COMSNETS 2010	 
January 9, 2010
Holly Esquivel (UW-Madison, USA)
Tatsuya Mori (NTT, Japan; presenter)
Aditya Akella (UW-Madison, USA)

Torrent of spam today	 More than 95% of email today is spam
 Major ESPs receive more than 100 million spammessages per day Evolution of spamming Present since the beginning (1978), it neverstops growing
 Spamming still has strong incentive as abusiness Spammers own global-scale distributed
spamming infrastructures (botnets)	 

How Is Receiving Huge Amount ofSpam Harmful?	
 Spamming is not just a nuisance. It could severely

damage our information infrastructure. 	 

Mail delivery delay (hours) at an enterprise mail system.	 

IP Reputation Services	 One technique to mitigate such spam traffic This service provides a score (reputation) for an IPaddress The most light-weight solution that precedes otheranti-spam solutions.
 Based on reports from TTP and measurement(e.g., spam traps)
 Major spam appliance companies operate theirown IP reputation services
 Ironport, Symantec, etc.
 are black boxes to users	 

Questions:	 What fraction of email can be correctlyclassified with IP reputation services?
 Especially white lists since they previously haveoften been overlooked How we can create localized IP reputation

services? Are they effective?

Our Contributions:	 Classify email senders into three primarycategories and study the effectiveness of IP
reputation services for each category Present methodologies to build custom local IPreputation lists

 Study other sources of email senders (openproxy, hijacked prefix)

 Study the characteristics of spamming for eachcategory of senders

Three Categories of Email Senders	 Legitimate servers
 MTA for legitimate ISP, ESP, Companies,Universities, …

 End-hosts Compromised end-hosts (botnets)
 Spam gangs
 Bullet-proof hosting servers
 E.g., Russian Business Network

Performance Evaluation of IP
Reputation Lists	
SpamSenders(end-hosts+spam gangs)	 

Legitimatesenders	 

Existing global white lists

Custom local white lists	 

Review of DNS SPF	 SPF: Sender Policy Framework
 A simple authentication mechanism thatassociates domain and IP addresses
 E.g., ieee.org 	 v=spf1 ip4:72.236.151.122/32 …

 Some spammers also use SPF to pass the simple

authentication checks
 We can use this to cluster their domains and addresses	 Building Custom IP Reputation Lists-- Legitimate Servers --	 WL1: Legit-Popular (web) Compile a list of legitimate domains

manually and extract associated IPaddresses WL2: SPF-good (history-based) Collect domains with good scores andextract associated IP addresses Sufficient history required	 Building Custom IP Reputation Lists-- End-hosts --	 BL1: Hostname (Naming heuristics)
 Compile heuristics for hostnames, e.g.,

ppp222.foo.com, dyn34-13-7-12.bar.com
 Check the RDNS of all the IP addresses BL2: Srizbi (Malware heuristics)
 Check the TCP header of a sender○ If the pattern matches to special case, it islikely a bot. 	 

Building Custom IP Reputation Lists-- Spam Gangs --	 BL3: Bad Blocks (history-based) Extract blocks (clusters) of IP addresses withbad history
 Clustering with BGP prefix and someheuristics (/29-based aggregation) BL4: SPF-bad (history-based) Same as SPF-good except for bad domains

and their associated IP addresses	 Data Sets	 SMTP logs
 Timestamp, sender IP, sender domain, score
 Collected at University of Wisconsin-Madison Tcpdump Used for compiling custom blacklists (BL2)	 

Performance of IP Reputation (1)	• Custom reputation lists cover more ham and less spam
• In total, reputation lists cover roughly 90% of ham 	 Performance of IP Reputation (2)	• Custom lists complement the coverage by 22%•In total, the reputation lists cover more than 54% of spam 	 Performance of IP Reputation (3)	• Custom lists cover much more spam with low fraction offalse positives• In total, the reputation lists cover more than 38% of spam	 Effectiveness of history-based
reputation over time	
one month history	 

one week history	 

one day history	 

September 2007	 

October 2007	 Coverage of SPF-good over time	 Constant over time
One month	  Good ones are stable Cyclic patterns
 Human activity

 Longer learning covers

more senders
One week	 One day	  One week is comparable

to one monthCoverage of SPF-Bad over time	 Degraded over time
 Bad ones are not stable Weaker cyclic patterns
One month	  Machine activity

 Longer learning covers

more senders
One day	 

One week	  One week is comparable

to one month

Contribution of each category	Summary and Future Work	 Empirically showed up to 90% of spam andham can be classified with IP reputation
services if compiled correctly.
 Local reputation lists can complement global
IP reputation services.
 Good IPs are stable over time. Reputation lists
for spam gangs need frequent updates.
 Aggregating IP reputation lists using machinelearning techniques a viable direction forimproving lists further

Existing anti-spam solutions	recipient	 

sender	 Pre-acceptancefiltering	 -­‐	  IP	  reputa9on	  (DNSBL)	  -­‐	  Greylis9ng	  -­‐	  Greet	  pause	  Light-weight
Limited information	 

Post-acceptancefiltering-­‐	  Text	  mining	  -­‐	  Binary	  pa0ern	  matching	  -­‐	  OCR	  Heavy-weight
Detailed information