Identifying spammers by their resource usage patterns

Kevin S. Xu, Mark Kliger, and Alfred O. Hero III

Most studies on spam thus far have focused on its content or source. These types of studies, however, reveal little about the behavioral characteristics of spammers. In addition, privacy issues may prevent wide access to email content. In this paper, we try to identify spammers by investigating their resource usage patterns. Specifically, we look at usage patterns of harvesters, the bots that are used to acquire email addresses, and spam servers, the email servers being used to send the spam emails. We perform spectral biclustering on both harvesters and servers to reveal groups of resources that are used together, which we believe correspond to individual spammers or groups of spammers. We make several interesting discoveries including a division into phishing and non-phishing spammers and a group of harvesters with highly correlated behavior that have IP addresses belonging to a rogue Internet service provider.

K. S. Xu, M. Kliger, A. O. Hero III, “Identifying spammers by their resource usage patterns,” Collaboration, Electronic Messaging, Anti-Abuse and Spam Conf. (CEAS), 2010. (.pdf)

The Cytoscape visualization shows the bicluster interaction network. Each bicluster is represented by two vertices: a circular vertex corresponding to a cluster of harvesters and a triangular vertex corresponding to a cluster of servers. The size of a vertex is representative of the number of harvesters or servers in that particular cluster, and the color of a vertex corresponds to the average phishing level of the harvesters or servers in the bicluster. Only the biclusters in the giant connected component (GCC) are displayed! In some months, such as March 2006, all of the phishing biclusters were disconnected from the GCC, so they are excluded from the visualization. The smaller connected components are, however, included in the contingency tables.

The contingency tables show the distribution of phishing and non-phishing harvesters and servers in phishing and non-phishing biclusters.

To request access to the code and data used in the analysis, please contact Kevin Xu at the address below.