Subject: [Asrg] Taxonomy of anti-spam systems version 3

From: Paul Judge <[email-masked]>
Date: Thu, 20 Mar 2003 00:51:12 -0500

Here is a third draft of the taxonomy of anti-spam systems. 

Once I started to put this in a graphical format, some flaws became obvious.
I went back and looked at some of my older work in creating taxonomies. The
top level classification was incorrect. Instead of prevention, deterrence,
and response, I believe that it should be prevention, detection, and
response. Prevention systems are subcategorized into deterrence systems and
protection systems. The detection category is essentially the old fail-open
category. This should help folks understand it better, since some seemed to
not agree with the use of 'fail-open' as a label. Actually, this particular
change is not drastic at all since I had already explained in the text that
'fail-open' systems detect unwanted messages.

I also incorporated feedback from the list about draft 2. (Thanks Tom,
Chris, Jon and Hadmut.)

Please provide feedback. Thanks. 

-Paul

-----------------------------

1.	Spam Prevention Approaches - These systems aim to prevent the spread
of spam messages. This includes protection systems and deterrence systems.

	a)	Spam Protection (to shield from exposure)
		i)	Whitelists
			(1)	Basic
			(2)	Verified
				(a)	Authenticated sender identity
				(b)	Token supported
				(c)	Disposable email addresses 
		ii)	Challenge/Response systems
			(1)	Basic
			(2)	Human verification (i.e. turing tests)
		iii)	Consent Tokens (a priori consent)
			(1)	Proof-of-work (i.e. hashcash)
			(2)	Stamps
		iv)	Don't receive messages, just notification (i.e.
IM2000)

	b)	Spam Deterrence Approaches - (to discourage from acting)
These systems aim to deter spamming activities. In most areas of life,
deterrence is achieved by introducing the ability to identify and track
wrongdoers. These systems provide input to certain spam reaction techniques
such as charging, legal prosecution, malicious response, and feedback to
reputation systems.

		i)	Authentication
		ii)	Tracking
		iii)	Non-repudiation

2)	Spam Detection 
	a)	Human determination
		i)	Collaborative filtering (i.e., razor) 
	b)	System Determination
		i)	Who is it from? 
			(1)	Blacklists
			(2)	Reputation systems
		ii)	What's in it? (Content Filtering)
			(1)	Static lists 
			(2)	Learning methods 
		iii)	How was it sent?
			(1)	Forged info?  (i.e. reverse DNS, domain
lookup, verify email address on calling server, verify message on sending
server,reverse MX record)
			(2)	Envelope characteristics; delivery path
information 
			(3)	Quantity? (i.e. DCC)

3)	Spam Responses - These are the different approaches that can be
taken upon receipt. 

	a)	Accept
	b)	Quarantine
	c)	Reject
	d)	Drop
	e)	Label
	f)	Challenge
	g)	Limit Rate
		i)	Ingress
		ii)	Egress
	h)	Feedback 
		i)	to detection systems i.e. blacklists, reputation
systems, learning content filtering methods
		ii)	to other response systems
	i)	Charge
		i)	Confirmed payment (i.e. Bonded Sender, Trusted
Sender)
		ii)	Pursue payment (i.e.Habeas)
	j)	Legal Prosecution
	k)	Malicious response (e.g., teargrubbing and hackback)
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 20 Mar 2003 16:22:14 +0000

> protection systems. 

Good so far I think. I still believe a more general message classification
taxonomy (including spam) would be useful. Of course that's not what you're
trying to do here so I'll shut up (for now).

> 3)	Spam Responses - These are the different approaches that can be

maybe add (l) Bounce Back
as performed by (I'm sure otherwise excellent) "Mailwasher", "Spam CSI"
etc.

I don't think this is covered by "Malicious response".

--