Fast Effective Botnet Spam Detection

Abstract

Spam mails distributed from botnets have been one of the critical problems for the Internet. Spamming is growing at a rapid rate since sending a flood of mails is easy and very cheap. Spam mails waste user time and consume resources e.g., space and network bandwidth, so fighting against spam is an interesting issue in computer security. We have spent for more than 3 years collecting and analyzing over 161,230 emails from several mailboxes. We found that some users received up to 235 emails per day, only 1 to 3 emails were legitimate and the rest appeared to be spam mails. This paper presents a fast effective spam filter by analyzing the mail header. It works well with both text-base spam and all kinds of image spam. Our experiments and results showed that spam was filtered out at least 96.23% with no false positive.

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…For spam-based botnets, Reference [190] proposes a method for the detection from spam mails received by those botnets. By looking at the mail header, the detection mechanism determines if the mail came from a botnet by looking at the sender's IP, the country of the domain name and the MX host of the sender.…”

A novel approach against E-mail attacks derived from user-awareness based techniques

“…It effectively works for both types of spam mails namely, 'Text based spam' as well as 'Image based spam'. It locates the sender's IP address, sender's email address; MX records and MX hosts, and analyses all the recorded information to provide effective results [7].…”

Efficient Spam Filtering System Based on Smart Cooperative Subjective and Objective Methods

“…About 8 years ago, spam was sent by spammer's own e-mail servers. Approximately 45% -60% of spam is now sent from compromised systems distributed over the Internet [5][6][7][8]. Spam relaying increases the distribution base and at the same time eludes and overwhelms spam detection systems [9].…”