Detecting Spam Bots by Sequential Analysis of Encrypted Traffic

10.6138/JIT.2016.17.6.20150603e

Po-Ching Lin；Chi-Fang Chen；Pin-Ren Chiou

Spam bot ； Encrypted email traffic ； Sequential analysis ； Hypothesis testing

網際網路技術學刊

17卷6期（2016 / 11 / 01）

1279 - 1286

英文

Detecting spam bots which send spam by encrypted protocols is difficult because the transmitted content cannot be inspected. In this work, we present a detection method based on the sequential analysis method, sequential probability ratio test (SPRT). This method can detect high-profile spam bots as soon as possible, and also low-profile spam bots if they exist, from encrypted email traffic observed in the intervals of both hours and days. The ratio of email deliveries and receptions, and the number of email deliveries in the intervals serve as the detection features. The experiments were conducted based on the encrypted email traffic from the campus of National Chung Cheng University from February to April 2014. The false-positive rates of the detection method are all under 10% after verification.