Detecting Spam Bots by Sequential Analysis of Encrypted Traffic

Abstract

Detecting spam bots which send spam by encrypted protocols is difficult because the transmitted content cannot be inspected. In this work, we present a detection method based on the sequential analysis method, sequential probability ratio test (SPRT). This method can detect high-profile spam bots as soon as possible, and also low-profile spam bots if they exist, from encrypted email traffic observed in the intervals of both hours and days. The ratio of email deliveries and receptions, and the number of email deliveries in the intervals serve as the detection features. The experiments were conducted based on the encrypted email traffic from the campus of National Chung Cheng University from February to April 2014. The false-positive rates of the detection method are all under 10% after verification.