Abstract: The most popular mail content filtering technology at present work on the network application layer, which judge the legitimacy of the mail by analyzing the content of the mail, couldn’t avoid the overflowing spam wasting the network bandwidth. To deal with the problem, the paper proposes a method of spam behavior recognition based on the session layer data mining. The method applies data mining techniques, the decision tree algorithm, to the network session layer, find the rule of the spam behavior, and could filter the spam before the content data of the spam have been sent. The method solves unwanted spam traffic effectively, that is a beneficial supplement of the current various spam filter technologies.