TY - GEN
T1 - Spam mail discrimination system based on behavior of DNS servers associated with URLs
AU - Suwa, Shuji
AU - Yamai, Nariyoshi
AU - Okayama, Kiyohiko
AU - Nakamura, Motonori
AU - Kawano, Keita
AU - Gada,
PY - 2012
Y1 - 2012
N2 - As one of anti-spam technologies, DNSBL based on the URLs or their corresponding IP addresses in the messages is well used. However, some spam mails cannot be filtered by conventional DNSBLs since the spammers create websites using various techniques such as botnet, fast-flux and Wildcard DNS record. To discriminate such spam mails, we ananalyzed DNS record characteristics corresponding to the domain name in the URLs in actual spam mails. According to this analysis, in this paper we propose a spam mail discrimination system based on the behavior of DNS servers. Since the behavior checking process is likely to wait for a timeout, the system queries some records to a DNS server simultaneously and decides whether the mail is spam or not on receiving the first reply. In addition, the system also introduces a blacklist for the IP addresses of the DNS servers.
AB - As one of anti-spam technologies, DNSBL based on the URLs or their corresponding IP addresses in the messages is well used. However, some spam mails cannot be filtered by conventional DNSBLs since the spammers create websites using various techniques such as botnet, fast-flux and Wildcard DNS record. To discriminate such spam mails, we ananalyzed DNS record characteristics corresponding to the domain name in the URLs in actual spam mails. According to this analysis, in this paper we propose a spam mail discrimination system based on the behavior of DNS servers. Since the behavior checking process is likely to wait for a timeout, the system queries some records to a DNS server simultaneously and decides whether the mail is spam or not on receiving the first reply. In addition, the system also introduces a blacklist for the IP addresses of the DNS servers.
KW - DNS
KW - URL
KW - e-mail
KW - spam
UR - http://www.scopus.com/inward/record.url?scp=84867976210&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84867976210&partnerID=8YFLogxK
U2 - 10.1109/SAINT.2012.68
DO - 10.1109/SAINT.2012.68
M3 - Conference contribution
AN - SCOPUS:84867976210
SN - 9780769547374
T3 - Proceedings - 2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet, SAINT 2012
SP - 381
EP - 386
BT - Proceedings - 2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet, SAINT 2012
T2 - 2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet, SAINT 2012
Y2 - 16 July 2012 through 20 July 2012
ER -