Analysis of SMTP Connection Characteristics for Detecting Spam Relays

Abstract

Research into preventing spam is an ongoing concern. Much of the effort to date has focused on filtering email at the receiving end using techniques such as content filters. Techniques that could prevent spam from initially being sent would be beneficial and contribute to the preventative effort. In practice much spam is sent from compromised hosts. These can potentially be detected by ISPs using simple monitoring techniques. This monitoring takes place in the core of an ISP's network and provides a periodic summary of email activity. Relatively simple post-capture analysis can then identify the most significant spam relay machines