The DOI matches its Crossref record; 19 of the 19 references it cites were found in a registry or an index.
Spamming botnets: signatures and characteristics
Abstract
In this paper, we focus on characterizing spamming botnets by leveraging both spam payload and spam server traffic properties. Towards this goal, we developed a spam signature generation framework called AutoRE to detect botnet-based spam emails and botnet membership. AutoRE does not require pre-classified training data or white lists. Moreover, it outputs high quality regular expression signatures that can detect botnet spam with a low false positive rate. Using a three-month sample of emails from Hotmail, AutoRE successfully identified 7,721 botnet-based spam campaigns together with 340,050 unique botnet host IP addresses. Our in-depth analysis of the identified botnets revealed several interesting findings regarding the degree of email obfuscation, properties of botnet IP addresses, sending patterns, and their correlation with network scanning traffic. We believe these observations are useful information in the design of botnet detection schemes.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Uniform Resource Identifiers (URI): Generic Syntax
Berners-Lee, T., Fielding, R., & Masinter, L. (1998) · doi:10.17487/rfc2396 · Cited by 1,740
Polygraph: Automatically Generating Signatures for Polymorphic Worms
Newsome, J., Karp, B., & Song, D. (2005) · 2005 IEEE Symposium on Security and Privacy (S&P'05) · doi:10.1109/sp.2005.15 · Cited by 670
Replacing suffix trees with enhanced suffix arrays
Abouelhoda, M. I., Kurtz, S., & Ohlebusch, E. (2004) · Journal of Discrete Algorithms · doi:10.1016/s1570-8667(03)00065-0 · Cited by 668
A multifaceted approach to understanding the botnet phenomenon
Abu Rajab, M., Zarfoss, J., Monrose, F., & Terzis, A. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177086 · Cited by 595
Singh, S. R., Estan, C., Varghese, G., & Savage, S. (2004) · Cited by 525
Honeycomb: creating intrusion detection signatures using honeypots
Kreibich, C., & Crowcroft, J. (2004) · ACM SIGCOMM Computer Communication Review · doi:10.1145/972374.972384 · Cited by 523
Understanding the network-level behavior of spammers
Ramachandran, A., & Feamster, N. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159947 · Cited by 510
Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm
Holz, T., Steiner, M., Dahl, F., Biersack, E. W., & Freiling, F. (2008) · Cited by 383
Modeling Botnet Propagation Using Time Zones.
Dagon, D., Zou, C. C., & Lee, W. (2006) · Cited by 335
Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience
Li, Z., Sanghi, M., Yan, C., Kao, M., & Chavez, B. (2006) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2006.18 · Cited by 270
Cited by
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Cao, Q., Yang, X., Yu, J., & Palow, C. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660269 · Cited by 274
Detecting spammers and content promoters in online video social networks
Benevenuto, F., Rodrigues, T., Almeida, V., Almeida, J., & Gonçalves, M. (2009) · Proceedings of the 32nd international ACM SIGIR conference on Research and development in information retrieval · doi:10.1145/1571941.1572047 · Cited by 220
Combating disinformation in a social media age
Shu, K., Bhattacharjee, A., Alatawi, F., Nazer, T. H., Ding, K., Karami, M., & Liu, H. (2020) · WIREs Data Mining and Knowledge Discovery · doi:10.1002/widm.1385 · Cited by 198
Quit Playing Games with My Heart: Understanding Online Dating Scams
Huang, J., Stringhini, G., & Yong, P. (2015) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-20550-2_12 · Cited by 48
(2015)
Metadata
- Authors
- Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G., & Osipkov, I.
- Venue
- ACM SIGCOMM Computer Communication Review
- Published
- 2008-08-17
- Volume
- 38
- Issue
- 4
- Pages
- 171-182
- ISSN
- 0146-4833 (ISSN-L)
- OpenAlex
- W2112063328
- Cited by
- 339
- References
- 19
- FWCI
- 107.76
- Type
- journal article
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Spamming botnets: signatures and characteristics. https://app.cochat.ai/papers/10.1145/1402946.1402979
- The paper
- Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G., & Osipkov, I. (2008). Spamming botnets: signatures and characteristics. ACM SIGCOMM Computer Communication Review. https://doi.org/10.1145/1402946.1402979
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
