1. How dynamic are IP addresses? Yinglian Xie, Fang Yu, Kannan Achan, Eliot Gillum, Moises Goldszmidt, Ted Wobber SIGCOMM ‘07 Chulhyun Park 2007. 11. 09. chpark@mmlab.snu.ac.kr

2. 2 / 19 Contents  Introduction  Related work  UDMap algorithm  IP Dynamics  Spam and IP dynamics  Conclusion

3. 3 / 19 Introduction  Tracking host IP Malicious host identification Network forensic analysis  Basis - IP address are static! Is this true?

4. 4 / 19 Introduction  Motivation Lots of spam mail servers use dynamic IPs Blocking-based spam filtering system may not be efficient  Purpose of UDMap Quantify the IP dynamics Automatic method for obtaining IP dynamics

5. 5 / 19 Related work  UDMap is the first attemption to automatically detect dynamic IPs  Reverse DNS Maps IP address to host domain name From the domain name, guess the static/dynamic state of the IP address  Dynablock Database of dialup user lists

6. 6 / 19 UDMap Algorithm  Definition IP dynamics  Dynamic behavior of the mapping between IP and a host over time IP volatility  Rate of IP is assigned to different hosts  Input IP addresses Persistent identification for hosts

7. 7 / 19 UDMap : Multi-User IP Block selection  Rule 1 A block of IP must belong to the same AS and same prefix  Rule 2 Size of block should be bigger than a specific size  Rule 3 A block must have no gaps  Gap : continuous IPs in a block, which is neither observed in the input data, nor used a single hotmail user

8. 8 / 19 UDMap : IP Usage-Entropy Computation  Multiple users with the same IP Dynamic IP assigned to multiple users over time Host with static IP is shared by multiple users  If the IP is dynamic IP, then users of that IP will use another dynamic IPs over time

9. 9 / 19 UDMap : IP Usage-Entropy Computation  Normalized usage-entropy close to 1 : That IP address is a dynamic IP

10. 10 / 19 UDMap : Dynamic IP block identification  Divide block into sub-blocks Pick a sub-block of addresses with larger usage-entropies than a threshold

11. 11 / 19 UDMap : Volatility estimation and proxy removal  Estimate frequency at which host identity changes with respect to an IP # of Hotmail users that have used this address in input data Average Hotmail inter-user duration between two users using the same IP  Removes two false-positive Proxies Internet café case

12. 12 / 19 UDMap Validation : UDMap IP blocks  Input 250 million hotmail users 155 million IP addresses (span over 20,167 ASes)  UDMap returned 102 million addresses, and 95 million addresses are in the data 61.4% of addresses are dynamic IPs

13. 13 / 19 UDMap Validation : Validation  Validation of UDMap result with reverse DNS Dynablock database

14. 14 / 19 Understanding IP dynamics  Relatively small region occupies large portion of dynamic addresses

15. 15 / 19 Understanding IP dynamics  Only 20% of dynamic IPs are used by a single user

16. 16 / 19 Understanding IP dynamics  Dynamic IP assignment Dialup user > DSL user > Cable modem user

17. 17 / 19 IP Dynamics and SPAM detection  Two categories of email server IPs Identified dynamic (by Dynablock or UDMap) Likely static  Distribution over IP address space, two categories looks similar Filtering by address range may be inefficient

18. 18 / 19 IP Dynamics and SPAM detection  92% of emails from dynamic IPs are spam! 95% of sessions from UDMap IP used to send spam ONLY

19. 19 / 19 Conclusion  Understanding IP dynamics can be helpful against spam email servers Most of spam email servers are using dynamic IPs  UDMap is a first automatic tool for tracking IP dynamics