A Game Theoretic Model and Empirical Analysis of
Spammer Strategies
Manoj Parameswaran
Santa Clara University
Santa Clara, CA 95053
manoj.pc@gmail.com
Huaxia Rui
University of Texas at Austin
Austin, TX 78712
ruihuaxia@mail.utexas.edu
Serpil Sayın
∗
Koç University
Sariyer, Istanbul, Turkey
ssayin@ku.edu.tr
ABSTRACT
Network security problems are deteriorating worldwide, and
can potentially undermine the growth of the digital economy
and imperil the multitude of innovations that have been a
significant driver of economic growth as well as providing in-
creased services to individuals, businesses, and governments.
The emergence of botnets as a powerful force undermining
security has raised new and important issues. In particu-
lar, the difficulty of detection, elimination and prevention
of botnets or spam caused thereof on an absolute scale us-
ing computing technologies alone have focused attention on
studying behavior patterns of botnets and spammers, to
help devise better countermeasures. This paper has two ob-
jectives; first to introduce a theoretical modeling approach
to spammer behavior and derivation of the model, and sec-
ond, to compare some of the derivations with data that has
been collected from blocklist organizations. By making in-
ferences about the blocklist rules, the spammer can strate-
gize to maximize the amount of spam sent, and we find
evidence of spammers using multiple strategies. The block-
list can achieve reduction of spam by investigating longer
history of a node’s behavior instead of focusing on detection
alone. While some of the derivations seem consistent with
the data there is considerable room for modification and ex-
tension of the modeling approach. The paper concludes with
suggestion for the extension of the model.
1.
INTRODUCTION
The technique of using blocklists to fight spam has been
widely used in the industry. Blocklists serve as a convenient
tool for mail service providers (MSP) to efficiently filter out
spam messages. In addition, the existence of blocklists also
deter sp