 senders, ``whereas legitimate e-mail transmissions are driven by social bilateral relationships, spam transmissions are a unilateral spammer-driven action''~\cite{Gomes}. 
\begin{figure}[t!!]
\begin{center}
\includegraphics*[scale=0.31]{mindist.eps}
\end{center}
\caption{\label{fig:mindist} (color online) Daily dependence of the probability of receiving an e-mail. $I$ indicates the probability of receiving a regular e-mail, which is highly structured. $J_i$ indicates the probability of receiving a spam, which on the contrary exhibits small oscillations during the day. The index $i = 1,2,3,4$ identifies the investigated datasets.
}
\end{figure}


As shown in Fig.~\ref{fig:rate}, spams are received at constant rate; yet the time series of the arrival times $t_i$ is characterized by bursts, short temporal periods during which many correlated spams are received. Here we suggest that the origin of these bursts lies in the use of peer-to-peer (i.e. decentralized) network of infected computers to send spams, known as botnets.


\begin{figure}[t!!]
\begin{center}
\includegraphics*[scale=0.31]{rate.eps}
\end{center}
\caption{\label{fig:rate} (color online) The cumulated number of delivered e-mails $N(t)$ increases linearly in time. In order to rescale the data of different datasets, here we plot $N(t)/N$, where $N$ is the number of e-mails of the dataset, as a function of the rescaled time $\overline{t}= (t-t_1)/(t_N-t_1)$, where $t_1$ and $t_N$ are the time of arrival of the first and of the last e-mail of the dataset. For a stochastic process at constant rate $N(t)$ increases linearly in time. The inset shows how the number of received spams increases in a temporal window of $3h$, and shows the existence of bursts.
}
\end{figure}

\begin{figure}[t]
\begin{center}
\includegraphics*[scale=0.31]{intertime.eps}
\includegraphics*[scale=0.31]{scaled_intertime_pw.eps}
\end{center}
\caption{\label{fig:intertime} (color online) (a) The distribution of intertimes between two consecutive e-mails of the {\it junk } folders is well described by a Gamma distribution. This is true both for the whole distribution of intertimes, as well as for the distribution of the intertimes sent by given geographical locations (the analysis is restricted to datasets with more than 500 points). Inset: the distribution of the intertimes between regular e-mails. (b) Collapse of the intertime distribution of the {\it junk } folders. The dotted line is a fit to Eq.~\ref{eq:gen_gamma}, the thick dashed line is the result of our model. Inset: the power spectrum of $P(\Delta t)$ for our largest spam dataset.}
\end{figure}

In order to check whether the spamming process could be considered a stationary Poisson process, we have investigated
the probability distribution $P(\Delta t)$ of the intertimes between two consecutive events. For regular e-mails, where correlations are expected and build up when replying to previous e-mails~\cite{Kossinets,Eckmann}, the probability distribution is characterized by a crossover between two power-laws, as shown in Fig.~\ref{fig:intertime}a (inset). For the dataset we have investigated the corresponding exponents are $-0.2$ at short intertimes, and $-1.7$ at large intertimes, but it has been suggested that these exponents may depend on the particular mailbox~\cite{Masuda08}.


Fig~\ref{fig:intertime}a shows the spam intertime probability distributions. We have computed these probability distributions for each {\it junk } folder, as well as for the catalogs obtained from each {\it junk } folder by considering only spams originating from specific geographical locations, China (CHN), European Union (EU) and United States (USA). These different distributions are also shown in  Fig~\ref{fig:intertime}a.
Contrary to the case of regular e-mails, the intertime probability distributions between spams show universal behaviour if time is rescaled by the average rate in each dataset. In fact, $P(t)$ can be expressed as 
\begin{equation} 
\label{eq:scaling}
P(\Delta t) = 1/\tau f(\Delta t/\tau),
\end{equation}
with $f$ an universal function and $\tau$ the mean intertime, as shown by the data collapse obtained by plotting $\tau P(\Delta t)$ versus $\Delta t/\tau$ in Fig~\ref{fig:intertime}b.
The scaling function is well described by a 
generalized gamma distribution,
\begin{equation} 
\label{eq:gen_gamma}
f(\Delta t/\tau) = \alpha \left(\frac{\Delta t}{\tau}\right)^\beta \exp\left[-\left(\frac{\Delta t}{\tau}\right)\right],
\end{equation}
where $\alpha$ is a normalization constant, and $\beta = -0.25$ is found via a regression procedure. The exponent $\beta$ can also be determined from the power spectrum of the intertime distributions, since if $P(\Delta t) \propto \Delta t^\beta$ at small $\Delta t$, then $S(\omega) \propto |\int P(\Delta t) e^{-i\omega \Delta t} d\Delta t|^2 \propto \omega^{-2(\beta+1)}$ at large $\omega$. As $\beta = -0.25$ we expect  $S(\omega) \propto \omega^{-1.5}$, and Fig.~\ref{fig:intertime}(b) (inset) shows that this is actually the case. As $P(\Delta t)$ is not a simple exponential, the spamming process cannot be considered a homogeneous Poisson process.
\begin{figure}[t!]
\begin{center}
\includegraphics*[scale=0.28]{conditional_both_original2.eps}
\includegraphics*[scale=0.28]{conditional_both_reshuffled.eps}
\includegraphics*[scale=0.28]{conditional_model.eps}
\end{center}
\caption{\label{fig:conditional} (color online) (a) Conditional probability distribution $P(\Delta t/\tau|\tau_0)$, for $\tau_0 \in Q_1$, 
$\tau_0 \in Q_4$ of the intertimes between spams of the dataset $J_1$. Inset: mean value of the intertime $\Delta t_{next}/\tau$ following an intertime $\tau_0$. (b) The same quantities are shown for the reshuffled catalog, where correlations are absent. (c) The same quantities are shown for the synthetic catalog, where correlations are found.}
\end{figure}

We show now that the non-Poissonian nature of the spamming process is due to the presence of temporal correlations between spams. We have checked that this is actually the case first by computing the mean value $\langle \Delta t_{next}(\tau_0) \rangle$ of the intertimes following an intertime of size $\tau_0$:
\begin{equation}
\langle\Delta t_{next}(\tau_0)\rangle = \frac{\sum_i \Delta t_{i+1} \delta(\Delta t_i,\tau_0)}{\sum_i  \delta(\Delta t_i,\tau_0)},
\end{equation}
where $\delta(\Delta t_i,\tau_0)=1$ if $0.9\tau_0 < \Delta t_i < 1.1 \tau_0$, $0$ otherwise.

In absence of correlations, one expects $\Delta t_{next}(\tau_0)/\tau \simeq 1$. We have determined this quantity both for the original time series of the intertimes $\Delta t_i$ and for the reshuffled time series. These are obtained from the original time series by repeatedly exchanging the values of two randomly chosen intertimes.
Fig.~\ref{fig:conditional}a (inset) shows that the original catalog is characterized by a positive correlation between $\Delta t_{next}/\tau$ and $\tau_0$, which implies that large intertimes are most probably followed by large intertimes. Conversely, for the reshuffled catalog $\Delta t_{next}(\tau_0)/\tau \simeq 1$ (see Fig.~\ref{fig:conditional}b (inset)), indicating absence of correlations.

A further check of the existence of correlations is provided by the study of the conditional probability $P(\Delta t |\tau_0)$, which is the probability of having an intertime $\Delta t$ following an intertime $\Delta t = \tau_0$. To improve the statistics, following~\cite{livina}, we have determined five intertimes $\delta