• Review of KIISC
• /
• v.22 no.8
• /
• pp.7-14
• /
• 2012

이메일 스팸메일의 대부분은 악성코드에 감염된 좀비PC에 의해 발송된다. '11년 시만텍 보고서에 따르면 한국발 좀비PC에 의한 스팸메일 발송이 세계 1위를 차지했으며, '12년에도 상위수준을 유지하고 있다. 본 논문에서는 이메일의 패턴 분석을 통해 좀비PC 및 같은 공격명령을 받은 봇넷그룹을 자동으로 탐지하는 시스템을 개발하고, 이를 통해 산출된 다양한 데이터에 대한 분석결과를 제시한다. 좀비PC 및 봇넷그룹 탐지결과는 스팸메일 차단기술로 활용 가능할 뿐 아니라, 악성코드 유포동향 파악 등 다양한 목적의 분석에 활용 가능하다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.3
• /
• pp.101-115
• /
• 2011

A botnet is a huge network of hacked zombie PCs. Recognizing the fact that the majority of email spam is sent out by botnets, a system that is capable of detecting botnets and zombie PCS will be designed in this study by analyzing email spam. In this study, spam data collected in "an email spam trail system", Korea's national spam collection system, were used for analysis. In this study, we classified the spam groups by the URLs or attached files, and we measured how much the group has the characteristics of botnet and how much the IPs have the characteristics of zombie PC. Through the simulation result in this study, we could extract 16,030 zombie suspected PCs for one hours and it was verified that email spam can provide considerably useful information in tracing zombie PCs.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.12 no.10
• /
• pp.1808-1814
• /
• 2008

In addition to RBL function, which is used to applying for spam e-mail filtering, as an effective way to deal with the recently widespread spam types, this paper proposes how to extract URL that was comprised in the original e-mail, apply it to RBL, and expand it. The BotNet, which is used to using for sending spam mails these days, has a problem that it is not able to solve with the distributed addresses of sent mails in spam e-mails. In general, as these spam e-mails are sent from the infected Zombi PC of individual user, the sent address itself is not efficient and is meaningless to use in RBL. As an effective way to filter spam e-mail sent by BotNet, this paper analyzes URLs that contained in the original spam e-mail and proposes how to effectively improve filter rate, based on the distribution data of URL site tempting users. This paper proposes the sending mechanism of spam e-mails from BotNet and the methods to realize those types of spam e-mails. In order to gather analyzable spam e-mails, this paper also carries out an experiment by configuring trap system of spam e-mail. By analyzing spam e-mails, which have been received during the certain period of experiment, this paper shows that the expanded RBL method, using URLs that contained in spam e-mails, is effective way to improve the filter distribution of spam e-mail.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.11a
• /
• pp.800-803
• /
• 2013

이메일을 기반으로 좀비PC 및 봇넷그룹을 탐지하는 알고리즘은 기존에 연구가 되었으나, 기존의 검증방식은 가상의 메일계정을 이용해 스팸메일을 수집하는 스팸트랩 시스템에서 추출한 이메일을 대상으로 하였다. 본 논문에서는 상용환경의 이메일을 대상으로 좀비PC를 탐지하고, 좀비PC를 이용한 추가 사이버 공격을 예방하기 위해 기존의 알고리즘을 보완하고, 이에 대한 좀비PC 탐지결과를 분석한다. 이를 통해, 주요 포탈 및 기업의 메일서버에서 수신하는 이메일을 대상으로 좀비IP를 탐지하여, 스팸메일을 차단하고 ISP와 연계하여 실제 조치를 유도할 수 있을 것으로 기대한다.