Skip to main content

Table 1 Related literature on email traffic workload modelling

From: Modelling email traffic workloads with RNN and LSTM models


Objective and dataset

Key parameters

Techniques & findings

Shah and Noble [4]

Large scale study of email patterns. The dataset was collected over 7 months (2.85 million messages) from a departmental server

Message size, content type, temporal locality

Lognormal distribution is the best fit for the size of the message body, Pareto distribution is the best fit for the tail. Spam email sizes are larger than that of legitimate email

Gomes, et al. [3]

Focus on identifying the characteristics that significantly distinguish spam from non-spam traffic. The dataset consists of 8 days of SMTP incoming email logs collected from a university in Brazil

Email arrival process, size and popularity distribution and temporal locality

The inter-arrival time for spam traces is exponentially distributed

Email sizes follow lognormal distribution for both spam and non-spam traces. However, the average size of non-spam emails is six to eight times larger than the average size of spam

The distribution of the number of recipients per email is modelled with a Zipf-like distribution and is heavier tailed in the spam workload

Temporal locality is much weaker among spam recipients than for non-spam

Bertolotti and Calzarossa [2]

Focus on the accurate characterization of the email traffic workload. The datasets were collected from the mail servers of an ISP, two enterprises and a university in Italy

Arrival process, size and the number of recipients of messages

Weibull distribution model is found to provide the best fit for modelling inter-arrival times whose values are smaller than a threshold, where Pareto distribution is the best fit for inter-arrival time larger than a threshold. The empirical inter-arrival time distribution threshold value is approximately equal to 7 s

Lee and Kim [32]

Focus on the coexistence of the Poisson process and self-similarity. The dataset consists of 9 months of SMTP traces collected from a web portal in South Korea

Inter-arrival time of SMTP traces

The Q–Q plot and Chi square test demonstrate that the inter-arrival time of SMTP traces follows a Poisson process. On the other hand, the inter-arrival time also exhibits self-similarity and long range dependence

Boukoros, et al. [6]

Focus on modelling workload of email servers for all categories of traffic using probability distribution models and statistical test. The datasets were collected over 9 months from a university in Greece

Users’ incoming and outgoing email sizes, system incoming and outgoing email sizes and spam email sizes

In contrast to several of the above works, the lognormal distribution was found unable to provide the best fit for any of the categories. The best fit was provided by the log-logistic and Generalized Extreme Value distributions

Boukoros, et al. [5]

Focus on modelling email traffic as a time series problem. The datasets were collected from four universities over several months

As in [6]

The Recurrent Neural Network model has achieved significantly higher accuracy compared to the probability distribution models