English

Abstract

In this paper we aim to detect the compromised machines in a network that are involved in the spamming activities, widely known as spam zombies. Given that spamming provides a key economic incentive for attackers to recruit the large number of compromised machine, we develop a spam zombie detection system named SPOT by keeping track of outgoing messages in a network. SPOT is designed based on a powerful statistical tool called Sequential Probability Ratio Test (SPRT), which has bounded false positive and false negative error rates.