Detection of Compromised Email Accounts Used by a Spam Botnet with Country Counting and Theoretical Geographical Travelling Speed Extracted from Metadata

Abstract

Seventy six percent of sent spam and phishing emails have their origins in botnets. They use compromised email accounts to send junk mail through other SMTP servers to their destinations. Commonly, research is focused on the rapid detection of compromised accounts to protect the integrity of other systems. One possible way to do this is to scan the email content or limit the amount of messages that can be sent from an IP address or an account during a specified time period. An anomaly is properly detected if the limit is reached or spam emails are identified. The objective of the presented research is to detect the anomaly with geo location and country counting without the knowledge of the email content. A second method, called Theoretical Geographical Travelling Speed, was developed to raise the detection rate without false negatives. The proposed method is seven times faster than the default rate limited to the detection of a compromised account.

A Comprehensive Study of Email Spam Botnet Detection

“…Carlo Schafer [158] has presented two methods for detecting compromised accounts called Country Counting and Theoretical Geographical Travelling Speed which do not need access to email content to detect an abused account since these compromised accounts are primarily used by botnets for sending new spam or phishing emails. The proposed method uses data that is extracted from the log files of the SMTP server and the detection is succeeded by observing the incoming metadata from the from the SMTP connections.…”