Anomaly Detection in SMTP Traffic

We investigate an effective and robust mechanism for detecting SMTP traffic anomaly. Our detection method cumulates the deviation of current delivering status from history behavior based on a weighted sum method called the leaky integrate-and-fire model to detect anomaly. The simplicity of our detection method is that the method need not store history profile and low computation overhead, which makes the detection method itself immunes to attacks. The performance is investigated in terms of detection probability, the false alarm ratio, and the detection delay. Our results show that leaky integrate-and-fire method is quite effective at detecting anomaly in the SMTP traffic. Compared with non-parametric cumulative sum method, the evaluation results show that our detection method has lower false alarm ratio and higher detection probability