Georgia Tech Releases Research

ATLANTA -- A database of more than 10 million spam email messages collected at just one Internet “spam sinkhole” suggets that Internet service providers could better fight unwanted junk email by addressing it at the network level, rather than using currently available message content filters.

Also, the research – conducted at the Georgia Institute of Technology’s College of Computing -- identified two additional techniques for combating spam: improving the security of the Internet’s routing infrastructure and developing algorithms to identify computers’ membership in “botnets,” which are groups of computers that are compromised and controlled remotely to send large volumes of spam. The findings are now directing the researchers’ design of new systems to stem spam.

“Content filters are fighting a losing battle because it’s easier for spammers to simply change their content than for us to build spam filters.,” said Nick Feamster, a Georgia Tech assistant professor of computing. “We need another set of properties, not based on content. So what about network-level properties? It’s harder for spammers to change network-level properties.”

Feamster and his Ph.D. student Anirudh Ramachandran will present their findings on Sept. 14, 2006 in Pisa, Italy, at the Association for Computing Machinery’s annual flagship conference of its Special Interest Group on Data Communication (SIGCOMM).

From 18 months of Internet routing and spam data the researchers collected in one domain, they have learned which network-level properties are most promising for consideration in spam filter design. Specifically, they learned that:

Internet routes are being hijacked by spammers; they can identify many narrow ranges within Internet protocol (IP) address space that are generating only spam; and they can identify the Internet service providers (ISP) from which spam is coming.

“We know route hijacking is occurring,” Feamster said. “It’s being done by a small, but fairly persistent and sophisticated group of spammers, who cannot be traced using conventional methods.”

Route hijacking works like this: By exploiting weaknesses in Internet routing protocols, spammers can steal Internet address space by briefly advertising a route for that space to the rest of the Internet’s routers. The spammers can then assign any IP address within that address space to their machines. They send their spam from those machines and then withdraw the route by which they sent the spam. By the time a recipient files a complaint related to this IP address, the route is gone and the IP address space is no longer reachable.

“Even if you’re watching the hijack take place, it’s difficult to tell where it’s coming from,” Feamster explained. “We can make some good guesses. But Internet routing protocols are insecure, so it’s relatively easy for spammers to steal them and hard for us to identify the perpetrators.”

Georgia Institute of Technology