## 3 Proposed Solution
### Using ML Schemes during SMTP Transactions  
An important contribution of this study is the experimentation on the use of ML techniques during the SMTP transaction. The use of such techniques in this context seems totally unfeasible due to the execution time required. However, if the model has been previously built and only a few features of the message are used, it is possible to apply some ML techniques to classify the message during the delivery transaction. This study involved an experiment in which ML techniques were used during SMTP transactions taking advantage of the following features for message representation: (_i_) number of images, (_ii_) number of URLs, (_iii_) content type represented as multiple binary features, (_iv_) extensions of attachments represented as multiple binary features, (_v_) a numeric value that identifies the sender (zero if unknown), and (_vi_) a feature that indicates if _ReturnPath_ and _From_ headers have different values. Initially, we evaluated three ML techniques: Support Vector Machines (SVM), Naive Bayes (NB), and Random Forest (RF). The aim of using different learning algorithms is to run them and compare their performance. For experimental purposes, we created a database of 26,598 emails, 13,299 ham (legitimate), and 13,299 spam. The experimental dataset was built by collecting all messages included in SpamAssassin (available at [[https://spamassassin.apache.org/old/publiccorpus/](https://spamassassin.apache.org/old/publiccorpus/)]([https://spamassassin.apache.org/old/publiccorpus/](https://spamassassin.apache.org/old/publiccorpus/)), accessed on 1 September 2022) public corpus, the entire Enron dataset shared by Professor [PERSON] of the University of Athens (available at [[https://spamassassin.apache.org/old/publiccorpus/](https://spamassassin.apache.org/old/publiccorpus/)]([https://spamassassin.apache.org/old/publiccorpus/](https://spamassassin.apache.org/old/publiccorpus/)), accessed on 1 September 2022) and part of Bruce Guenter Spam Archive (available at [[http://untroubled.org/spam/](http://untroubled.org/spam/)]([http://untroubled.org/spam/](http://untroubled.org/spam/)), accessed on 1 September 2022) (messages received from 1 January 2000 to 31 August 2001). Despite their age, the original corpora used in the construction of the  
Figure 2: LiSB administration website: (**a**) LiSBWeb Menu; (**b**) LiSBWeb admin console. experimental dataset have been widely used in recent spam filtering studies [17,19]. These 26,598,074 emails have been processed and as a result, a feature vector has been obtained for each of them. The feature vector, containing 26,598,074 rows and 8 columns (7 features and 1 target attribute), has been used to build 5 ML models (Naive Bayes Multinomial, Random Forest, SVM with RBF kernel, SVM with Sigmoid kernel, and SVM with Polynomial Kernel). Table 1 shows the time required for building each model in a computer with an Intel(R) Core(TM) i7-8565U microprocessor and 8 GB of RAM memory. As shown in Table 1, NB Multinomial and RF algorithms are built quickly. However, these times are not particularly relevant for selecting an ML technique since the models can be built on a stand-alone server. Therefore, the performance of the models is what we need to evaluate in order to select the most suitable one to use for the SMTP transaction. To do so, we run a training/testing experiment using 80% of instances for building the model and 20% for testing. Table 2 presents _precision_, _recall_, and _f-score_ evaluations obtained by each algorithm. As shown in Table 2, the lowest false positive (_precision_) values correspond to the NB Multinomial and RF models. Therefore, these models are the most suitable for filtering spam messages. Furthermore, considering _recall_ (and _f-score_, which combines _recall_ and _precision_ measures), the use of Multinomial Naive Bayes seems to be the best choice. Taking into account the performance scores, we measured the average time required to classify a message.