论文信息 - Dynamics of Online Scam Hosting Infrastructure

Dynamics of Online Scam Hosting Infrastructure

This paper studies the dynamics of scam hosting infrastructure, with an emphasis on the role of fast-flux service networks. By monitoring changes in DNS records of over 350 distinct spam-advertised domains collected from URLs in 115,000 spam emails received at a large spam sinkhole, we measure the rates and locations of remapping DNS records, and the rates at which "fresh" IP addresses are used. We find that, unlike the short-lived nature of the scams themselves, the infrastructure that hosts these scams has relatively persistent features that may ultimately assist detection.

[1] Felix C. Freiling,et al. Measuring and Detecting Fast-Flux Service Networks , 2008, NDSS.

[2] Stefan Savage,et al. Spamscatter: Characterizing Internet Scam Hosting Infrastructure , 2007, USENIX Security Symposium.

[3] Pavel Laskov,et al. Detection of Intrusions and Malware, and Vulnerability Assessment: 19th International Conference, DIMVA 2022, Cagliari, Italy, June 29 –July 1, 2022, Proceedings , 2022, International Conference on Detection of intrusions and malware, and vulnerability assessment.

[4] SpitznerLance. The Honeynet Project , 2003, S&P 2003.

[5] Wenke Lee,et al. Modeling Botnet Propagation Using Time Zones , 2006, NDSS.

[6] M. Goldszmidt,et al. How dynamic are IP addresses? , 2007, SIGCOMM '07.

[7] Zhuoqing Morley Mao,et al. Peeking into Spammer Behavior from a Unique Vantage Point , 2008, LEET.

[8] Andreas Terzis,et al. A multifaceted approach to understanding the botnet phenomenon , 2006, IMC '06.

[9] Lorenzo Martignoni,et al. FluXOR: Detecting and Monitoring Fast-Flux Service Networks , 2008, DIMVA.

[10] Duane Wessels,et al. Passive Monitoring of DNS Anomalies , 2007, DIMVA.

[11] Emil Sit,et al. An empirical study of spam traffic and the use of DNS black lists , 2004, IMC '04.

[12] Nick Feamster,et al. Understanding the network-level behavior of spammers , 2006, SIGCOMM.