CT-ER: Breaking Email Spam Laundering

通过开放代理或受攻击的PC来清洗电子邮件是地下电子邮件行业广泛使用的一种隐藏真实垃圾邮件来源、降低垃圾邮件成本的技术。破解垃圾邮件清洗和阻止接近其来源的垃圾邮件活动的设施，不仅对电子邮件用户有很大好处，而且对受害互联网服务提供商也有很大好处，这种设施需求很大，但仍然缺乏。基于协议语义和时序因果关系，我们揭示了垃圾邮件清洗活动的一个显著特征，即数据包对称性。利用垃圾邮件清洗所表现出的数据包对称性，我们提出了一种简单而有效的对策DBSpam来在线检测和破解客户网络中的垃圾邮件清洗活动。一旦检测到垃圾邮件清洗，在发送者端对垃圾邮件进行指纹识别是可行的，并且可以分发垃圾邮件签名以加速在其他地方的垃圾邮件检测。DBSpam是对现有反垃圾邮件技术的补充，可以在互联网上逐步部署，作为一种接近垃圾邮件来源的有效垃圾邮件检测和抑制机制，DBSpam将在抑制急剧增长的垃圾邮件消息方面发挥关键作用。此外，这项研究将成为垃圾邮件发送者跟踪和执法、垃圾邮件指纹识别和全球垃圾邮件取证分析的催化剂。该项目的教育方面侧重于整合教育和研究活动，加强本科生和研究生的安全和网络课程

Laundering email spam through open-proxies or compromised PCs is a widely-used technique to conceal real spam sources and reduce spamming cost in underground email spam industry. The facility of breaking the spam laundering and deterring the spam activities close to their sources, which will greatly benefit not only email users but also victim ISPs, is in great demand but still missing. We propose a highly-focused and timely-demanded project to systematically investigate (1) the distinct behavior of email spam laundering and (2) how to detect and break this email spam laundering.Based on protocol semantics and timing causality, we reveal one salient characteristic of email spam laundering activities, namely packet symmetry. Utilizing the packet symmetry exhibited in spam laundering, we propose a simple and efficient countermeasure, DBSpam, to on-line detect and break spam laundering activities inside a customer network. Once spam laundering is detected, fingerprinting spam messages at the sender side is viable and spam signatures may be distributed to accelerate spam detection at other places. DBSpam is complementary to existing anti-spam techniques and can be incrementally deployed over the Internet.As an effective spam detection and suppression mechanism close to spam sources, DBSpam will play a critical to dampen the dramatically-grown spam messages. Moreover, this research will serve as a catalyst for spammer tracking and law enforcement, spam message fingerprinting, and global spam forensic analysis. The educational aspect of this project focuses on integrating education and research activities, enhancing the undergraduate and graduate security and networking curricula