A Novel Approach to Detect Spam Worms Propagation with Monitoring the Footprinting

Abstract

One of the key security threats on the Internet are the compromised machines that can be used to launch various security attacks such as spamming and spreading malware, accessing useful information and DDoS. Attackers for spamming activity are volunteer by large number of compromised machines. Our main focus is on detection of the compromised machines in a network that may be or are involved in the spamming activities; these machines are commonly known as spam zombies. Activities such as port scan, DB scan and so on are treated as malicious activity within the network. So to overcome that we develop one of the most effective spam zombie detection system within the network based on the behavior of other systems as if performing the above activities are treated as zombies machines. If any system within the network try's to gather some information about any other system then this is treated as a malicious activity and should be not allowed to do so. SYN packets are used in order to initiate communication within the network so as to establish connection. If any system try's to flood the network with these packets we can make an assumption that the system is trying to gather the information about other system. This is what called footprinting. So we will try to detect any system involved in footprinting and report to the administrator.