Abstract
Many traditional SPAM filters work by analyzing the content of each email message in turn against a set of rules that are used to measure the spaminess of the message. Unfortunately, because spammers have access to these rules, the content of SPAM messages continually changes to evade detection. This is similar to the difficulties the immune system faces in identifying and clearing the Human Immuno-Deficiency Virus (HIV). Intriguingly, some individuals are resistant to HIV. We explore the parallels between HIV and SPAM in order to deduce a method of identifying SPAM that transcends the polymorphic nature of the SPAM message body. This proposed method is based on the group behavior of SPAM messages, rather than on the content of a SPAM message. We are in the process of implementing a SPAM filter that uses the proposed method.