@conference {18614,
	title = {Wide-area routing dynamics of malicious networks},
	booktitle = {Proceedings of the ACM SIGCOMM 2011 conference},
	series = {SIGCOMM {\textquoteright}11},
	year = {2011},
	month = {2011///},
	pages = {432 - 433},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper studies the routing dynamics of malicious networks. We characterize the routing behavior of malicious networks on both short and long timescales. We find that malicious networks more consistently advertise prefixes with short durations and long inter- arrival times; over longer timescales, we find that malicious ASes connect with more upstream providers than legitimate ASes, and they also change upstream providers more frequently.},
	keywords = {BGP, Security, spam},
	isbn = {978-1-4503-0797-0},
	doi = {10.1145/2018436.2018505},
	url = {http://doi.acm.org/10.1145/2018436.2018505},
	author = {Konte,Maria and Feamster, Nick}
}
@conference {18570,
	title = {Filtering spam with behavioral blacklisting},
	booktitle = {Proceedings of the 14th ACM conference on Computer and communications security},
	series = {CCS {\textquoteright}07},
	year = {2007},
	month = {2007///},
	pages = {342 - 351},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Spam filters often use the reputation of an IP address (or IP address range) to classify email senders. This approach worked well when most spam originated from senders with fixed IP addresses, but spam today is also sent from IP addresses for which blacklist maintainers have outdated or inaccurate information (or no information at all). Spam campaigns also involve many senders, reducing the amount of spam any particular IP address sends to a single domain; this method allows spammers to stay "under the radar". The dynamism of any particular IP address begs for blacklisting techniques that automatically adapt as the senders of spam change. This paper presents SpamTracker, a spam filtering system that uses a new technique called behavioral blacklisting to classify email senders based on their sending behavior rather than their identity. Spammers cannot evade SpamTracker merely by using "fresh" IP addresses because blacklisting decisions are based on sending patterns, which tend to remain more invariant. SpamTracker uses fast clustering algorithms that react quickly to changes in sending patterns. We evaluate SpamTracker{\textquoteright}s ability to classify spammers using email logs for over 115 email domains; we find that SpamTracker can correctly classify many spammers missed by current filtering techniques. Although our current datasets prevent us from confirming SpamTracker{\textquoteright}s ability to completely distinguish spammers from legitimate senders, our evaluation shows that SpamTracker can identify a significant fraction of spammers that current IP-based blacklists miss. SpamTracker{\textquoteright}s ability to identify spammers before existing blacklists suggests that it can be used in conjunction with existing techniques (e.g., as an input to greylisting). SpamTracker is inherently distributed and can be easily replicated; incorporating it into existing email filtering infrastructures requires only small modifications to mail server configurations.},
	keywords = {blacklists, botnets, clustering, Security, spam},
	isbn = {978-1-59593-703-2},
	doi = {10.1145/1315245.1315288},
	url = {http://doi.acm.org/10.1145/1315245.1315288},
	author = {Ramachandran,Anirudh and Feamster, Nick and Vempala,Santosh}
}
@conference {18610,
	title = {Understanding the network-level behavior of spammers},
	booktitle = {Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications},
	series = {SIGCOMM {\textquoteright}06},
	year = {2006},
	month = {2006///},
	pages = {291 - 302},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper studies the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent across time each spamming host is, and characteristics of spamming botnets. We try to answer these questions by analyzing a 17-month trace of over 10 million spam messages collected at an Internet "spam sinkhole", and by correlating this data with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet "command and control" traces.We find that most spam is being sent from a few regions of IP address space, and that spammers appear to be using transient "bots" that send only a few pieces of email over very short periods of time. Finally, a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked prefixes. These trends suggest that developing algorithms to identify botnet membership, filtering email messages based on network-level properties (which are less variable than email content), and improving the security of the Internet routing infrastructure, may prove to be extremely effective for combating spam.},
	keywords = {BGP, botnet, network management, Security, spam},
	isbn = {1-59593-308-5},
	doi = {10.1145/1159913.1159947},
	url = {http://doi.acm.org/10.1145/1159913.1159947},
	author = {Ramachandran,Anirudh and Feamster, Nick}
}
