A simple framework for filtering queued SMTP mail (cyberwar countermeasures)

Pre-information age military battlefields are based on the traditional land, sea, air, and space paradigm. Global internetworking is causal to the creation of a dangerously real 5th dimension of warfare-cyberspace. This paper describes an Internet based assault, commonly referred to as e-mail spam, on the Langley AFB internetworking infrastructure. We discuss the cyber-attack, a framework for defending against the attack, and the results of the campaign. The countermeasure was accomplished by running the MTA in a mode which accepts and queues SMTP mail; processes the messages with a rules-based filter; and then forwards mail after filtering. The filtering framework is simple and effective for a large subset of e-mail bombs. The prototype filter scripts may be obtained from the authors