Medição, caracterização e redução dos custos associados ao tráfego de spam

Abstract

Spam messages are often used to propagate malware, to disseminate phishing exploits, and to advertise illegal products. Those messages generate costs for users and network operators, but it is hard to measure how much of their costs are associated with spam traffic, and who actually pays for it. In this work, we provide a method to quantify the transit costs of spam traffic. We issue traceroutes from RIPE Atlas vantage points to estimate the routes traversed by spam messages collected at five honeypots. These collectors simulate vulnerable machines and lead spammers to believe they are interacting with legitimate open relays and proxies. Then we map IP-level traceroute measurements to AS-level paths and use the database of inter-network business relationships to infer the spam traffic costs. Our results show that stub networks are systematically subject to high spam traffic costs and that large ASes can receive twice with the spam traffic of the same message. Furthermore, we show that some networks profit from spam traffic and might not be interested in filtering spam; other networks, even paying for spam traffic, when they can foward these messages to their customers may not be interested in filtering them. Finally, we present a simple but effective algorithm to identify the networks that would benefit in cooperating to filter spam traffic at the origin to reduce transit costs.