Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Metrics and SPAM SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Metrics and SPAM

 

Like all good security people I regularly look at different metrics to see what is going on in the environment.  Usually this is a bit of a ho hum task, but every now and then you do come across something interesting.  I find it helps to graphically represent the information as abnormalities often jump out at you which otherwise might not be as obvious.

Take the graph on the left.  This represents the SPAM traffic received in a month.  August and September are fairly steady a noticeable drop in October in email received and then, Whoa! What is going on in November?  Email messages received increased by more than 100% and the yellow line shows that the majority is SPAM.  It is not exactly parallel to the received line so either normal mail increased as well or more SPAM was missed by the tool used to block SPAM.  Both are worth investigating further.  

Metrics, especially visualised metrics, can be very effective in identifying whether you need to jump and fix something or whether it is business as usual.

Now all of you use some form of metrics in your organisation for security and I can guarantee that others are looking for useful metrics that they can apply in their environment. So if you are using a nifty metric that is easy to obtain and you are willing to share with the rest of us let us know.

(On a second note, if you SPAM increased by similar numbers in November, I'd be interested as well)

Mark H - Shearwater

 

 

Mark

391 Posts
ISC Handler
I find the correlation between sent e-mail and received e-mail/spam somewhat more interesting. It's subtle, but if you look at the relative increase in received and sent mail in November, it's very similar, though it's a bit hard to spot how similar with such a rough graph.

That being said, visual representation of metrics is definitely the way to go to spot patterns, or anomalies from patterns.
Anonymous
Nicely spotted. You are correct sent traffic also increased, about 90% in fact. This was due to some mail outs ahead of the festive season and sadly ndr replies to spam runs (fixed that).
M
Mark

391 Posts
ISC Handler
I had to laugh when I saw your graph, but when I was done, I checked mine and we did see an increase but mine started in september ish. I;d e happy to send you the mailgraphs for YTD.
Mark
2 Posts
Sorry for the typos ;) heres a link to the graphs from last Feb to now.
http://tinypic.com/r/a1n4tx/6
Mark
2 Posts
Our spam numbers have been DOWN over the past three months, which also made me wonder what's going on :) The number of spam with viral payloads has also returned to near-zero levels, after spiking tremendously in September.
Paul

44 Posts
I'm using (like Charles) http://mailgraph.schweikert.ch/ for those three (low traffic) mailserver I handle.
http://img5.imagebanana.com/img/fmgz547i/mgs.png
So far I don't see a general increase in the rejected mails but a lot more waves that go up very high for short periodes since end of September.
Paul
7 Posts
Our spam peaked in October. December so far looks like a big reduction in spam.
http://tinypic.com/r/dxi9vq/6
Anonymous
My spam also peaked in October. In fact, it was a 30% increase over both August and November.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!