## 4 Conclusions and Future Work  
In this study, we introduce the LiSB Framework (source code shared on [[https://github.com/sing-group/LiSB](https://github.com/sing-group/LiSB)]([https://github.com/sing-group/LiSB](https://github.com/sing-group/LiSB)), accessed on 1 September 2022), which allows network administrators to execute a wide variety of spam filtering techniques during an SMTP transaction. The techniques implemented are based on SMTP anomaly detection, server/user profiling, and content-based ML. These techniques have been tested in a real environment and we have publicly shared the generated source code in a GitHub repository ([[https://github.com/sing-group/MLClassifers4](https://github.com/sing-group/MLClassifers4) LiSB]([https://github.com/sing-group/MLClassifers4](https://github.com/sing-group/MLClassifers4) LiSB), accessed on 1 September 2022). Moreover, we have developed a simple process to install the software on Amazon AWS services (available at [[https://aws.amazon.com](https://aws.amazon.com)]([https://aws.amazon.com](https://aws.amazon.com)), accessed on 1 September 2022) using Ansible (available at [[https://www.ansible.com](https://www.ansible.com)]([https://www.ansible.com](https://www.ansible.com)), accessed on 1 September 2022) and Terraform (available at [[https://www.terraform.io](https://www.terraform.io)]([https://www.terraform.io](https://www.terraform.io)), accessed on 1 September 2022). The Ansible playbook is available on a GitHub repository ([[https://github.com/sing-group/LiSBsetup](https://github.com/sing-group/LiSBsetup)]([https://github.com/sing-group/LiSBsetup](https://github.com/sing-group/LiSBsetup)), accessed on 1 September 2022). The LiSB framework includes modules that check for possible anomalies in SMTP and MIME headers. It also includes some modules that are able to build profiles for servers and senders and check for unexpected changes in the messages they sent. LiSB also uses ML to classify messages by examining some properties such as the presence of attachments, and the number of images and URLS. Furthermore, we have proven that the developed modules can successfully run during SMTP transactions with small delays. Furthermore, the modularity of the framework enables the maximum duration of the filtering process to be adapted to the time limits imposed by SMTP transactions. In the context of ML, we have analyzed the use of three ML algorithms (SVM, Naive Bayes, and Random Forest) during SMTP transactions. Considering that the ML techniques are applied in real time, our work has focused on reaching a trade-off between the time needed to run the algorithms and their accuracy. The effectiveness of each ML strategy was measured to identify the most suitable one for a real environment and the conclusion was that the NB Multinomial and Random Forest algorithms showed the best performance by returning the lowest number of false positives (FP or ham emails incorrectly classified). Reducing the number of FP errors prevents important emails from being discarded because they are identified as spam. Both algorithms are also remarkable for their low computational time for training and classifying messages. The modular design of LiSB allows for the easy addition of new filters, as new filtering techniques can be simply incorporated to be executed during the SMTP transaction. On the other hand, being able to include new filtering modules that work under different criteria provides greater control over the email traffic during SMTP transactions, beyond simple blacklists. Future work includes the development of new modules to extend the functionality of the LiSB framework and to improve the mechanisms used to combine the output of the modules. Moreover, it would be useful to identify new features that can be analyzed to increase the performance of the ML models.