We explore host network-level properties, in particular, host IP address properties,  to derive the rich contexts of a communication between a client and a service. We developed a novel method, called UDmap, to identify dynamically assigned IP addresses and analyze their dynamics pattern. We applied UDmap to a month-long Hotmail user-login trace and identified a large number of dynamic IP addresses -- more than 102 million.By correlating the inferred dynamic IP addresses with Hotmail’s email server log pertaining to three consecutive months, we were able to establish that 97% of mail servers setup on dynamic IPs sent out solely spam emails, likely controlled by zombies. We developed AutoRE, a spam signature generation framework that detects and characterizes spamming botnets by leveraging both spam payload and spam server traffic properties.
Our in-depth analysis of the identified botnets revealed several interesting findings regarding the degree of email obfuscation, properties of botnet IP addresses, sending patterns, and their correlation with network scanning traffic.
Network security applications often require analyzing huge volumes of data to identify abnormal patterns or activities.
We design and implement a novel system, called BotGraph, to detect a new type of botnet spamming attacks targeting major Web email providers. UDmap is fully automatic, and relies only on application-level server logs that are already available today.

Moreover, these mail servers sent out a large amount of spam -- counting towards over 42% of all spam emails to Hotmail. While it permits free traffic from any host, attackers that generate malicious traffic cannot typically be held accountable.
We believe these observations are useful information in the design of botnet detection schemes.
The emergence of cloud-computing models opens up new opportunities to address this challenge by leveraging the power of parallel computing. BotGraph uncovers the correlations among botnet activities by constructing large user-user graphs and looking for tightly connected subgraph components. These results highlight the importance of being able to accurately identify dynamic IP addresses for spam filtering and we suspect of similar benefits for phishing site identification and Botnet detection. We develop a system called HostTracker that tracks dynamic bindings between hosts and IP addresses by leveraging application-level data with unreliable IDs.
Moreover, it outputs high quality regular expression signatures that can detect botnet spam with a low false positive rate.

This enables us to identify stealthy botnet users that are hard to detect when viewed in isolation. Using a month-long user login trace from a large email provider, we show that HostTracker can attribute most of the activities reliably to the responsible hosts, despite the existence of dynamic IP addresses, proxies, and NATs.
To deal with the huge data volume, we implement BotGraph as a distributed application on a computer cluster. With this information, we are able to analyze the host population, to conduct forensic analysis, and also to blacklist malicious hosts dynamically. We believe both our graph-based approach and our implementations are generally applicable to a wide class of security applications for analyzing large datasets.

The secret book game chapter 2 review
The secret place in gta vice city


  1. 11.05.2014 at 22:55:28
    BAKILI_OGLAN writes:
    Buddhist meditation trainer who leads retreats.
  2. 11.05.2014 at 18:34:18
    queen_of_snow writes:
    See if they're what you fewer days in the hospital than their.