Research Detects Spamming Attacks
10
2,009
By Grace V. Jean and Sandra I. Erwin
Researchers at Microsoft have developed a system to detect botnet attacks on Web email providers.
Botnets are composed of computers that have been taken over by an entity without the owner’s knowledge. These “zombie” computers are then commandeered to attack other computers and servers. Spamming botnets sign up for numerous Web site-based email accounts and then log in to send spam.
New software called BotGraph harnesses cloud-computing models and a graph-based approach to detect malicious activity spawned by spamming botnets. To catch them, BotGraph examines user activity logs of email accounts and produces large-scale graphs that assist in differentiating legitimate users from fake users.
“We looked at the graphs to analyze the similarities between the users. Each botnet-created fake user account in this graph will look very connected to each other,” says Fang Yu, one of the researchers on the Silicon Valley-based Microsoft team.
Legitimate account holders’ activities are spontaneous and usually are not correlated with other accounts.
“You would very rarely find a large number of users who at the same time would all log in from the same computer,” explains researcher Yinglian Xie. Botnet-created accounts, however, sign in simultaneously from the same IP address.
The team applied BotGraph to two months of Hotmail logs containing more than 500 million users and 440 gigabytes of data. The system identified more than 26 million botnet-created user accounts with a false-positive rate of 0.44 percent.