Structural and Temporal Properties of E-mail and Spam Networks

In this paper we present a large-scale measurement study and analysis of e-mail traffic collected on an Internet backbone link. To the best of our knowledge this is one of the largest studies of network-wide behavior of e-mail traffic. We consider e-mail networks connecting senders and receivers that have communicated via e-mail, capturing their social interactions. Our study focuses on temporal and structural properties of these e-mail networks. By analyzing the structural properties of e-mail networks, first we confirm that legitimate e-mail traffic generates a small-world, scale-free network that can be modeled similarly to many other social networks, but we also show that, contrary to previous work, e-mail traffic as a whole does not exhibit a scale-free behavior. We show that this deviation is caused by the unsocial behavior of unsolicited e-mail traffic. We also analyze how various structural properties of e-mail networks change over time and reveal the structural properties that are indicative of the unsocial behavior of spam traffic. Finally, we show that our findings can be used to identify spam traffic in regular e-mail traffic without inspecting the e-mail contents.