Transcript 下載/瀏覽
Fast Effective Botnet Spam Detection 2009 Fourth International Conference on Computer Sciences and Convergence Information Technology Kobkiat Saraubon Benchaphon Limthanmaphon 報告者：陳柏仲 Abstract This paper presents a fast effective spam filter by Analyzing the mail header. It works well with both text-base spam and all kinds of image spam. Our experiments and results showed that spam was filtered out at least 96.23% with no false positive. Botnet 攻擊者植入具遠端控制功能的惡意軟體到他人電腦，受感 染的電腦會被攻擊者所操控(殭屍電腦)，被當成攻擊其他 電腦的一個跳板。 “Botnet”泛指一群由殭屍電腦所形成的網絡，攻擊者能 遙控整個網絡的電腦同時發動攻擊，殭屍網路愈大，代表 其攻擊效果越顯著，常見的攻擊有Ddos、Spam。 為了逃避偵測並隱藏的真實身分，有些垃圾郵件業者會在 受感染的電腦內植入Spam Relay轉信引擎，以受害電腦作 為跳板，四處寄送廣告信。 Spam 發送垃圾信件的目的 ◆ 廣告 ◆ 散佈惡意程式 ◆ DDoS ◆ 網路釣魚 The types of spam 1/3 Text-Based Spam 純文字的 描述 The types of spam Image-Based Spam 2/3 The types of spam 3/3 Image-Based Spam 的變形 對抗垃圾郵件,最有效的方法是從「造假行為」著手,而不 是『過濾內容』!! IMPLEMENTATION E-Mail Header MX host Location of IP E-Mail Header 1/2 E-Mail header可以得知的一些資訊： 1.發信者主機IP 2.發信者郵件伺服器的IP 3.收信者郵件伺服器的IP 4.寄送途中所有幫忙轉送信件的節點的IP 5.收件者信箱 6.發信者信箱 E-Mail Header 2/2 Our system uses and analyzes only the header part of email. We use only two: (1)Sender IP The beginning of each header specifies the IP address of the sender server . (2)Sender email address e.g. From: "Charl Watch" <[email protected]> IMPLEMENTATION E-Mail Header MX host Location of IP MX Records and MX hosts MX是 Mail eXchanger 的縮寫。 MX Record是放在DNS中的一個設定，主 要是讓 mail server在發信的時候，可 以馬上找到收信端的mail server位置。 hinet.net [email protected] 寄信給 [email protected] DNS MX Record @hinet.net ↔ S (MX host) 3 回傳到S主機的IP 送方mail server 2 收方mail server = MX host 收方 1 5-1 送方 [email protected] 4 S MX host mail server 收方 5-2 S [email protected] IMPLEMENTATION E-Mail Header MX host Location of IP Location of IP ARIN RIPE We employ this distributed database to locate the country of the sender server and the MX hosts from the given IPs. 1/3 Location of IP 2/3 Location of IP 3/3 Architecture Example 1—spam 巴西 美國 Sender IP： 189.47.130.39 Sender Email Address： [email protected] MX host： hrndva-smtpin02.mailrr.com MX host IP： 71.74.56.244 Example 2—legitimate email Sender IP：209.85.221.120 美國 Sender Email Address： [email protected] MX hosts： alt3.gmail-smtp-in.l.google.com 216.239.59.27 - US 美國 CONCLUSION Our study found that over 80% of the spam mails were sent by botnets or zombie computers. Our results indicated that spam was filtered out at least 96.23% with no false positive The system has proved a fast effective botnet spam detection since the process does not touch any email bodies nor perform image processing operation.