Classification of web-based email traffic in Thailand

Traditional works in traffic classification usually measure usage of mail applications by monitoring only SMTP, IMAP, and POP3 traffic. The shortcoming of such measurement is that it does not take into account web-based email usage (Webmail) since the Webmail traffic is usually classified collectively as HTTP or web traffic. The simple way to identify Webmail traffic is mapping source or destination IP address with URLs of Webmail providers (e.g. Hotmail, Yahoo!, and Gmail), is neither flexible nor accurate. The URL mapping technique cannot detect some related Webmail traffic such as advertising banners, pictures, and news, which are requested from other servers. In this paper we propose a technique to detect Webmail traffic from regular HTTP traffic by matching unique Webmail keywords in HTTP payload, in combination with TCP flow analysis. The significance of our method is that it can identify Webmail traffic missed by using the URL mapping alone, and can identify all packets associated with a TCP flow in both sending and receiving directions.