並列摘要

It is common to see the delivery of unsolicited emails in the Internet, namely spam. Most spam-filtering solutions are deployed on the receiver side. Although the solutions are good at filtering spam for end users, spam messages still keep wasting Internet bandwidth and the storage space of mail servers. This work is intended to detect spam hosts in a university campus to nip the spam sources in the bud. We use the Bro network intrusion detection system (NIDS) to collect the SMTP sessions, and track the volume and uniqueness of the target email addresses of outgoing sessions from each individual internal host as the features for detecting spamming hosts. The large number of email addresses can be efficiently stored in the Bloom filters. Over a period of six months from November 2011 to April 2012, we found totally 65 spammers in the campus and also observed 1.5 million outgoing spam messages. We also found 33% of internal mail servers that have an account cracking problem. The precision of the detection is 0.91, and the recall is 0.97.

並列關鍵字

Botnet ； Spam ； Bloom filter ； Spam filtering

參考文獻

[8] L. Zhang, J. Zhu and T. Yao, “An evaluation of statistical spam filtering techniques,” ACM Trans. Asian Language Information Processing(TALIP), 3(4), pp. 243-269, Dec. 2004.

[9] M. Hirschbichler, C. Egger, O. Pasteka and A. Berger, “Using E-Mail SPAMDNSBlacklists for Qualifying the SPAM-over-Internet-Telephony

Probability of a SIP Call,” In Proceedings of Third International Conference on Digital Society (ICDS), Feb. 2009.

[10] J. Jung and E. Sit, “An empirical study of spam trac and the use of DNS black lists,” In Proceedings of the 4th ACM SIGCOMM conference

on Internet Measurement, Oct. 2004.