Charcterization of an anomalous email traffic

This paper proposes a novel method to characterize Internet email traffic. We apply our mechanism to two different volumes of email traffic data captured respectively near an email gateway of a small company and at a country-edged core router of a large commercial Internet service provider in China. Experiment results show that there are significant abnormal email traffic in both the backbone link and the local gateway. Our method is effective and practical, which can be employed to design more effective rules or investigate possible countermeasure strategies that an administrator may pursue for reducing unwanted traffic.