Botnet Judo: Fighting Spam with Itself

摘要

We have traditionally viewed spam from the receiver'srnpoint of view: mail servers assaulted by a barrage of spamrnfrom which we must pick out a handful of legitimate messages.rnIn this paper we describe a system for better filteringrnspam by exploiting the vantage point of the spammer. Byrninstantiating and monitoring botnet hosts in a controlledrnenvironment, we are able to monitor new spam as it is created,rnand consequently infer the underlying template usedrnto generate polymorphic e-mail messages. We demonstraternthis approach on mail traces from a range of modern botnetsrnand show that we can automatically filter such spamrnprecisely and with virtually no false positives.