Patent ID: 8904530

Claim:
A system for detecting a remotely controlled e-mail spam host comprising: an e-mail spammer detection unit to analyze incoming network data received from an e-mail client to determine if the e-mail client is an e-mail spammer; a host traffic profiler unit comprising: an extractor to, in response to determining that the e-mail client is an e-mail spammer, extract traffic flow data from incoming internet traffic associated with the e-mail spammer, and to extract an entropy-based significant traffic component from the traffic flow data, the entropy-based significant traffic component comprising significant protocol port values determined by: clustering ports having a flow share greater than or equal to a threshold value, and determining the significant protocol port values as non-clustered ports having a probability exceeding the threshold value; a profile construction unit to construct a traffic profile associated with the e-mail spammer based on the traffic flow data and the entropy-based significant traffic component, wherein the traffic profile comprises data indicative of types of interactions and ports; and a processor to determine if the e-mail spammer is a compromised e-mail spammer based on the traffic profile; and a botnet controller detector: for identifying a botnet controller controlling the compromised e-mail spammer; for analyzing the traffic flow data to identify a botnet controller connection associated with the botnet controller; and for assigning a confidence score to the botnet controller based on analyzing the traffic flow data, wherein the confidence score is based on a number of suspected bot clients connected, bytes per packet, inter-arrival times between flows, a number of triggers, and types of triggers.