Many home computer users currently connect to the Inter- net through dial-up, ADSL, cable or other services that as- sign them new IP addresses constantly anywhere from every couple of hours to every couple of days. This af- fects our estimation of number of hosts involved in each spam campaign. We correct this by estimating how dy- namic each IP address is, and compensate by merging some dynamic IP addresses with other IP addresses in the same spam campaign. The problem of IP dynamics was rst presented and studied in [18]. However, we are not able to directly use their results because our application requires a different set of parameters. We.
