Exploring the Spam Arms Race to
Characterize Spam Evolution
Pedro H. Calais Guerra
Universidade Federal de
Minas Gerais (UFMG), Brazil
pcalais@dcc.ufmg.br
Dorgival Guedes
Universidade Federal de
Minas Gerais (UFMG), Brazil
dorgival@dcc.ufmg.br
Wagner Meira Jr.
Universidade Federal de
Minas Gerais (UFMG), Brazil
meira@dcc.ufmg.br
Cristine Hoepers
Brazilian Network Information
Center (NIC.br)
cristine@cert.br
Marcelo H. P. C. Chaves
Brazilian Network Information
Center (NIC.br)
mhp@cert.br
Klaus Steding-Jessen
Brazilian Network Information
Center (NIC.br)
jessen@cert.br
ABSTRACT
Current studies on spam evolution usually extract evolution
patterns and trends by analyzing historical spam message
corpora.
In this paper, we propose a novel methodology
that incorporates spam filters to the spam trend analysis, as
they are the agents that may force spammers to change their
tactics. Moreover, filters also evolve over time and different
filter releases present different characteristics, providing dif-
ferent views of the spams. We considered both outdated
and recent releases of the Open Source SpamAssassin fil-
ter and applied their criteria on spams collected from the
Spam Archive dataset, a dataset that contains spams col-
lected from 1998 to 2010. When we compare the effective-
ness of old and recent filters over old and recent spams, spam
trends naturally emerge. Our results give a general picture
of the dynamic nature of spam over the last 12 years and
indicate that, on any given year, spams from different gen-
erations are observed. Moreover, we investigated how the
popularity of spam construction techniques changes when
filters start to detect them. We also determined automati-
cally techniques that seemed more resistant than others and
thus subsidize studies on improving anti-spam mechanisms.
1.
INTRODUCTION
Spam fighting is an “arms race” characterized by an in-
crease in the sophistication adopted by both spammers and
spam filters [8]. The co-evolution of spammers and anti-
spammers is a remarkable aspect of the