《异常SMTP讯务与EmailSpam的自动通告课件.ppt》由会员分享，可在线阅读，更多相关《异常SMTP讯务与EmailSpam的自动通告课件.ppt（52页珍藏版）》请在三一办公上搜索。
1、1,異常SMTP訊務與Email Spam的自動通告,中央大學 電算中心 楊素秋 Email:center7cc.ncu.edu.tw,2,大 綱,1.研究動機2.異常SMTP訊務的監測3.Spam與異常SMTP訊務的相關 4.Spam 事件的自動通告5.結論,3,1.研究動機,加速 Email Spam 通告 IP 管理資訊查詢區網 Routing Table RWhois查詢服務Spam event 的自動通告異常SMTP訊務的監測Flow count 超量Packet Density分析超量SMTP傳訊主機與通告spam relay/sender 的相關,4,2.SMTP與 Spam傳訊
2、,SMTP 傳輸Client詢問DNS MX list,建立信件delivery route紀錄sender與receiver間的多個mail relay/server將 reverse-path加入mail header與SMTP relay建立雙向連接,沿SMTP route傳送信件relay收進信件後與下一relay 建立連接/轉送信件.最後的deliver relay將信件分送到用戶mailbox.,5,SpamUCE(Unsolicited Commercial Mail)spammer利用自動搜尋程式持續尋找 newsgroup(BBS boards)Join mailing li
3、st網頁的mail addresses所侵入系統的mail accountRegular sequence mail account重複/密集寄送廣告信件,6,Spammer以最低的成本,透過全球網路傳送超大量廣告信Internet用戶花費可觀的連線費用,時間與精力下載/收取/刪除大量spam.ISP耗費更龐大的網路與系統資源重複傳送junk mails影響mail的正常收送,7,為避免回覆大量的spam complainSpammer藉由自動搜尋程式尋找未設防的SMTP server 作為spam relay/sender傳送廣告信件往蒐集的newsgroup/mailing list及ma
4、il accountsGuess Receipts甚至透過mail夾檔散播病蟲或攻擊程式侵入網路主機.集結更大量的感染主機寄發/轉送更大量的spam.,8,減緩Spam倍數成長的主要途徑(1)回報/檢舉Spam event減少一個 spam relay/sender減少millions of spam(2)監測可能的spammer主機及訊務SMTP訊務量測篩選異常訊務量,9,回報/檢舉Spam event連網中心建立abuse Email帳號abusedomain,spamdomain,securitydomain接受所轄IP主機的Spam/Junk通告信.網路用戶依據spam route,萃
5、取發送主機與relay servers“Received:”,“From:”紀錄項回應給發信主機與relay server擁有者Report給spam report siteEX:,10,偵測可能的spammer主機及訊務依據Spam 傳訊特徵,實作異常SMTP訊務的統計High frequentlyObviously high SMTP connection countRepeatedly last for several hours協助管理者監測異常的mail訊務據以Check/var/log/maillog據以Check user mailbox 預先發現感染主機,通告用戶修補漏洞,11
6、,通告的Email Spam(2003年 7月至 11月)桃園區網每月處理的Spam mail通告主機總數.主要的abuse通告信件S 通報廣告郵件的 relay server/sendermyNetWatch 通報CodeRed/Nimda感染主機(80/TCP)SYN Flooding(445/TCP,17300/TCP,)環球或派拉蒙製片通告侵犯智財權的eDonkey主機及其影片檔存放 Others,12,Table 1 通告的區網Abuse主機數分布,13,3異常SMTP訊務的監測,異常SMTP訊務的監測Spam傳訊特徵FrequentlyObviously high frequenc
7、y of SMTP connectionsRepeatedlyLast for Many hours(Mean Packet Size)Little than 100 Bytes per PacktMore than 100 Bytes per packet,14,Transportation Traffic Logs all network operators depend on the quantifiable traffic log data to evaluate the network performanceTCPDUMPNetFlow,sFlowOthers,15,Tcpdumpa
8、 raw packet capture program.Gather the layer 4 transportation traffic logs throughThe dump transport traffic logs involved the detail fields of each IP packet headersource/destination IP addresses,source/destination application ports,protocol identity,number of packets,number of bytes,TCP operators,
9、16,Netflow router 轉送訊務紀錄Flow-based layer 4 transport traffic logSource&destination IP addressSource&destination application port Source&destination interface#protocol identifierpacket countbyte count,17,利用Netflow log統計區網的異常SMTP訊務Accumulate SMTP serv_flow connection counts statisticsNetflowlog gather
10、ed from router of aggregate networkThreshold_100_flowLess than 100 connections:99.72%More than 100 connections:0.28%Threshold_30_flowLess than 30 connections:98.61%,18,Table 2.區網的SMTP Flows 特徵項分布,19,SMTP訊務的統計/監測Monitor Abnormal SMTP Traffic of smtp_flowiCombine Several NetFlow features SMTP service
11、port&Src_IP&Dst_IPsrc_IPdst_IP.(25)src_IP.(25)dst_IP,20,統計/監測異常的 SMTP 訊務累計SMTP 訊務變量透過 IP protocol_id&application port的比對,累計 flowsmtp_flowipktsmtp_flowibytesmtp_flowi排序/篩選超量的syn_flows訊務Monitoring SMTP TrafficPHP+Apache,21,22,23,24,Nov 3 20:25:58 smtp3 sendmail7645:ID 801593 mail.info hA3CPot1007645:f
12、rom=,size=64607,class=0,nrcpts=1,msgid=,proto=SMTP,daemon=MTA,relay=163.25.154.253Nov 3 20:25:58 smtp3 sendmail7645:ID 801593 mail.info hA3CPot1007645:to=,delay=00:00:06,mailer=relay,pri=30258,stat=queuedNov 3 20:26:45 smtp3 mailscanner3948:Virus W32/Yaha-P found infile./hA3CPot1007645/disney.zip/DO
13、CUME1DennisLOCALS1Tempsetup.exeNov 3 20:26:51 smtp3 sendmail7958:ID 801593 mail.info hA3CPot1007645:to=,delay=00:00:59,xdelay=00:00:00,mailer=relay,pri=120258,relay=140.115.17.89 140.115.17.89,dsn=2.0.0,stat=Sent(hA3CP8k1016181 Message accepted for delivery)Nov 3 20:27:00 smtp3 mailscanner3948:Virus
14、 W32/Yaha-P found infile./hA3CPot1007645/disney.zip/DOCUME1DennisLOCALS1Tempsetup.exe,25,26,27,syslog:Oct 26 08:24:25 smtp3 sendmail13433:ID 801593 mail.info h9Q0ON2a013433:from=,size=6998,class=0,nrcpts=1,sgid=,proto=SMTP,daemon=MTA,relay=216.22.24.81(may be forged)syslog:Oct 26 08:24:25 smtp3 send
15、mail13425:ID 801593 mail.info h9Q0ON2a013425:from=,size=6994,class=0,nrcpts=1,sgid=,proto=SMTP,daemon=MTA,relay=216.22.24.85(may be forged)syslog:Oct 26 08:24:25 smtp3 sendmail13435:ID 801593 mail.info h9Q0ON2a013435:from=,size=6971,class=0,nrcpts=1,sgid=,proto=SMTP,daemon=MTA,relay=216.22.24.81(may
16、 be forged)syslog:Oct 26 08:24:25 smtp3 sendmail13432:ID 801593 mail.info h9Q0ON2a013432:from=,size=6995,class=0,nrcpts=1,sgid=,proto=SMTP,daemon=MTA,relay=216.22.24.84(may be forged)syslog:Oct 26 08:24:25 smtp3 sendmail13434:ID 801593 mail.info h9Q0ON2a013434:from=,size=6965,class=0,nrcpts=1,28,Mai
17、l Relay Testing,mrtftp:/v test.patterns test.message host_ip_add,29,30,ann#./mrt-v./test.patterns./test.message 163.25.121.245mrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.1
18、21.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connec
19、tion refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245
20、:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refusedmrt:163.25.121.245:Error connecting:Connection refused,31,ann#./mrt-v./test.patterns./test.message 163.25.70.1mrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:
21、163.25.70.1:SMTP error(553)reading MAIL responsemrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acce
22、ptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:Message acceptedmrt:163.25.70.1:SMTP error(553)reading MAIL response,32,ann#./mrt-v./test.patterns./test.message 140.115.17.128mrt:140.115.17.128:SMTP e
23、rror(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT res
24、ponsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(553)reading RCPT responsemrt:140.115.17.128:SMTP error(553)reading RCPT responsemrt:140.115.17.128:SMTP error(553)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:S
25、MTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCPT responsemrt:140.115.17.128:SMTP error(550)reading RCP
26、T response,33,數據分析,More than 70%通告spam relay/sender可由統計的異常SMTP主機佇列中篩選得異常SMTP/SYN Flooding訊務監測發現Spam&網路侵擾訊務,34,Table 2 區網Abuse host分布(2003年),35,4 Spam 事件的自動通告,Spam/攻擊訊務通告事件倍數成長的spam 通告超量的異常 SMTP Traffic 網路管理者非常依賴IP管理資訊查詢系統通告感染主機用戶與管理者,修補系統自動阻斷攻擊訊務,防堵攻擊訊務的持續擴散,36,spam mail的自動通告系統自動Query IP管理資訊,Email通告
27、藉由SNMP pulling router ipRoute MIB,快速萃取連網的龐大 routing資訊建立IP管理資訊查詢服務依據 NextHop integrate The extracted Routing Table連線單位通訊資訊檔RWhois IP管理資料庫,37,ipRoute SNMP MIB儲存連網單位的routing 資訊Network address NetMask辨識號.1.3.6.1.4.21.2.1.11NextHop 辨識號.1.3.6.1.4.21.2.1.7Mansfield G.曾藉由ipRoute MIB重複搜尋各層routers ipRoute MIB
28、 自動構建區域網路拓樸,38,重複萃取網段IP位址與對應的NetMask/NextHop位址分別以IP網段位址index,儲存NetMask ListNextHop List.結合NetMask,NextHop 與Segment佇列快速重建龐大的區網ip_routing 紀錄存檔,39,ipRouteMask OIDip.ipRouteTable.ipRouteEntry.ipRouteMask.192.192.40.0=IpAddress:255.255.252.0ip.ipRouteTable.ipRouteEntry.ipRouteMask.192.192.44.0=IpAddress:
29、255.255.255.0ip.ipRouteTable.ipRouteEntry.ipRouteMask.192.192.45.0=IpAddress:255.255.255.0ip.ipRouteTable.ipRouteEntry.ipRouteMask.192.192.46.0=IpAddress:255.255.255.0ipRouteNextHop OID ip.ipRouteTable.ipRouteEntry.ipRouteNextHop.192.192.40.0=IpAddress:203.71.2.72ip.ipRouteTable.ipRouteEntry.ipRoute
30、NextHop.192.192.44.0=IpAddress:192.83.175.111ip.ipRouteTable.ipRouteEntry.ipRouteNextHop.192.192.45.0=IpAddress:192.83.175.116ip.ipRouteTable.ipRouteEntry.ipRouteNextHop.192.192.46.0=IpAddress:192.83.175.111,40,NextHop Dest.Netmask Seg=203.72.244.226,140.115.0.0,255.255.0.0,256 203.71.2.5,140.132.0.
31、0,255.255.0.0,256 203.71.2.61,140.135.0.0,255.255.0.0,256 203.71.2.237,140.138.0.0,255.255.0.0,256203.71.2.209,192.192.40.0,255.255.252.0,4203.71.2.209,203.68.52.0,255.255.252.0,4,41,IP邏輯位址不包含任何管理資訊Router藉由routing table的查詢依據 NextHop 紀錄 switch packetSwitch 往正確的 routing interface,42,RWhois分享軟體利用Mark K
32、ostersDataBase(MKDB)支援資料的管理與查詢.資料庫查詢伺服程式rwhoisd資料庫建置程式rwhoisd_indexer,43,RWhois Server藉由IP管理資料庫伺服系統的建置,作為自動通告Spam 的基礎.讀取routing紀錄,依據Nexthop 紀錄比對/萃取對應的管理聯絡資訊檔構建RWhois network schema關聯紀錄檔建立資料庫indexing,提供管理資訊 query網頁.,44,選取的Network schema特徵IP-Network(網段位址)Admin-Contact(管理人員)Address(街道地址)Tel(聯絡電話)Update
33、d-By(資料建立者)Updated(資料建立日期,45,46,47,Sendmail最普遍使用的電子郵件傳送程式Mail server 藉由sendmail daemon 接受 mail client連接要求輾轉發送mail到 destination mail server接收送達的user mail,並轉存到user mail-box 存成/var/mail/user_name檔.,48,自動化的Spam通告程序讀取/var/mail/abuse buffer 檔依據“From“萃取各單封的mail存檔.parsing信件內容,萃取攻擊IP位址.自動連線RWhois server,查詢IP
34、管理資訊.依據IP管理資訊,將萃取的信件內容檔轉送給管理員/用戶mail,49,50,攻擊訊務的自動阻絕與通告,周期地篩選超量攻擊訊務,萃取攻擊主機IP依據主機IP,自動連線RWhois server,查詢管理資訊.依據管理資訊,遠端設定區網 router限制攻擊主機傳訊,防止超量攻擊訊務的擴散連接RWhois 查詢伺服主機,查詢管理資訊自動發信通知管理人員/用戶協助修補感染的系統,排除攻擊訊務起源.,51,5.結語,異常 SMTP/www DoS訊務的統計檢測感染主機及Spam senders主動遏止SMTP干擾訊務.Spam/攻擊事件自動通告機制提升spam的通告效率減輕網路管理者處理大量抱怨信的負荷,52,教育網路用戶提升 mail server被冒用的警覺性加強異常網路訊務的監測PING Storm,SYN Flooding,Spam relay分享網路攻擊模式與防堵經驗,
