Targeting spam control on middleboxes: spam detection based on layer-3 e-mail content classification

• Main Authors: Marsono, Muhammad N., El-Kharashi, M. Watheq, Gebali, Fayez
• Format: Article
• Published: Elsevier BV 2009
• Subjects: TK Electrical engineering. Electronics Nuclear engineering
• Online Access: http://eprints.utm.my/id/eprint/13128/; http://dx.doi.org/10.1016/j.comnet.2008.11.012

This paper proposes a spam detection technique, at the packet level (layer 3), based on classification of e-mail contents. Our proposal targets spam control implementations on middleboxes. E-mails are first pre-classified (pre-detected) for spam on a per-packet basis. without the need for reassembly. This, in turn, allows fast e-mail class estimation (spam detection) at receiving e-mail servers to support more effective spam handling on both inbound and outbound (relayed) e-mails. In this paper, the naive Bayes classification technique is adapted to support both pre-classification and fast e-mail class estimation, on a per-packet basis. We focus on evaluating the accuracy of spam detection at layer 3, considering the constraints on processing byte-streams over the network, including packet reordering, fragmentation, overlapped bytes, and different packet sizes. Results show that the proposed layer-3 classification technique gives less than 0.5% false positive, which approximately equals the performance attained at layer 7. This shows that classifying e-mails at the packet level could differentiate non-spam from spam with high confidence for a viable spam control implementation on middleboxes.