Spamalytics: An empirical analysis of spam marketing conversion

Chris Kanich, Christian Kreibich, Kirill Levchenko, Brandon Enright, Geoffrey M. Voelker, Vern Paxson, Stefan Savage

Research output: Contribution to journalArticle

Abstract

The "conversion rate" of spam?the probability that an unsolicited email will ultimately elicit a "sale"?underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet?s infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing online pharmaceuticals. For nearly a half billion spam emails we identify the number that are successfully delivered, the number that pass through popular antispam filters, the number that elicit user visits to the advertised sites, and the number of "sales" and ?infections? produced.

Original languageEnglish (US)
Pages (from-to)99-107
Number of pages9
JournalCommunications of the ACM
Volume52
Issue number9
DOIs
StatePublished - Sep 1 2009
Externally publishedYes

Fingerprint

Electronic mail
Marketing
Sales
Infiltration
Drug products
Botnet
Malware

ASJC Scopus subject areas

  • Computer Science(all)

Cite this

Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G. M., Paxson, V., & Savage, S. (2009). Spamalytics: An empirical analysis of spam marketing conversion. Communications of the ACM, 52(9), 99-107. https://doi.org/10.1145/1562164.1562190

Spamalytics : An empirical analysis of spam marketing conversion. / Kanich, Chris; Kreibich, Christian; Levchenko, Kirill; Enright, Brandon; Voelker, Geoffrey M.; Paxson, Vern; Savage, Stefan.

In: Communications of the ACM, Vol. 52, No. 9, 01.09.2009, p. 99-107.

Research output: Contribution to journalArticle

Kanich, C, Kreibich, C, Levchenko, K, Enright, B, Voelker, GM, Paxson, V & Savage, S 2009, 'Spamalytics: An empirical analysis of spam marketing conversion', Communications of the ACM, vol. 52, no. 9, pp. 99-107. https://doi.org/10.1145/1562164.1562190
Kanich, Chris ; Kreibich, Christian ; Levchenko, Kirill ; Enright, Brandon ; Voelker, Geoffrey M. ; Paxson, Vern ; Savage, Stefan. / Spamalytics : An empirical analysis of spam marketing conversion. In: Communications of the ACM. 2009 ; Vol. 52, No. 9. pp. 99-107.
@article{b4fcdb0ced504c6195d0d6193146bd3c,
title = "Spamalytics: An empirical analysis of spam marketing conversion",
abstract = "The {"}conversion rate{"} of spam?the probability that an unsolicited email will ultimately elicit a {"}sale{"}?underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet?s infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing online pharmaceuticals. For nearly a half billion spam emails we identify the number that are successfully delivered, the number that pass through popular antispam filters, the number that elicit user visits to the advertised sites, and the number of {"}sales{"} and ?infections? produced.",
author = "Chris Kanich and Christian Kreibich and Kirill Levchenko and Brandon Enright and Voelker, {Geoffrey M.} and Vern Paxson and Stefan Savage",
year = "2009",
month = "9",
day = "1",
doi = "10.1145/1562164.1562190",
language = "English (US)",
volume = "52",
pages = "99--107",
journal = "Communications of the ACM",
issn = "0001-0782",
publisher = "Association for Computing Machinery (ACM)",
number = "9",

}

TY - JOUR

T1 - Spamalytics

T2 - An empirical analysis of spam marketing conversion

AU - Kanich, Chris

AU - Kreibich, Christian

AU - Levchenko, Kirill

AU - Enright, Brandon

AU - Voelker, Geoffrey M.

AU - Paxson, Vern

AU - Savage, Stefan

PY - 2009/9/1

Y1 - 2009/9/1

N2 - The "conversion rate" of spam?the probability that an unsolicited email will ultimately elicit a "sale"?underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet?s infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing online pharmaceuticals. For nearly a half billion spam emails we identify the number that are successfully delivered, the number that pass through popular antispam filters, the number that elicit user visits to the advertised sites, and the number of "sales" and ?infections? produced.

AB - The "conversion rate" of spam?the probability that an unsolicited email will ultimately elicit a "sale"?underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet?s infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing online pharmaceuticals. For nearly a half billion spam emails we identify the number that are successfully delivered, the number that pass through popular antispam filters, the number that elicit user visits to the advertised sites, and the number of "sales" and ?infections? produced.

UR - http://www.scopus.com/inward/record.url?scp=70149106104&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=70149106104&partnerID=8YFLogxK

U2 - 10.1145/1562164.1562190

DO - 10.1145/1562164.1562190

M3 - Article

AN - SCOPUS:70149106104

VL - 52

SP - 99

EP - 107

JO - Communications of the ACM

JF - Communications of the ACM

SN - 0001-0782

IS - 9

ER -