Distributed Layer-3 E-Mail Classification for Spam Control

Abstract

This paper proposes a distributed layer-3 e-mail classification for spam control. E-mail packets are inferred in transit and tagged with an intra-packet spam score to indicate whether the packet forms a legitimate or spam e-mail. During e-mail packet reassembly, tags for an e-mail are aggregated to give an inter-packet spam score. The naïve Bayes inference technique is used to evaluate the performance of the proposed approach compared to the full e-mail classification approach. Our simulation results show that the proposed approach exhibits a comparable spam precision (and confidence) to the full e-mail classification approach. Spam recall increases from 63% to 85% depending to the maximum transmission unit size, approaching the 87% of the full e-mail classification. For 67% spam-to-legitimate ratio, we obtain reduction of end servers's workload by 42% to 57% (across all maximum transmission unit sizes tested) of the total e-mail traffic. Thus, the proposed approach can complement existing anti-spam systems by pre-processing e-mail packets on upstream nodes. Layer-3 e-mail processing requires reduced processing complexity as compared to layer-7 processing and is viable for high throughput hardware-based implementations.

Prioritized e‐mail servicing to reduce non‐spam delay and loss: A performance analysis

“…We assume t = 0.1 seconds and B v = B w = B = 50 for all service strategies. Unless otherwise stated, we assumed that f p = 0.005 and f n = 0.28 as reported in [7]. For all figures in this section, except in Section 5.4, horizontal axes represent the ratio a/c.…”

“…A prioritized e-mail servicing is proposed by estimating e-mail classes based on layer-3 e-mail classification [7]. We assume a two-class classification, where e-mails are classified as either non-spam or spam.…”

“…Figure 3 illustrates the proposed two-queue scheme. Based on layer-3 e-mail class estimation [7], e-mails are forwarded either to a fast non-spam queue V of size B v or to a slow spam queue W of size B w . The proposed two-queue scheme is not limited to the layer-3 e-mail class estimation.…”

A spam rejection scheme during SMTP sessions based on layer-3 e-mail classification

“…Otherwise, an e-mail class will be known only after the e-mail has been detected for spam, long after the SMTP session ends and an e-mail is received for transfer to recipients. A fast e-mail class estimation on MTAs is possible by pre-classifying e-mails at layer-3 (Marsono et al, 2006). This approach is suitable for high-throughput hardware support (Marsono et al, 2008) and is capable of providing fast e-mail class estimations on MTAs.…”

“…E-mail packets are assumed to have been pre-classified on a per-packet basis as discussed in our previous work (Marsono et al, 2006). Using this detection technique, each e-mail packet is predetected for spam and a hint is passed to the receiving MTA to improve spam control (at receiving MTAs).…”