Method and apparatus for detecting zombie-generated spam

• US 20080005316A1
• Filed: 06/30/2006
• Published: 01/03/2008
• Est. Priority Date: 06/30/2006
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Hansen, Tony, Feaver, John
• Granted Patent: US 8,775,521 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Disclosed is a method and system for detecting a zombie attack in a network having a plurality of computers. The method and system include a network analysis module for determining, for each computer, a working set of email addresses associated with emails sent by each computer. A zombie attack is detected by determining at least one of: 1) at least one computer in the plurality is transmitting more than a threshold rate of emails, 2) that at least one of the computers is transmitting more than a first threshold number of emails to email addresses outside of its associated working set, 3) that a first threshold number of computers in the plurality are transmitting email messages to email addresses outside of their associated working set, and 4) that more than a second threshold number of computers are transmitting more than a second threshold number of emails to a recipient computer.

Claims

1. A method for detecting a zombie attack in a network having a plurality of computers comprising:

determining, for each computer in said plurality of computers, a working set of email addresses associated with emails sent by said each computer; and

detecting a zombie attack by at least one of;

determining that at least one computer in said plurality of computers is transmitting more than a threshold rate of emails;

determining that at least one computer in said plurality of computers is transmitting more than a first threshold number of emails to email addresses outside of its associated working set,

determining that a first threshold number of computers in said plurality of computers are transmitting email messages to email addresses outside of their associated working set, and

determining that more than a second threshold number of computers are transmitting more than a second threshold number of emails to a recipient computer.

2. The method of claim 1 wherein said first threshold number of emails is equal to said second threshold number of emails.

3. The method of claim 1 wherein said first threshold number of computers is equal to said second threshold number of computers.

4. The method of claim 1 further comprising performing network analysis on said each computer to determine a list of email addresses associated with said each computer.

5. The method of claim 4 further comprising determining a working set for said each computer by determining to which email addresses in said list of email addresses said each computer sends email messages.

6. The method of claim 5 further comprising updating said working set.

7. A system for detecting a zombie attack in a network having a plurality of computers comprising:

a network analysis module configured to determine, for each computer in said plurality of computers, a working set of email addresses associated with emails sent by said each computer and configured to detect a zombie attack by at least one of;

determining that at least one computer in said plurality of computers is transmitting more than a threshold rate of emails;

determining that at least one computer in said plurality of computers is transmitting more than a first threshold number of emails to email addresses outside of its associated working set,

determining that more than a first threshold number of computers in said plurality of computers are transmitting email messages to email addresses outside of their associated working set, and

determining that more than a second threshold number of computers are transmitting more than a second threshold number of emails to a recipient computer.

8. The system of claim 7 wherein said first threshold number of emails is equal to said second threshold number of emails.

9. The system of claim 7 wherein said first threshold number of computers is equal to said second threshold number of computers.

10. The system of claim 7 wherein said network analysis module performs network analysis on said each computer in said plurality of computers to determine a list of email addresses associated with said each computer.

11. The system of claim 10 wherein said network analysis module determines said working set by determining to which email addresses in said list of email addresses said each computer sends email messages.

12. A system for detecting a zombie attack in a network having a plurality of computers comprising:

means for determining, for each computer in said plurality of computers, a working set of email addresses associated with emails sent by said each computer; and

means for detecting a zombie attack by at least one of;

means for determining that at least one computer in said plurality of computers is transmitting more than a threshold rate of emails;

means for determining that at least one computer in said plurality of computers is transmitting more than a first threshold number of emails to email addresses outside of its associated working set,

means for determining that a first threshold number of computers in said plurality of computers are transmitting email messages to email addresses outside of their associated working set, and

means for determining that more than a second threshold number of computers are transmitting more than a second threshold number of emails to a recipient computer.

13. The system of claim 12 wherein said first threshold number of emails is equal to said second threshold number of emails.

14. The system of claim 12 wherein said first threshold number of computers is equal to said second threshold number of computers.

15. The system of claim 12 further comprising means for performing network analysis on each computer to determine a list of email addresses associated with said each computer.

16. The system of claim 15 further comprising means for determining said working set by determining to which email addresses in said list of email addresses said each computer sends email messages.