A New Spam Traffic Characterizatione Mechanism

In this paper, we propose a new method to characterize unwanted email traffic. In order to survey a significant, diverse, and representative set of Internet email traffic, we use an extended deterministic finite automata (EFSA) model to express email session and then choose some parameters to capture email traffic characterization. We apply our mechanism to two different volumes of email traffic data captured respectively near an email gateway of a small company and at a country-edged core router of a large commercial Internet Service Provider in China. Experiment results show that there are significant unwanted email traffic in both the backbone link and the local gateway. Our method is effective and practical, which can be employed to design more effective rules or investigate possible countermeasure strategies that an administrator may pursue for reducing unwanted traffic.