A Behavior-Based Detection Approach to Mass-Mailing Host

Mass-mailing threats have made a serious impact on the Internet. These junk mails consume valuable network resources and possibly are used as carriers for virus/worms, trojans, phishing and DDoS attacks. Through an analysis of a number of mass-mailing spams collected from ISPs (Internet Service Provider), this paper is focused on fundamental mailing behaviors and mail header of mass-mailing spam, it also puts forward a new approach to detecting abnormal host by mining mailing traffic data using the theory of decision trees. The approach can suppress and stop distribution of mass-mailing threats on the Internet. The experiment to apply it to mailing traffic data captured at ISPs indicates that the accuracy rate can be 99% with this approach.