CT-ER: Breaking Email Spam Laundering

在地下垃圾邮件行业中，通过开放代理或被入侵的个人电脑进行垃圾邮件洗钱是一种广泛使用的隐藏真实垃圾邮件来源和降低垃圾邮件传播成本的技术。打击垃圾邮件洗钱和在源头附近阻止垃圾邮件活动的设施，对电子邮件用户和受害的互联网服务提供商都有很大的好处，但需求很大，但仍然缺乏。我们提出了一个高度集中和及时要求的项目，系统地研究(1)垃圾邮件洗钱的独特行为和(2)如何检测和打破这种垃圾邮件洗钱。基于协议语义和时间因果关系，我们揭示了垃圾邮件洗钱活动的一个显著特征，即数据包对称性。利用垃圾邮件洗钱中显示的数据包对称性，我们提出了一种简单而有效的对策，DBSpam，用于在线检测和破坏客户网络中的垃圾邮件洗钱活动。一旦检测到垃圾邮件洗钱，就可以在发送方对垃圾邮件进行指纹识别，并且可以分发垃圾邮件签名以加速其他地方的垃圾邮件检测。DBSpam是对现有反垃圾邮件技术的补充，可以在Internet上增量部署。作为一种接近垃圾邮件源的有效的垃圾邮件检测和抑制机制，DBSpam将在抑制急剧增长的垃圾邮件消息方面发挥关键作用。此外，这项研究将成为垃圾邮件发送者跟踪和执法、垃圾邮件信息指纹和全球垃圾邮件取证分析的催化剂。该项目的教育方面侧重于整合教育和研究活动，加强本科生和研究生的安全和网络课程

Laundering email spam through open-proxies or compromised PCs is a widely-used technique to conceal real spam sources and reduce spamming cost in underground email spam industry. The facility of breaking the spam laundering and deterring the spam activities close to their sources, which will greatly benefit not only email users but also victim ISPs, is in great demand but still missing. We propose a highly-focused and timely-demanded project to systematically investigate (1) the distinct behavior of email spam laundering and (2) how to detect and break this email spam laundering.Based on protocol semantics and timing causality, we reveal one salient characteristic of email spam laundering activities, namely packet symmetry. Utilizing the packet symmetry exhibited in spam laundering, we propose a simple and efficient countermeasure, DBSpam, to on-line detect and break spam laundering activities inside a customer network. Once spam laundering is detected, fingerprinting spam messages at the sender side is viable and spam signatures may be distributed to accelerate spam detection at other places. DBSpam is complementary to existing anti-spam techniques and can be incrementally deployed over the Internet.As an effective spam detection and suppression mechanism close to spam sources, DBSpam will play a critical to dampen the dramatically-grown spam messages. Moreover, this research will serve as a catalyst for spammer tracking and law enforcement, spam message fingerprinting, and global spam forensic analysis. The educational aspect of this project focuses on integrating education and research activities, enhancing the undergraduate and graduate security and networking curricula