Date Added: Jan 2011
Previous work has shown that the network dynamics experienced by both the initial packet and an entire connection carrying an email can be leveraged to classify the email as spam or ham. In the case of packet properties, the prior work has investigated their efficacy based on models of traffic collected from around the world. In this paper, the authors first revisit the techniques when only using information from a single enterprise's vantage point and find packet properties to be less useful. This paper also shows that adding flow characteristics to a model of packet features adds modest discriminating power, and some flow features' information is captured by packet features.