Melting the snow: Using active DNS measurements to detect snowshoe spam domains

Abstract

Snowshoe spam is a type of spam that is notoriously hard to detect. Anti-abuse vendors estimate that 15% of spam can be classified as snowshoe spam. Differently from regular spam, snowshoe spammers distribute sending of spam over many hosts, in order to evade detection by spam reputation systems (blacklists). To be successful spammers need to appear as legitimate as possible, for example, by adopting email best practices, such as the Sender Policy Framework (SPF). This requires spammers to register and configure legitimate DNS domains. Many previous studies have relied on DNS data to detect spam. However, this often happens based on passive DNS data. This limits detection to domains that have actually been used and have been observed on passive DNS sensors. To overcome this limitation, we take a different approach. We make use of active DNS measurements, covering more than 60% of the global DNS namespace, in combination with machine learning to identify malicious domains crafted for snowshoe spam. Our results show that we are able to detect snowshoe spam domains with a precision of over 93%. More importantly, we are able to detect a significant fraction of the malicious domains up to 100 days earlier than existing blacklists, which suggests our method can give us a time advantage in the fight against spam. In addition to testing the efficacy of our approach in comparison to existing blacklists, we validated our approach over a 3-month period in an actual mail filter system at a major Dutch network operator. Not only did this demonstrate that our approach works in practice, the operator has actually decided to deploy our method in production, based on the results obtained.

Looking Beyond the Horizon

“…For the explanation on how we have built and trained the classifier, we refer the reader to our original work [22].…”

“…The benefits of an interconnected society are immediately clear to everybody; however, it has recently become more and more evident, even to laypeople, that the Internet exposes us to cyberthreats attacking information, services, and even the Internet infrastructure itself (e.g., attacks against the Domain Name System). Chief examples are (Distributed) Denial of Service (DDoS) attacks, an old threat that has recently taken new shapes and 4:2 • O. van der Toorn and A. Sperotto proportions (e.g., the 2016 attacks against the hosting company OVH (1 Tbps) [20] and the attack against the service and DNS provider Dyn [11]) but also ever more advanced phishing attacks (e.g., CEO fraud [16]), advanced spam campaigns (e.g., snowshoe spam [22]), and other forms of insidious activities.…”

“…This section is a summary of a previously published work of the authors[22].Digital Threats: Research and Practice, Vol. 1, No.…”

Domain Name System Security and Privacy: A Contemporary Survey

“…Chung et al [86] have collected all DNSSEC-enabled domain names, under the .com, .org, and .net TLDs through Open-INTEL active DNS measurement system [85], to study the adoption and management of DNSSEC in both authoritative name servers and DNS resolvers. Moreover, Toorn et al [148] have studied the detection of Snowshoe spams through active DNS measurement and using machine learning techniques. Discussion.…”

Proactive threat detection : a DNS based approach

“…CEO fraud [6]), advanced spam campaigns (e.g. snowshoe spam [7]) and other forms of insidious activity.…”