Neighborhoods and bands: an analysis of the origins of spam
Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfu...
Ausführliche Beschreibung
Gespeichert in:
| Autor*in: |
Fonseca, Osvaldo [verfasserIn] |
|---|
| Format: |
E-Artikel |
|---|---|
| Sprache: |
Englisch |
| Erschienen: |
2015 |
|---|
| Schlagwörter: |
|---|
| Anmerkung: |
© Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( |
|---|
| Übergeordnetes Werk: |
Enthalten in: Journal of internet services and applications - London : Springer, 2010, 6(2015), 1 vom: 11. Mai |
|---|---|
| Übergeordnetes Werk: |
volume:6 ; year:2015 ; number:1 ; day:11 ; month:05 |
| Links: |
|---|
| DOI / URN: |
10.1186/s13174-015-0025-5 |
|---|
| Katalog-ID: |
SPR030746086 |
|---|
| LEADER | 01000caa a22002652 4500 | ||
|---|---|---|---|
| 001 | SPR030746086 | ||
| 003 | DE-627 | ||
| 005 | 20230331101751.0 | ||
| 007 | cr uuu---uuuuu | ||
| 008 | 201007s2015 xx |||||o 00| ||eng c | ||
| 024 | 7 | |a 10.1186/s13174-015-0025-5 |2 doi | |
| 035 | |a (DE-627)SPR030746086 | ||
| 035 | |a (SPR)s13174-015-0025-5-e | ||
| 040 | |a DE-627 |b ger |c DE-627 |e rakwb | ||
| 041 | |a eng | ||
| 100 | 1 | |a Fonseca, Osvaldo |e verfasserin |4 aut | |
| 245 | 1 | 0 | |a Neighborhoods and bands: an analysis of the origins of spam |
| 264 | 1 | |c 2015 | |
| 336 | |a Text |b txt |2 rdacontent | ||
| 337 | |a Computermedien |b c |2 rdamedia | ||
| 338 | |a Online-Ressource |b cr |2 rdacarrier | ||
| 500 | |a © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( | ||
| 520 | |a Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. | ||
| 650 | 4 | |a Spam traffic |7 (dpeaa)DE-He213 | |
| 650 | 4 | |a Autonomous system |7 (dpeaa)DE-He213 | |
| 650 | 4 | |a Network bad neighborhoods |7 (dpeaa)DE-He213 | |
| 700 | 1 | |a Fazzion, Elverton |4 aut | |
| 700 | 1 | |a B Las-Casas, Pedro Henrique |4 aut | |
| 700 | 1 | |a Guedes, Dorgival |4 aut | |
| 700 | 1 | |a Meira, Wagner |4 aut | |
| 700 | 1 | |a Hoepers, Cristine |4 aut | |
| 700 | 1 | |a Steding-Jessen, Klaus |4 aut | |
| 700 | 1 | |a Chaves, Marcelo HP |4 aut | |
| 773 | 0 | 8 | |i Enthalten in |t Journal of internet services and applications |d London : Springer, 2010 |g 6(2015), 1 vom: 11. Mai |w (DE-627)62014694X |w (DE-600)2541863-4 |x 1869-0238 |7 nnns |
| 773 | 1 | 8 | |g volume:6 |g year:2015 |g number:1 |g day:11 |g month:05 |
| 856 | 4 | 0 | |u https://dx.doi.org/10.1186/s13174-015-0025-5 |z kostenfrei |3 Volltext |
| 912 | |a GBV_USEFLAG_A | ||
| 912 | |a SYSFLAG_A | ||
| 912 | |a GBV_SPRINGER | ||
| 912 | |a GBV_ILN_11 | ||
| 912 | |a GBV_ILN_20 | ||
| 912 | |a GBV_ILN_22 | ||
| 912 | |a GBV_ILN_23 | ||
| 912 | |a GBV_ILN_24 | ||
| 912 | |a GBV_ILN_31 | ||
| 912 | |a GBV_ILN_39 | ||
| 912 | |a GBV_ILN_40 | ||
| 912 | |a GBV_ILN_60 | ||
| 912 | |a GBV_ILN_62 | ||
| 912 | |a GBV_ILN_63 | ||
| 912 | |a GBV_ILN_65 | ||
| 912 | |a GBV_ILN_69 | ||
| 912 | |a GBV_ILN_70 | ||
| 912 | |a GBV_ILN_73 | ||
| 912 | |a GBV_ILN_95 | ||
| 912 | |a GBV_ILN_105 | ||
| 912 | |a GBV_ILN_110 | ||
| 912 | |a GBV_ILN_150 | ||
| 912 | |a GBV_ILN_151 | ||
| 912 | |a GBV_ILN_161 | ||
| 912 | |a GBV_ILN_170 | ||
| 912 | |a GBV_ILN_213 | ||
| 912 | |a GBV_ILN_230 | ||
| 912 | |a GBV_ILN_285 | ||
| 912 | |a GBV_ILN_293 | ||
| 912 | |a GBV_ILN_370 | ||
| 912 | |a GBV_ILN_602 | ||
| 912 | |a GBV_ILN_2014 | ||
| 912 | |a GBV_ILN_2507 | ||
| 912 | |a GBV_ILN_4012 | ||
| 912 | |a GBV_ILN_4037 | ||
| 912 | |a GBV_ILN_4112 | ||
| 912 | |a GBV_ILN_4125 | ||
| 912 | |a GBV_ILN_4126 | ||
| 912 | |a GBV_ILN_4249 | ||
| 912 | |a GBV_ILN_4305 | ||
| 912 | |a GBV_ILN_4306 | ||
| 912 | |a GBV_ILN_4307 | ||
| 912 | |a GBV_ILN_4313 | ||
| 912 | |a GBV_ILN_4322 | ||
| 912 | |a GBV_ILN_4323 | ||
| 912 | |a GBV_ILN_4324 | ||
| 912 | |a GBV_ILN_4325 | ||
| 912 | |a GBV_ILN_4326 | ||
| 912 | |a GBV_ILN_4335 | ||
| 912 | |a GBV_ILN_4338 | ||
| 912 | |a GBV_ILN_4367 | ||
| 912 | |a GBV_ILN_4700 | ||
| 951 | |a AR | ||
| 952 | |d 6 |j 2015 |e 1 |b 11 |c 05 | ||
| author_variant |
o f of e f ef l c p h b lcph lcphb d g dg w m wm c h ch k s j ksj m h c mh mhc |
|---|---|
| matchkey_str |
article:18690238:2015----::egbrodadadaaayiote |
| hierarchy_sort_str |
2015 |
| publishDate |
2015 |
| allfields |
10.1186/s13174-015-0025-5 doi (DE-627)SPR030746086 (SPR)s13174-015-0025-5-e DE-627 ger DE-627 rakwb eng Fonseca, Osvaldo verfasserin aut Neighborhoods and bands: an analysis of the origins of spam 2015 Text txt rdacontent Computermedien c rdamedia Online-Ressource cr rdacarrier © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. Spam traffic (dpeaa)DE-He213 Autonomous system (dpeaa)DE-He213 Network bad neighborhoods (dpeaa)DE-He213 Fazzion, Elverton aut B Las-Casas, Pedro Henrique aut Guedes, Dorgival aut Meira, Wagner aut Hoepers, Cristine aut Steding-Jessen, Klaus aut Chaves, Marcelo HP aut Enthalten in Journal of internet services and applications London : Springer, 2010 6(2015), 1 vom: 11. Mai (DE-627)62014694X (DE-600)2541863-4 1869-0238 nnns volume:6 year:2015 number:1 day:11 month:05 https://dx.doi.org/10.1186/s13174-015-0025-5 kostenfrei Volltext GBV_USEFLAG_A SYSFLAG_A GBV_SPRINGER GBV_ILN_11 GBV_ILN_20 GBV_ILN_22 GBV_ILN_23 GBV_ILN_24 GBV_ILN_31 GBV_ILN_39 GBV_ILN_40 GBV_ILN_60 GBV_ILN_62 GBV_ILN_63 GBV_ILN_65 GBV_ILN_69 GBV_ILN_70 GBV_ILN_73 GBV_ILN_95 GBV_ILN_105 GBV_ILN_110 GBV_ILN_150 GBV_ILN_151 GBV_ILN_161 GBV_ILN_170 GBV_ILN_213 GBV_ILN_230 GBV_ILN_285 GBV_ILN_293 GBV_ILN_370 GBV_ILN_602 GBV_ILN_2014 GBV_ILN_2507 GBV_ILN_4012 GBV_ILN_4037 GBV_ILN_4112 GBV_ILN_4125 GBV_ILN_4126 GBV_ILN_4249 GBV_ILN_4305 GBV_ILN_4306 GBV_ILN_4307 GBV_ILN_4313 GBV_ILN_4322 GBV_ILN_4323 GBV_ILN_4324 GBV_ILN_4325 GBV_ILN_4326 GBV_ILN_4335 GBV_ILN_4338 GBV_ILN_4367 GBV_ILN_4700 AR 6 2015 1 11 05 |
| spelling |
10.1186/s13174-015-0025-5 doi (DE-627)SPR030746086 (SPR)s13174-015-0025-5-e DE-627 ger DE-627 rakwb eng Fonseca, Osvaldo verfasserin aut Neighborhoods and bands: an analysis of the origins of spam 2015 Text txt rdacontent Computermedien c rdamedia Online-Ressource cr rdacarrier © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. Spam traffic (dpeaa)DE-He213 Autonomous system (dpeaa)DE-He213 Network bad neighborhoods (dpeaa)DE-He213 Fazzion, Elverton aut B Las-Casas, Pedro Henrique aut Guedes, Dorgival aut Meira, Wagner aut Hoepers, Cristine aut Steding-Jessen, Klaus aut Chaves, Marcelo HP aut Enthalten in Journal of internet services and applications London : Springer, 2010 6(2015), 1 vom: 11. Mai (DE-627)62014694X (DE-600)2541863-4 1869-0238 nnns volume:6 year:2015 number:1 day:11 month:05 https://dx.doi.org/10.1186/s13174-015-0025-5 kostenfrei Volltext GBV_USEFLAG_A SYSFLAG_A GBV_SPRINGER GBV_ILN_11 GBV_ILN_20 GBV_ILN_22 GBV_ILN_23 GBV_ILN_24 GBV_ILN_31 GBV_ILN_39 GBV_ILN_40 GBV_ILN_60 GBV_ILN_62 GBV_ILN_63 GBV_ILN_65 GBV_ILN_69 GBV_ILN_70 GBV_ILN_73 GBV_ILN_95 GBV_ILN_105 GBV_ILN_110 GBV_ILN_150 GBV_ILN_151 GBV_ILN_161 GBV_ILN_170 GBV_ILN_213 GBV_ILN_230 GBV_ILN_285 GBV_ILN_293 GBV_ILN_370 GBV_ILN_602 GBV_ILN_2014 GBV_ILN_2507 GBV_ILN_4012 GBV_ILN_4037 GBV_ILN_4112 GBV_ILN_4125 GBV_ILN_4126 GBV_ILN_4249 GBV_ILN_4305 GBV_ILN_4306 GBV_ILN_4307 GBV_ILN_4313 GBV_ILN_4322 GBV_ILN_4323 GBV_ILN_4324 GBV_ILN_4325 GBV_ILN_4326 GBV_ILN_4335 GBV_ILN_4338 GBV_ILN_4367 GBV_ILN_4700 AR 6 2015 1 11 05 |
| allfields_unstemmed |
10.1186/s13174-015-0025-5 doi (DE-627)SPR030746086 (SPR)s13174-015-0025-5-e DE-627 ger DE-627 rakwb eng Fonseca, Osvaldo verfasserin aut Neighborhoods and bands: an analysis of the origins of spam 2015 Text txt rdacontent Computermedien c rdamedia Online-Ressource cr rdacarrier © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. Spam traffic (dpeaa)DE-He213 Autonomous system (dpeaa)DE-He213 Network bad neighborhoods (dpeaa)DE-He213 Fazzion, Elverton aut B Las-Casas, Pedro Henrique aut Guedes, Dorgival aut Meira, Wagner aut Hoepers, Cristine aut Steding-Jessen, Klaus aut Chaves, Marcelo HP aut Enthalten in Journal of internet services and applications London : Springer, 2010 6(2015), 1 vom: 11. Mai (DE-627)62014694X (DE-600)2541863-4 1869-0238 nnns volume:6 year:2015 number:1 day:11 month:05 https://dx.doi.org/10.1186/s13174-015-0025-5 kostenfrei Volltext GBV_USEFLAG_A SYSFLAG_A GBV_SPRINGER GBV_ILN_11 GBV_ILN_20 GBV_ILN_22 GBV_ILN_23 GBV_ILN_24 GBV_ILN_31 GBV_ILN_39 GBV_ILN_40 GBV_ILN_60 GBV_ILN_62 GBV_ILN_63 GBV_ILN_65 GBV_ILN_69 GBV_ILN_70 GBV_ILN_73 GBV_ILN_95 GBV_ILN_105 GBV_ILN_110 GBV_ILN_150 GBV_ILN_151 GBV_ILN_161 GBV_ILN_170 GBV_ILN_213 GBV_ILN_230 GBV_ILN_285 GBV_ILN_293 GBV_ILN_370 GBV_ILN_602 GBV_ILN_2014 GBV_ILN_2507 GBV_ILN_4012 GBV_ILN_4037 GBV_ILN_4112 GBV_ILN_4125 GBV_ILN_4126 GBV_ILN_4249 GBV_ILN_4305 GBV_ILN_4306 GBV_ILN_4307 GBV_ILN_4313 GBV_ILN_4322 GBV_ILN_4323 GBV_ILN_4324 GBV_ILN_4325 GBV_ILN_4326 GBV_ILN_4335 GBV_ILN_4338 GBV_ILN_4367 GBV_ILN_4700 AR 6 2015 1 11 05 |
| allfieldsGer |
10.1186/s13174-015-0025-5 doi (DE-627)SPR030746086 (SPR)s13174-015-0025-5-e DE-627 ger DE-627 rakwb eng Fonseca, Osvaldo verfasserin aut Neighborhoods and bands: an analysis of the origins of spam 2015 Text txt rdacontent Computermedien c rdamedia Online-Ressource cr rdacarrier © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. Spam traffic (dpeaa)DE-He213 Autonomous system (dpeaa)DE-He213 Network bad neighborhoods (dpeaa)DE-He213 Fazzion, Elverton aut B Las-Casas, Pedro Henrique aut Guedes, Dorgival aut Meira, Wagner aut Hoepers, Cristine aut Steding-Jessen, Klaus aut Chaves, Marcelo HP aut Enthalten in Journal of internet services and applications London : Springer, 2010 6(2015), 1 vom: 11. Mai (DE-627)62014694X (DE-600)2541863-4 1869-0238 nnns volume:6 year:2015 number:1 day:11 month:05 https://dx.doi.org/10.1186/s13174-015-0025-5 kostenfrei Volltext GBV_USEFLAG_A SYSFLAG_A GBV_SPRINGER GBV_ILN_11 GBV_ILN_20 GBV_ILN_22 GBV_ILN_23 GBV_ILN_24 GBV_ILN_31 GBV_ILN_39 GBV_ILN_40 GBV_ILN_60 GBV_ILN_62 GBV_ILN_63 GBV_ILN_65 GBV_ILN_69 GBV_ILN_70 GBV_ILN_73 GBV_ILN_95 GBV_ILN_105 GBV_ILN_110 GBV_ILN_150 GBV_ILN_151 GBV_ILN_161 GBV_ILN_170 GBV_ILN_213 GBV_ILN_230 GBV_ILN_285 GBV_ILN_293 GBV_ILN_370 GBV_ILN_602 GBV_ILN_2014 GBV_ILN_2507 GBV_ILN_4012 GBV_ILN_4037 GBV_ILN_4112 GBV_ILN_4125 GBV_ILN_4126 GBV_ILN_4249 GBV_ILN_4305 GBV_ILN_4306 GBV_ILN_4307 GBV_ILN_4313 GBV_ILN_4322 GBV_ILN_4323 GBV_ILN_4324 GBV_ILN_4325 GBV_ILN_4326 GBV_ILN_4335 GBV_ILN_4338 GBV_ILN_4367 GBV_ILN_4700 AR 6 2015 1 11 05 |
| allfieldsSound |
10.1186/s13174-015-0025-5 doi (DE-627)SPR030746086 (SPR)s13174-015-0025-5-e DE-627 ger DE-627 rakwb eng Fonseca, Osvaldo verfasserin aut Neighborhoods and bands: an analysis of the origins of spam 2015 Text txt rdacontent Computermedien c rdamedia Online-Ressource cr rdacarrier © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. Spam traffic (dpeaa)DE-He213 Autonomous system (dpeaa)DE-He213 Network bad neighborhoods (dpeaa)DE-He213 Fazzion, Elverton aut B Las-Casas, Pedro Henrique aut Guedes, Dorgival aut Meira, Wagner aut Hoepers, Cristine aut Steding-Jessen, Klaus aut Chaves, Marcelo HP aut Enthalten in Journal of internet services and applications London : Springer, 2010 6(2015), 1 vom: 11. Mai (DE-627)62014694X (DE-600)2541863-4 1869-0238 nnns volume:6 year:2015 number:1 day:11 month:05 https://dx.doi.org/10.1186/s13174-015-0025-5 kostenfrei Volltext GBV_USEFLAG_A SYSFLAG_A GBV_SPRINGER GBV_ILN_11 GBV_ILN_20 GBV_ILN_22 GBV_ILN_23 GBV_ILN_24 GBV_ILN_31 GBV_ILN_39 GBV_ILN_40 GBV_ILN_60 GBV_ILN_62 GBV_ILN_63 GBV_ILN_65 GBV_ILN_69 GBV_ILN_70 GBV_ILN_73 GBV_ILN_95 GBV_ILN_105 GBV_ILN_110 GBV_ILN_150 GBV_ILN_151 GBV_ILN_161 GBV_ILN_170 GBV_ILN_213 GBV_ILN_230 GBV_ILN_285 GBV_ILN_293 GBV_ILN_370 GBV_ILN_602 GBV_ILN_2014 GBV_ILN_2507 GBV_ILN_4012 GBV_ILN_4037 GBV_ILN_4112 GBV_ILN_4125 GBV_ILN_4126 GBV_ILN_4249 GBV_ILN_4305 GBV_ILN_4306 GBV_ILN_4307 GBV_ILN_4313 GBV_ILN_4322 GBV_ILN_4323 GBV_ILN_4324 GBV_ILN_4325 GBV_ILN_4326 GBV_ILN_4335 GBV_ILN_4338 GBV_ILN_4367 GBV_ILN_4700 AR 6 2015 1 11 05 |
| language |
English |
| source |
Enthalten in Journal of internet services and applications 6(2015), 1 vom: 11. Mai volume:6 year:2015 number:1 day:11 month:05 |
| sourceStr |
Enthalten in Journal of internet services and applications 6(2015), 1 vom: 11. Mai volume:6 year:2015 number:1 day:11 month:05 |
| format_phy_str_mv |
Article |
| institution |
findex.gbv.de |
| topic_facet |
Spam traffic Autonomous system Network bad neighborhoods |
| isfreeaccess_bool |
true |
| container_title |
Journal of internet services and applications |
| authorswithroles_txt_mv |
Fonseca, Osvaldo @@aut@@ Fazzion, Elverton @@aut@@ B Las-Casas, Pedro Henrique @@aut@@ Guedes, Dorgival @@aut@@ Meira, Wagner @@aut@@ Hoepers, Cristine @@aut@@ Steding-Jessen, Klaus @@aut@@ Chaves, Marcelo HP @@aut@@ |
| publishDateDaySort_date |
2015-05-11T00:00:00Z |
| hierarchy_top_id |
62014694X |
| id |
SPR030746086 |
| language_de |
englisch |
| fullrecord |
<?xml version="1.0" encoding="UTF-8"?><collection xmlns="http://www.loc.gov/MARC21/slim"><record><leader>01000caa a22002652 4500</leader><controlfield tag="001">SPR030746086</controlfield><controlfield tag="003">DE-627</controlfield><controlfield tag="005">20230331101751.0</controlfield><controlfield tag="007">cr uuu---uuuuu</controlfield><controlfield tag="008">201007s2015 xx |||||o 00| ||eng c</controlfield><datafield tag="024" ind1="7" ind2=" "><subfield code="a">10.1186/s13174-015-0025-5</subfield><subfield code="2">doi</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(DE-627)SPR030746086</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(SPR)s13174-015-0025-5-e</subfield></datafield><datafield tag="040" ind1=" " ind2=" "><subfield code="a">DE-627</subfield><subfield code="b">ger</subfield><subfield code="c">DE-627</subfield><subfield code="e">rakwb</subfield></datafield><datafield tag="041" ind1=" " ind2=" "><subfield code="a">eng</subfield></datafield><datafield tag="100" ind1="1" ind2=" "><subfield code="a">Fonseca, Osvaldo</subfield><subfield code="e">verfasserin</subfield><subfield code="4">aut</subfield></datafield><datafield tag="245" ind1="1" ind2="0"><subfield code="a">Neighborhoods and bands: an analysis of the origins of spam</subfield></datafield><datafield tag="264" ind1=" " ind2="1"><subfield code="c">2015</subfield></datafield><datafield tag="336" ind1=" " ind2=" "><subfield code="a">Text</subfield><subfield code="b">txt</subfield><subfield code="2">rdacontent</subfield></datafield><datafield tag="337" ind1=" " ind2=" "><subfield code="a">Computermedien</subfield><subfield code="b">c</subfield><subfield code="2">rdamedia</subfield></datafield><datafield tag="338" ind1=" " ind2=" "><subfield code="a">Online-Ressource</subfield><subfield code="b">cr</subfield><subfield code="2">rdacarrier</subfield></datafield><datafield tag="500" ind1=" " ind2=" "><subfield code="a">© Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License (</subfield></datafield><datafield tag="520" ind1=" " ind2=" "><subfield code="a">Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands.</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Spam traffic</subfield><subfield code="7">(dpeaa)DE-He213</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Autonomous system</subfield><subfield code="7">(dpeaa)DE-He213</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Network bad neighborhoods</subfield><subfield code="7">(dpeaa)DE-He213</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Fazzion, Elverton</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">B Las-Casas, Pedro Henrique</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Guedes, Dorgival</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Meira, Wagner</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Hoepers, Cristine</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Steding-Jessen, Klaus</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Chaves, Marcelo HP</subfield><subfield code="4">aut</subfield></datafield><datafield tag="773" ind1="0" ind2="8"><subfield code="i">Enthalten in</subfield><subfield code="t">Journal of internet services and applications</subfield><subfield code="d">London : Springer, 2010</subfield><subfield code="g">6(2015), 1 vom: 11. Mai</subfield><subfield code="w">(DE-627)62014694X</subfield><subfield code="w">(DE-600)2541863-4</subfield><subfield code="x">1869-0238</subfield><subfield code="7">nnns</subfield></datafield><datafield tag="773" ind1="1" ind2="8"><subfield code="g">volume:6</subfield><subfield code="g">year:2015</subfield><subfield code="g">number:1</subfield><subfield code="g">day:11</subfield><subfield code="g">month:05</subfield></datafield><datafield tag="856" ind1="4" ind2="0"><subfield code="u">https://dx.doi.org/10.1186/s13174-015-0025-5</subfield><subfield code="z">kostenfrei</subfield><subfield code="3">Volltext</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_USEFLAG_A</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">SYSFLAG_A</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_SPRINGER</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_11</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_20</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_22</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_23</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_24</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_31</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_39</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_40</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_60</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_62</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_63</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_65</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_69</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_70</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_73</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_95</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_105</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_110</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_150</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_151</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_161</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_170</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_213</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_230</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_285</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_293</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_370</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_602</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_2014</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_2507</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4012</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4037</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4112</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4125</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4126</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4249</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4305</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4306</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4307</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4313</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4322</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4323</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4324</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4325</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4326</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4335</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4338</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4367</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4700</subfield></datafield><datafield tag="951" ind1=" " ind2=" "><subfield code="a">AR</subfield></datafield><datafield tag="952" ind1=" " ind2=" "><subfield code="d">6</subfield><subfield code="j">2015</subfield><subfield code="e">1</subfield><subfield code="b">11</subfield><subfield code="c">05</subfield></datafield></record></collection>
|
| author |
Fonseca, Osvaldo |
| spellingShingle |
Fonseca, Osvaldo misc Spam traffic misc Autonomous system misc Network bad neighborhoods Neighborhoods and bands: an analysis of the origins of spam |
| authorStr |
Fonseca, Osvaldo |
| ppnlink_with_tag_str_mv |
@@773@@(DE-627)62014694X |
| format |
electronic Article |
| delete_txt_mv |
keep |
| author_role |
aut aut aut aut aut aut aut aut |
| collection |
springer |
| remote_str |
true |
| illustrated |
Not Illustrated |
| issn |
1869-0238 |
| topic_title |
Neighborhoods and bands: an analysis of the origins of spam Spam traffic (dpeaa)DE-He213 Autonomous system (dpeaa)DE-He213 Network bad neighborhoods (dpeaa)DE-He213 |
| topic |
misc Spam traffic misc Autonomous system misc Network bad neighborhoods |
| topic_unstemmed |
misc Spam traffic misc Autonomous system misc Network bad neighborhoods |
| topic_browse |
misc Spam traffic misc Autonomous system misc Network bad neighborhoods |
| format_facet |
Elektronische Aufsätze Aufsätze Elektronische Ressource |
| format_main_str_mv |
Text Zeitschrift/Artikel |
| carriertype_str_mv |
cr |
| hierarchy_parent_title |
Journal of internet services and applications |
| hierarchy_parent_id |
62014694X |
| hierarchy_top_title |
Journal of internet services and applications |
| isfreeaccess_txt |
true |
| familylinks_str_mv |
(DE-627)62014694X (DE-600)2541863-4 |
| title |
Neighborhoods and bands: an analysis of the origins of spam |
| ctrlnum |
(DE-627)SPR030746086 (SPR)s13174-015-0025-5-e |
| title_full |
Neighborhoods and bands: an analysis of the origins of spam |
| author_sort |
Fonseca, Osvaldo |
| journal |
Journal of internet services and applications |
| journalStr |
Journal of internet services and applications |
| lang_code |
eng |
| isOA_bool |
true |
| recordtype |
marc |
| publishDateSort |
2015 |
| contenttype_str_mv |
txt |
| author_browse |
Fonseca, Osvaldo Fazzion, Elverton B Las-Casas, Pedro Henrique Guedes, Dorgival Meira, Wagner Hoepers, Cristine Steding-Jessen, Klaus Chaves, Marcelo HP |
| container_volume |
6 |
| format_se |
Elektronische Aufsätze |
| author-letter |
Fonseca, Osvaldo |
| doi_str_mv |
10.1186/s13174-015-0025-5 |
| title_sort |
neighborhoods and bands: an analysis of the origins of spam |
| title_auth |
Neighborhoods and bands: an analysis of the origins of spam |
| abstract |
Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( |
| abstractGer |
Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( |
| abstract_unstemmed |
Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands. © Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License ( |
| collection_details |
GBV_USEFLAG_A SYSFLAG_A GBV_SPRINGER GBV_ILN_11 GBV_ILN_20 GBV_ILN_22 GBV_ILN_23 GBV_ILN_24 GBV_ILN_31 GBV_ILN_39 GBV_ILN_40 GBV_ILN_60 GBV_ILN_62 GBV_ILN_63 GBV_ILN_65 GBV_ILN_69 GBV_ILN_70 GBV_ILN_73 GBV_ILN_95 GBV_ILN_105 GBV_ILN_110 GBV_ILN_150 GBV_ILN_151 GBV_ILN_161 GBV_ILN_170 GBV_ILN_213 GBV_ILN_230 GBV_ILN_285 GBV_ILN_293 GBV_ILN_370 GBV_ILN_602 GBV_ILN_2014 GBV_ILN_2507 GBV_ILN_4012 GBV_ILN_4037 GBV_ILN_4112 GBV_ILN_4125 GBV_ILN_4126 GBV_ILN_4249 GBV_ILN_4305 GBV_ILN_4306 GBV_ILN_4307 GBV_ILN_4313 GBV_ILN_4322 GBV_ILN_4323 GBV_ILN_4324 GBV_ILN_4325 GBV_ILN_4326 GBV_ILN_4335 GBV_ILN_4338 GBV_ILN_4367 GBV_ILN_4700 |
| container_issue |
1 |
| title_short |
Neighborhoods and bands: an analysis of the origins of spam |
| url |
https://dx.doi.org/10.1186/s13174-015-0025-5 |
| remote_bool |
true |
| author2 |
Fazzion, Elverton B Las-Casas, Pedro Henrique Guedes, Dorgival Meira, Wagner Hoepers, Cristine Steding-Jessen, Klaus Chaves, Marcelo HP |
| author2Str |
Fazzion, Elverton B Las-Casas, Pedro Henrique Guedes, Dorgival Meira, Wagner Hoepers, Cristine Steding-Jessen, Klaus Chaves, Marcelo HP |
| ppnlink |
62014694X |
| mediatype_str_mv |
c |
| isOA_txt |
true |
| hochschulschrift_bool |
false |
| doi_str |
10.1186/s13174-015-0025-5 |
| up_date |
2024-07-03T19:52:14.234Z |
| _version_ |
1803588819208896513 |
| fullrecord_marcxml |
<?xml version="1.0" encoding="UTF-8"?><collection xmlns="http://www.loc.gov/MARC21/slim"><record><leader>01000caa a22002652 4500</leader><controlfield tag="001">SPR030746086</controlfield><controlfield tag="003">DE-627</controlfield><controlfield tag="005">20230331101751.0</controlfield><controlfield tag="007">cr uuu---uuuuu</controlfield><controlfield tag="008">201007s2015 xx |||||o 00| ||eng c</controlfield><datafield tag="024" ind1="7" ind2=" "><subfield code="a">10.1186/s13174-015-0025-5</subfield><subfield code="2">doi</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(DE-627)SPR030746086</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(SPR)s13174-015-0025-5-e</subfield></datafield><datafield tag="040" ind1=" " ind2=" "><subfield code="a">DE-627</subfield><subfield code="b">ger</subfield><subfield code="c">DE-627</subfield><subfield code="e">rakwb</subfield></datafield><datafield tag="041" ind1=" " ind2=" "><subfield code="a">eng</subfield></datafield><datafield tag="100" ind1="1" ind2=" "><subfield code="a">Fonseca, Osvaldo</subfield><subfield code="e">verfasserin</subfield><subfield code="4">aut</subfield></datafield><datafield tag="245" ind1="1" ind2="0"><subfield code="a">Neighborhoods and bands: an analysis of the origins of spam</subfield></datafield><datafield tag="264" ind1=" " ind2="1"><subfield code="c">2015</subfield></datafield><datafield tag="336" ind1=" " ind2=" "><subfield code="a">Text</subfield><subfield code="b">txt</subfield><subfield code="2">rdacontent</subfield></datafield><datafield tag="337" ind1=" " ind2=" "><subfield code="a">Computermedien</subfield><subfield code="b">c</subfield><subfield code="2">rdamedia</subfield></datafield><datafield tag="338" ind1=" " ind2=" "><subfield code="a">Online-Ressource</subfield><subfield code="b">cr</subfield><subfield code="2">rdacarrier</subfield></datafield><datafield tag="500" ind1=" " ind2=" "><subfield code="a">© Fonsecaet al.; licensee Springer. 2015. This is an Open Access article distributed under the terms of the Creative Commons Attribution License (</subfield></datafield><datafield tag="520" ind1=" " ind2=" "><subfield code="a">Abstract Despite the continuous efforts to mitigate spam, the volume of such messages continues to grow and identifying spammers is still a challenge. Spam traffic analysis is an important tool in this context, allowing network administrators to understand the behavior of spammers, both as they obfuscate messages and try to hide inside the network. This work adds to that body of information by analyzing the sources of spam to understand to what extent they explain the traffic observed. Our results show that, in many cases, an Autonomous System (AS) represents an interesting neighborhood to observe, with most ASes falling into four basic types: heavy and light senders, which tend to have many or very few spammer machines respectively, frequent small offenders, where spammer machines appear every now and then but disappear in a short time, and conniving ASes, where most machines do not send spam, but a few are heavy, continuous senders. Not only that, but also by grouping machines based on the campaigns that they send together, we define the notion of SpamBands. Those bands identify groups of machines that are probably controlled by the same spammer, and our findings show that they often span multiple ASes. The identification of AS neighborhood types and SpamBands may simplify the combat against spam, focusing efforts at the sources as a whole, possibly improving blacklists by grouping machines found in a same AS or SpamBands.</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Spam traffic</subfield><subfield code="7">(dpeaa)DE-He213</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Autonomous system</subfield><subfield code="7">(dpeaa)DE-He213</subfield></datafield><datafield tag="650" ind1=" " ind2="4"><subfield code="a">Network bad neighborhoods</subfield><subfield code="7">(dpeaa)DE-He213</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Fazzion, Elverton</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">B Las-Casas, Pedro Henrique</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Guedes, Dorgival</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Meira, Wagner</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Hoepers, Cristine</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Steding-Jessen, Klaus</subfield><subfield code="4">aut</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Chaves, Marcelo HP</subfield><subfield code="4">aut</subfield></datafield><datafield tag="773" ind1="0" ind2="8"><subfield code="i">Enthalten in</subfield><subfield code="t">Journal of internet services and applications</subfield><subfield code="d">London : Springer, 2010</subfield><subfield code="g">6(2015), 1 vom: 11. Mai</subfield><subfield code="w">(DE-627)62014694X</subfield><subfield code="w">(DE-600)2541863-4</subfield><subfield code="x">1869-0238</subfield><subfield code="7">nnns</subfield></datafield><datafield tag="773" ind1="1" ind2="8"><subfield code="g">volume:6</subfield><subfield code="g">year:2015</subfield><subfield code="g">number:1</subfield><subfield code="g">day:11</subfield><subfield code="g">month:05</subfield></datafield><datafield tag="856" ind1="4" ind2="0"><subfield code="u">https://dx.doi.org/10.1186/s13174-015-0025-5</subfield><subfield code="z">kostenfrei</subfield><subfield code="3">Volltext</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_USEFLAG_A</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">SYSFLAG_A</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_SPRINGER</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_11</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_20</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_22</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_23</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_24</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_31</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_39</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_40</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_60</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_62</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_63</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_65</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_69</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_70</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_73</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_95</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_105</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_110</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_150</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_151</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_161</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_170</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_213</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_230</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_285</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_293</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_370</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_602</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_2014</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_2507</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4012</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4037</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4112</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4125</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4126</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4249</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4305</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4306</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4307</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4313</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4322</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4323</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4324</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4325</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4326</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4335</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4338</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4367</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">GBV_ILN_4700</subfield></datafield><datafield tag="951" ind1=" " ind2=" "><subfield code="a">AR</subfield></datafield><datafield tag="952" ind1=" " ind2=" "><subfield code="d">6</subfield><subfield code="j">2015</subfield><subfield code="e">1</subfield><subfield code="b">11</subfield><subfield code="c">05</subfield></datafield></record></collection>
|
| score |
7.4013157 |