A Spam Traffic Cost Analysis for Network Operators

Abstract

Spam messages are used to disseminate malware, make phishing attacks, and advertise illegal products. Spam generates costs to users, e.g., victims of phishing, and to network administrators, e.g., who provision and pay for the traffic. Recent proposals aim to identify and filter spam messages at the origin, restraining message propagation and reducing wasted bandwidth on the route from the spammer to the destination. In this work we analyze spam traffic costs for network operators. We measure the routes traversed by real spam messages colected at five honeypots, and estimate spam traffic costs according to the business relationships between networks traversed on each route. We show that stub networks are systematically encumbered by high spam traffic costs but can cooperate to filter up to 70% of spam messages at the origin. Our results also indicate that transit networks that send a lot of spam may employ traffic engineering to reduce their transit costs.