Identificação e caracterização de campanhas de spam a partir de honeypots

Abstract

This work presents a methodology for the characterization of spamming strategies based on the identification of spam campaigns. To deeply understand how spammers abuse network resources and obfuscate their messages, an aggregated analysis of spam messages is not enough. Grouping spam messages into campaigns is important to unveil behaviors that cannot be noticed when looking at the whole set of spams collected. We propose a spam identification technique based on a frequent pattern tree, which naturally captures the invariants on message content and detect messages that differ only due to obfuscated fragments. The technique was able to group 350 million messages into 57,851 distinct campaigns. After that, we characterize these campaigns both in terms of content obfuscation and exploitation of networkresources. Our methodology includes the use of attribute association analysis: by applying an association rule mining algorithm, we were able to determine co-occurrence of campaign attributes that unveil different spamming strategies. In particular, we found strong relationsbetween the origin of the spam and how the network was abused, between operating systems and types of abuse and patterns that describe how spammers chain machines over the Internetto conceal their identities. Data was collected from low-interaction honeypots emulating open proxies and open relays, traditionally abused by spammers. The data collected from these emulators created a vantage point of spams from inside the network, before the messages were delivered to recipients, and that allowed the determination of the different strategies adopted by spammers to deliver their messages.