Abstract: Based on the universal network measurement platform, a new method for detectingand defending spam is proposed, which is different from existing anti-spam technologies such as Blackhole List and mail filter. The traffic associatedwith mails is gathered into mail flows at the monitor points in local networks,which classified as invalid mail flows, normal mail flows and abnormal mail flows. Then according to the statistical characteristic of the three kinds of mailflows, ad spam, spam virus and abnormal mail behaviors are detected, and interception and alarms are performed by the policy-based responding mechanism.

Key words: :spam, anti-spam, network measurement