Controlling Spam E-mail at the Routers

Like it or not, unsolicited bulk commercial email (aka “spam”) has become a regular menu item on the Internet information diet. To combat the daily onslaught of spam clogging people’s email inboxes, much work is being done on the development of effective spam control methods, most of which follow the same basic theme of establishing a “front line” of defense at the end-user level. However, dealing with spam is like fighting a battle against a large army; the most effective approach is to employ multiple tactics. Thus, in this paper we propose a method for blocking the supply lines. More specifically, since the daily replenishment of all those in-boxes with new spam consumes a significant amount of network resources, we describe a mechanism to allow network administrators to impose rate controls on bulk email delivery. In our approach, we separate SMTP email delivery traffic from other types of traffic at the router. We then apply a twostep process to the email delivery traffic, which first identifies bulk email streams by comparison with a cache of recently-seen emails, and then uses a Bayesian classifier to decide whether or not a particular bulk emails stream is spam. If a bulk email stream is classified as a spam, we then rate limit it (e.g., no more than 1 copy per minute).