Towards Modeling Legitimate and Unsolicited Email Traffic Using Social Network Properties

Paper in proceedings, 2012

Identifying unsolicited email based on their network-level behavior rather than their content have received huge interest. In this study, we investigate the social network properties of large-scale email networks generated from real email traffic to reveal the properties that are indicative of spam as opposed to the expected legitimate behavior. By analyzing the structural and temporal properties of the email networks we confirm that legitimate email traffic generates a small-world, scale-free network similar to other social networks. However, email traffic as a whole contains unsolicited email, thus the structure of email networks deviates from that of social networks. Our study points out the distinctive characteristics of spam traffic and reveals that the anomalies in the structural properties of email networks are due to the unsocial behavior of spam.