Spam, or unsolicited junk email, is a problem experienced by many customers of an Internet Service Provider (ISP). Often, spam is sent from so-called “zombie” computers, which are personal computers that are under the control of another controlling computer. It is often extremely difficult for an ISP to detect when spam is being generated by a zombie computer.
As described above, a spammer typically uses a controller computer to execute a program called a daemon. The daemon executes in the background unknown to the user of the zombie computer and “steals” the computer's resources. A controller transmits this daemon to one or more zombie computers via an email attachment or over a network.
Each master computer 110, 112 communicates with and controls one or more zombie computers. The master and zombie computers are typical computers executing typical software applications. For example, the first master computer 110 communicates with a first zombie computer 114, a second zombie computer 116, and a third zombie computer 118. The second master computer 112 communicates with the second zombie computer 116, the third zombie computer 118, and a fourth zombie computer 120. The controller 104 then communicates with the master computers 110, 112 (either directly or through a chain of other hosts that the spammer has compromised) and orders the daemons to send spam to particular email addresses.
Although
The network analysis module 204 creates a working set for each computer in a particular network hosted by an ISP in step 300. The network analysis module 204 may associate a working set with a computer by downloading the working set onto the computer. Alternatively, the network analysis module 204 relates a working set to a computer, such as by creating a record in the working set identifying the computer that the working set is associated with.
In accordance with one aspect of the present invention, the network analysis module 204 uses the working set to detect zombie computers. There are typically three checks performed by the network analysis module 204 to determine whether spam is being sent using zombie computers (i.e., a zombie attack).
The first check occurs when the network analysis module 204 determines whether one or more computers start transmitting many email messages outside of their associated working set (i.e., a zombie spew attack). In one embodiment, the network analysis module 204 determines whether more than a first threshold number of email messages are being transmitted from a zombie computer 208, 212, 216, 220 to addresses outside of the working set associated with the first zombie computer 208 in step 304. If so, then the network analysis module 204 determines that a zombie attack is occurring in step 308.
If not, the network analysis module 204 performs its second check on the zombie computers 208-220. The second check is determining whether there are more than a first threshold number of computers transmitting email messages to addresses outside of the computers' associated working set (i.e., a zombie trickle attack) in step 312. Several users emailing messages to addresses outside of their working set periodically is usually a normal occurrence. If, however, the network analysis module 204 determines that a large number of computers that do not normally send emails to addresses outside of their working set suddenly send such emails, the network analysis module 204 determines that a zombie attack (i.e., a zombie trickle attack) is occurring in step 308.
If the network analysis module 204 determines that the second check is not occurring, the network analysis module 204 then continues with a third check. The third check is determining whether more than a second threshold number of computers are transmitting more than a second threshold number of email messages to the same recipient computer (i.e., a Distributed Denial of Service (DDoS) attack) in step 316. Specifically, the daemons of the zombie computers work together and launch a distributed denial of service (DDoS) attack, flooding a targeted computer with packets in an attempt to cripple the computer's operation. If the network analysis module 204 detects that more than a second threshold number of computers are transmitting more than a second threshold number of email messages to the same recipient computer, the network analysis module 204 determines that a zombie attack is occurring in step 308. If not, then the network analysis module 204 has not detected a zombie attack in step 320.
The first threshold number of computers may or may not be related to the second threshold number of computers. In one embodiment, the first threshold is the same as the second threshold. Alternatively, they are different and/or unrelated. Similarly, the first threshold number of email messages may be related to (e.g., the same as) or unrelated to (e.g., different than) the second threshold number of email addresses.
The network analysis module 204 can be located in any position in the network so long as the network analysis module 204 can analyze the communications being transmitted from and being sent to one or more computers in the network 200. Different levels of support are possible, depending on whether the network analysis module 204 is examining the messages sent or the messages sent and received. In one embodiment, there are the following levels of support possible by the network analysis module 204: 1) examining the rates of messages sent, 2) examining the messages sent outside of the users' working sets, and 3) using the messages sent to the users to further define those working sets. Further, any number of network analysis modules can be used in the network 200 to detect a zombie attack.
The previous description describes the present invention in terms of the processing steps required to implement an embodiment of the invention. These steps may be performed by an appropriately programmed computer, the configuration of which is well known in the art. An appropriate computer may be implemented, for example, using well known computer processors, memory units, storage devices, computer software, and other nodes. A high level block diagram of such a computer is shown in
One skilled in the art will recognize that an implementation of an actual computer will contain other nodes as well, and that
The foregoing Detailed Description is to be understood as being in every respect illustrative and exemplary, but not restrictive, and the scope of the invention disclosed herein is not to be determined from the Detailed Description, but rather from the claims as interpreted according to the full breadth permitted by the patent laws. It is to be understood that the embodiments shown and described herein are only illustrative of the principles of the present invention and that various modifications may be implemented by those skilled in the art without departing from the scope and spirit of the invention. Those skilled in the art could implement various other feature combinations without departing from the scope and spirit of the invention.