Figure 3: (a) Section of a user-IP matrix (with 1000 users and 500 IPs) from a large matrix (5483 x 2432). A ’*’ denotes 1 and zero otherwise. (b) Normalized usage-entropy vs. normalized sample usage-entropy for the 500 IP addresses shown in (a). Figure 2: Algorithmic overview of dynamic IP block identification. Figure 5: IP block size distribution. Figure 6: Distribution of the three categories of IPs in the ad- dress space. Figure 8: The distribution of dispersion factors across UDmap IP blocks Figure 7: UDmap IP statistics computed with three different metrics on per-IP basis Figure 11: (a) Number of days an IP was used as a mail server to send emails. (b)Spam ratio per session. We compare the identified dynamic email servers (UDmap IP + Dynablock IP) with the likely static servers (All - UDmap IP - Dynablock IP). Table 7: Spam sent from UDmap IPs and Dynablock IPs. Table 8: Top 10 ASes that sent most spam.
