 |
Google Tech TalksJune, 13 2008ABSTRACTThe Internet is overrun with spam: Recent estimates suggest that spamconstitutes about 95% of all email traffic. Beyond simply being anuisance, spam exhausts network resources and can also serve as avector for other types of attacks, including phishing attacks andonline scams. Conventional approaches to stopping these types ofattacks typically rely on a combination of the reputation of asender's IP address and the contents of the message. Unfortunately,these features are brittle. Spammers can easily change the IPaddresses from which they send spam and the content that they use asthe "cover medium" for the email message itself. In this talk, I willdescribe a new, complementary approach to stopping unwanted emailtraffic on the Internet: Rather than classifying spam based on eitherthe content of the message or the identity of the sender, we classifyemail messages based on how the spam is being sent and the propertiesof the spamming infrastructure. I will first summarize the highlightsof a 13-month study of the network-level behavior of spammers usingdata from a large spam trap. I will then describe a new approach tospammer classification called "behavioral blacklisting" and present adetailed study of network-level features that can be used to identifyspammers. Often these features can classify a spammer on the firstpacket received from that sender, without even receiving the message.I will conclude by describing our plans to incorporate thesealgorithms into a next-generation sender reputation system, as well asour ongoing study of the online scam hosting infrastructure, whoseproperties may also ultimately prove useful for identifying unwantedtraffic.This talk includes joint work with Anirudh Ramachandran, Nadeem Syed,Maria Konte, Santosh Vempala, Jaeyeon Jung, and Alex Gray.Speaker: Nick FeamsterNick Feamster is an assistant professor in the College of Computing at Georgia Tech. He received his Ph.D. in Computer science from MIT in 2005, and his S.B. and M.Eng. degrees in Electrical Engineering and Computer Science from MIT in 2000 and 2001, respectively. His research focuses on many aspects of computer networking and networked systems, including the design, measurement, and analysis of network routing protocols, network operations and security, and anonymous communication systems. His honors include a Sloan Research Fellowship, the NSF CAREER award, the IBM Faculty Fellowship, and award papers at SIGCOMM 2006 (network-level behavior of spammers), the NSDI 2005 conference (fault detection in router configuration), Usenix Security 2002 (circumventing web censorship using Infranet), and Usenix Security 2001 (web cookie analysis). [More] [Less] |
|
