• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

Detection of Zombie PCs Based on Email Spam Analysis

Vol. 6, No. 5, May 24, 2012
10.3837/tiis.2012.05.011, Download Paper (Free):

Abstract

While botnets are used for various malicious activities, it is well known that they are widely used for email spam. Though the spam filtering systems currently in use block IPs that send email spam, simply blocking the IPs of zombie PCs participating in a botnet is not enough to prevent the spamming activities of the botnet because these IPs can easily be changed or manipulated. This IP blocking is also insufficient to prevent crimes other than spamming, as the botnet can be simultaneously used for multiple purposes. For this reason, we propose a system that detects botnets and zombie PCs based on email spam analysis. This study introduces the concept of “group pollution level” _ the degree to which a certain spam group is suspected of being a botnet _ and “IP pollution level” _ the degree to which a certain IP in the spam group is suspected of being a zombie PC. Such concepts are applied in our system that detects botnets and zombie PCs by grouping spam mails based on the URL links or attachments contained, and by assessing the pollution level of each group and each IP address. For empirical testing, we used email spam data collected in an "email spam trap system" - Korea’s national spam collection system. Our proposed system detected 203 botnets and 18,283 zombie PCs in a day and these zombie PCs sent about 70% of all the spam messages in our analysis. This shows the effectiveness of detecting zombie PCs by email spam analysis, and the possibility of a dramatic reduction in email spam by taking countermeasure against these botnets and zombie PCs.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
H. Jeong, H. K. Kim, S. Lee, E. Kim, "Detection of Zombie PCs Based on Email Spam Analysis," KSII Transactions on Internet and Information Systems, vol. 6, no. 5, pp. 1445-1462, 2012. DOI: 10.3837/tiis.2012.05.011.

[ACM Style]
HyunCheol Jeong, Huy Kang Kim, Sangjin Lee, and Eunjin Kim. 2012. Detection of Zombie PCs Based on Email Spam Analysis. KSII Transactions on Internet and Information Systems, 6, 5, (2012), 1445-1462. DOI: 10.3837/tiis.2012.05.011.

[BibTeX Style]
@article{tiis:20130, title="Detection of Zombie PCs Based on Email Spam Analysis", author="HyunCheol Jeong and Huy Kang Kim and Sangjin Lee and Eunjin Kim and ", journal="KSII Transactions on Internet and Information Systems", DOI={10.3837/tiis.2012.05.011}, volume={6}, number={5}, year="2012", month={May}, pages={1445-1462}}