Measuring, Characterizing, and Avoiding Spam Traffic Costs

Abstract

Spam messages propagate malware, disseminate phishing exploits, and advertise illegal products. Those messages generate costs for users and network operators, but it's difficult to measure the costs associated with spam traffic and determine who actually pays for it. Here, the authors provide a method to quantify the transit costs of spam traffic, identifying the routes traversed by spam messages collected at five honeypots. Combining the volume of spam traffic with traceroute measurements and a database of internetwork business relationships, they show that stub networks are systematically subject to high spam traffic costs. They also show that some networks profit from spam traffic and might not be interested in filtering it. Finally, a simple-but-effective algorithm is presented to identify the networks that would benefit from cooperating to filter spam traffic at the origin, to reduce transit costs.