Internet bad neighborhoods

A significant part of current attacks on the Internet comes from compromised hosts that, usually, take part in botnets.

Even though bots themselves can be distributed all over the world, there is evidence that most of the malicious hosts are, in fact, concentrated in small fractions of the IP address space, on certain networks.

Based on that, the Bad Neighborhood concept was introduced. The general idea is to rate a subnetwork by the number of malicious hosts that have been observed in that subnetwork.

Even though Bad Neighborhoods were successfully employed in mail filtering, the very concept was not investigated in further details. This work provides a closer look on it, by proposing four definitions for spam-based Bad Neighborhoods that take into account the way spammers operate.

The authors apply the definitions to real world data sets and show that they provide insight into the behavior of spammers and the networks hosting them. Among other findings, the paper shows that 10% of the Bad Neighborhoods are responsible for the majority of spam.

The complete paper by Giovane C. M. Moura, Ramin Sadre, and Aiko Pras is available here.