Subject: RE: [Asrg] 2. - Spam Characterization - Possible Measurements (wa s : RE: Two ways to look at spam)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 5 Jul 2003 19:08:36 -0700

I think it might be unreasonable to expect a particularly accurate
measurement of spam characteristics. There are a lot of potential biases in
any sample that is constructed.

However I think we could hope to create a series of measurements that show
long term trends in various characteristics. So while a measurement of the
proportion of spam that is 419 scams is going to be heavily biased by the
means used for measurement a series of measurements taken in the same way
could provide highly accurate trending.

I think it will be very useful to have measurements that allow the
effectiveness of anti-spam measures to be judged as they are implemented.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Paul Judge <[email-masked]>
Date: Tue, 8 Jul 2003 06:19:23 -0400

> -----Original Message-----
> From: Yakov Shafranovich [mailto:[email-masked]] 
> Sent: Monday, July 07, 2003 8:33 PM
> To: Barry Shein; Dave Crocker
> Cc: Paul Judge; [email-masked]'
> Subject: Re: [Asrg] 2. - Spam Characterization - Possible 
> Measurements (wa s : RE: Two ways to look at spam)
> 
> 
> At 07:12 PM 7/7/2003 -0400, Barry Shein wrote:
> 
> 
> >Well, there's one characterization from measurements mentioned which 
> >spammers can't adapt to and that's their location 
> (in)stability in IP 
> >space.
> >
> >This relates to the idea that the only reason spammers can operate 
> >effectively is because they exploit thousands of hijacked computers 
> >which gives them location mobility (not geographic but in ip space.)
> >
> >If this can be shown to be true via measurement it leads to the 
> >conclusion that perhaps the problem with spam is not what 
> leads to this 
> >idea of a "consent" framework as originally proposed in this 
> charter, 
> >but, instead, shows spam is almost entirely a security problem.
> >
> >Spammers can't adapt their way out of this observation because that 
> >would mean they'd have to become location immobile which 
> means we could 
> >just block them and that'd be the end of spam.
> 
> Paul,
> 
> Perhaps we can start seeing some of the data based on these 
> characteristics?
> 
> Yakov 

I've commented on Barry's points in a separate message so I'll just address
your question here.

There were four categories of measurements: sending, source, message, and
spam attack characteristics.

I'm working with some colleagues at Georgia Tech on some analysis around the
first three. It will probably be another month before the data is in a
meaningful representation. If others want to also pursue this path, that is
great. Just contact me off-list and we can discuss.

The fourth category is spam attack characteristics. This seems to be where
this particular suggestion from Barry focuses. We can develop a methodology
for performing this analysis. We then need volunteers for performing the
data collection. This most likely requires not just a collection of spam,
but some honeypot domains, relays, or proxies. Volunteers?

Barry, any specific thoughts towards measuring the IP instability of
senders? There have been some ideas from persons discussing reputation
systems about the difference between the real source of the message and the
sender of the message. One difficulty is determining the real source and
tracking this across different messages sent via different means. Then, how
do you account for the legitimate messages that may originate from machines
or networks that have been compromised by spammers?