Workload models of spam and legitimate e-mails

  • Authors:
  • Luiz Henrique Gomes;Cristiano Cazita;Jussara M. Almeida;Virgílio Almeida;Wagner Meira, Jr.

  • Affiliations:
  • Department of Computer Science, Federal University of Minas Gerais, Belo Horizonte, Brazil;Department of Computer Science, Federal University of Minas Gerais, Belo Horizonte, Brazil;Department of Computer Science, Federal University of Minas Gerais, Belo Horizonte, Brazil;Department of Computer Science, Federal University of Minas Gerais, Belo Horizonte, Brazil;Department of Computer Science, Federal University of Minas Gerais, Belo Horizonte, Brazil

  • Venue:
  • Performance Evaluation
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

This article presents an extensive characterization of a spam-infected e-mail workload. The study aims at identifying and quantifying the characteristics that significantly distinguish spam from non-spam (i.e., legitimate) traffic, assessing the impact of spam on the aggregate traffic, providing data for creating synthetic workload models, and drawing insights into more effective spam detection techniques. Our analysis reveals significant differences in the spam and non-spam workloads. We conjecture that these differences are consequence of the inherently different mode of operation of the e-mail senders. Whereas legitimate e-mail transmissions are driven by social bilateral relationships, spam transmissions are a unilateral spammer-driven action.