Researchers from the Georgia Institute of Technology have discovered that addressing spam at the network level could be a more effective solution for Internet service providers than today's message content filters.

They've also developed algorithms that can detect when a computer is a member of a botnet, and also a technique for enforcing the security.

"Content filters are fighting a losing battle because it's easier for spammers to simply change their content than for us to build spam filters", explains Nick Feamster, an assistant professor in the Georgia Tech College. "We need another set of properties, not based on content. So what about network-level properties? It's harder for spammers to change network-level properties."

The research has been introduced a few days ago at the ACM SIGCOMM conference, in Pisa in Italy. The researchers spent one year and half collecting Internet routing and spam data from only one domain. They found that they can identify which Internet service providers are transmitting spam, as well as the narrow ranges of IP address that are only producing spam.

Spammers exploit vulnerabilities in Internet routing protocols, succeeding to assign their machines any IP address within that range. They then send spam from those machines and promptly withdraw the route. The IP address is no longer reachable, so the receiver cannot identify it.

Feamster hopes that his research will allow to make those protocols more secured and to improve the spam filtering.


Source: Georgia Research Tech News, two weeks ago.

For those who do not know:
Botnet is a jargon term for a collection of software robots, or bots, which run autonomously. This can also refer to the network of computers using distributed computing software. The word is generally used to refer to a collection of compromised machines running programs, usually referred to as worms, Trojan horses, or backdoors, under a common command and control infrastructure.