Workload models of spam and legitimate e-mails

This article presents an extensive characterization of a spam-infected e-mail workload. The study aims at identifying and quantifying the characteristics that significantly distinguish spam from non-spam (i.e., legitimate) traffic, assessing the impact of spam on the aggregate traffic, providing data for creating synthetic workload models, and drawing insights into more effective spam detection techniques. Our analysis reveals significant differences in the spam and non-spam workloads. We conjecture that these differences are consequence of the inherently different mode of operation of the e-mail senders. Whereas legitimate e-mail transmissions are driven by social bilateral relationships, spam transmissions are a unilateral spammer-driven action. c © 2006 Elsevier B.V. All rights reserved.