System and method for detecting remotely controlled E-mail spam hosts
A system for detecting a remotely controlled e-mail spam host. The system includes an E-mail spammer detection unit and a host traffic profiling unit. The E-mail spammer detection unit identifies E-mail Spammers based on SMTP traffic characteristics. The host profiling unit extracts traffic components from the plurality of Internet traffic associated with an E-mail Spammer; interprets the extracted traffic components and determines whether the E-mail Spammer is a compromised host. The system may also include a botnet controller detection unit that analyzes traffic associated with compromised E-mail Spammers and identifies the botnet Controller remotely controlling the compromised E-mail Spammer.
1. A system for detecting a remotely controlled e-mail spam host comprising:
an e-mail spammer detection unit to analyze incoming network data received from an e-mail client to determine if the e-mail client is an e-mail spammer;
a host traffic profiler unit comprising:
an extractor to, in response to determining that the e-mail client is an e-mail spammer, extract traffic flow data from incoming internet traffic associated with the e-mail spammer, and to extract an entropy-based significant traffic component from the traffic flow data, the entropy-based significant traffic component comprising significant protocol port values determined by:
clustering ports having a flow share greater than or equal to a threshold value, and
determining the significant protocol port values as non-clustered ports having a probability exceeding the threshold value;
a profile construction unit to construct a traffic profile associated with the e-mail spammer based on the traffic flow data and the entropy-based significant traffic component, wherein the traffic profile comprises data indicative of types of interactions and ports; and
a processor to determine if the e-mail spammer is a compromised e-mail spammer based on the traffic profile; and
a botnet controller detector: for identifying a botnet controller controlling the compromised e-mail spammer; for analyzing the traffic flow data to identify a botnet controller connection associated with the botnet controller; and for assigning a confidence score to the botnet controller based on analyzing the traffic flow data, wherein the confidence score is based on a number of suspected bot clients connected, bytes per packet, inter-arrival times between flows, a number of triggers, and types of triggers.
2. The system of claim 1 , wherein the traffic flow data is associated with mail-related activities and non-mail related activities.
3. The system of claim 2 , wherein the host traffic profiler unit further comprises:
a detector that detects if the compromised e-mail spammer consistently uses a particular user data protocol port with a specific payload byte size indicating non-mail-related activity.
4. The system of claim 2 , wherein mail-related activities include simple mail transfer protocol interactions, hypertext transfer protocol related services, and domain name system related services.
5. The system of claim 1 , wherein the e-mail spammer detection unit detects if a simple mail transfer protocol client that initiates simple mail transfer protocol traffic is the e-mail spammer.
6. The system of claim 1 , wherein the processor executes an algorithm to identify traffic flows associated with botnet controllers.
7. The system of claim 1 , wherein:
the extractor extracts the traffic flow data in response to a determination that an internet protocol address of the compromised e-mail spammer is one of a source internet protocol address and a destination internet protocol address;
and wherein the botnet controller detector further comprises:
a comparator that compares the confidence score to a confidence threshold score representing a numerical probability that the botnet controller is remotely controlling the compromised e-mail spammer; and
a botnet controller alarm that generates an alarm in response to the confidence score exceeding the confidence threshold score.
8. The system of claim 1 , wherein the entropy-based significant traffic component includes one of local port values, remote port values, protocol message values, and protocol values; and
wherein the extractor interprets the entropy-based significant traffic component in order to construct the traffic profile.
9. The system of claim 1 , wherein entropy of X is defined as
H
(
X
)
=
-
∑
x
i
∈
X
p
(
x
i
)
log
(
p
(
x
i
)
)
,
where
0
≤
H
(
X
)
≤
H
max
(
X
)
=
log
(
min
(
N
x
,
m
)
)
wherein X is a random variable that takes on N x discrete values, and
wherein if X is randomly sampled m times, then
P(x i )=m i /m, x i εX, wherein m i is a frequency of X taking a value x i .
10. The system of claim 1 , wherein the entropy-based significant traffic component is determined based on a normalized entropy defined for a discrete random variable X as:
H n ( X )=−((Σ p ( x i )log( p ( x i )))/(log(min( N x ,m )))
where p(x i ) denotes probabilities of discrete values x i , m is a sample size, and N x is a number of all possible values of the discrete random variable X.
11. A computer-implemented method for detecting a compromised e-mail spam host comprising:
analyzing incoming network data received from an e-mail client to determine if the e-mail client is an e-mail spammer;
in response to determining that the e-mail client is an e-mail spammer, extracting traffic flow data from incoming internet traffic associated with the e-mail spammer, and extracting an entropy-based significant traffic component from the traffic flow data to construct a traffic profile associated with the e-mail spammer, wherein the traffic profile comprises data indicative of types of interactions and ports, the entropy-based significant traffic component comprising significant protocol port values determined by:
clustering ports having a flow share greater than or equal to a threshold value, and
determining the significant protocol port values as non-clustered ports having a probability exceeding the threshold value;
determining if the e-mail spammer is a compromised e-mail spammer based on the traffic profile;
detecting if a botnet controller is remotely controlling the compromised e-mail spammer;
analyzing the traffic flow data to identify a botnet controller connection associated with the botnet controller; and
assigning a confidence score to the botnet controller based on the analyzing the traffic flow data, wherein the confidence score is based on a number of suspected bot clients connected, bytes per packet, inter-arrival times between flows, a number of triggers, and types of triggers.
12. The method of claim 11 , wherein the traffic flow data is associated with mail-related activities and non-mail related activities.
13. The method of claim 12 , wherein the mail-related activities include simple mail transfer protocol related services, hypertext transfer protocol related services, and domain name system related services.
14. The method of claim 11 , further comprising:
detecting if a simple mail transfer protocol client that initiates simple mail transfer protocol traffic is the e-mail spammer.
15. The method of claim 14 wherein the detecting if a simple mail transfer protocol client that initiates simple mail transfer protocol traffic is the e-mail spammer comprises:
detecting if the compromised e-mail spammer consistently uses a particular user data protocol port with a specific payload byte size indicating non-mail-related activity.
16. The method of claim 11 , wherein the detecting if a botnet controller detector is remotely controlling the compromised e-mail spammer further comprises:
extracting the traffic flow data from the compromised e-mail spammer in response to a determination that an internet protocol address of the compromised e-mail spammer is one of a source internet protocol address and a destination internet protocol address;
comparing the confidence score to a confidence threshold score representing a numerical probability that the botnet controller is remotely controlling the compromised e-mail spammer; and
generating an alarm in response to the confidence score exceeding the confidence threshold score.
17. The method of claim 11 , wherein the entropy-based significant traffic component includes one of local port values, remote port values, protocol message values, and protocol values, the method further comprising: and
interpreting the entropy-based significant traffic component in order to construct the traffic profile.
18. The method of claim 11 , wherein the entropy-based significant traffic component is determined based on a normalized entropy defined for a discrete random variable X as:
H n ( X )=−((Σ p ( x i )log( p ( x i )))/(log(min( N x ,m )))
where p(x i ) denotes probabilities of discrete values x i , m is a sample size, and N x is a number of all possible values of the discrete random variable X.