Subject: RE: [Asrg] 2. - Spam Characterization - Possible Measurements

From: "Mark McCarron" <[email-masked]>
Date: Sun, 06 Jul 2003 17:07:22 +0000

My responses are in the body of the message below.

Version 0.005 - Updated 6th July 2003

GIEIS - Global ISP Email Identity System - The Ultimate Anti-Spam System
a.k.a. - The Digital Reaper

© Including intellectual copyright, Mark McCarron 2003, All rights reserved.

http://homepage.ntlworld.com/giza.necropolis

Mark McCarron.

>
>Message: 1
>From: Paul Judge <[email-masked]>
>To: "'Dave Crocker'" <[email-masked]>,
>         Paul Judge
>	 <[email-masked]>
>Cc: "'Barry Shein'" <[email-masked]>,
>         "'Yakov Shafranovich'"
>	 <[email-masked]>,
>         "[email-masked]'" <[email-masked]>
>Subject: RE: [Asrg] 2. - Spam Characterization - Possible Measurements (wa
>	s :  RE: Two ways to look at spam)
>Date: Sat, 5 Jul 2003 18:13:28 -0400
>
>
>
> > -----Original Message-----
> > From: Dave Crocker [mailto:[email-masked]]
> > Sent: Saturday, July 05, 2003 12:09 PM
> > To: Paul Judge
> > Cc: 'Barry Shein'; 'Yakov Shafranovich'; [email-masked]'
> > Subject: Re: [Asrg] 2. - Spam Characterization - Possible
> > Measurements (was : RE: Two ways to look at spam)
> >
> >
> > Paul,
> >
> > Permit me to ask a difficult question:
> >
> >
> > PJ> Here is a list of characteristics that I'd put together.
> >
> > Why?
>
>There are many reasons why one would want to understand characteristics of 
>a
>problem as a fundamental step towards attempting to solve that problem.
>
> > Essentially all of the characteristics that you have listed
> > are no better than second-order. That is, they are not key
> > characteristics to spam, but rather they are characteristics
> > of some spam today.
>
>Spam measurement and characterization should not be confused with the
>inventory of problems list. Spam characterization seeks to understand the
>current state of the problem (read symptoms). The inventory of problems 
>list
>seeks to look at the reason for the problem or the core attributes that
>allow the actions taken by spammers that result in these symptoms.
>
> > Let's say that a sender of spam changed their operation, so
> > that they committed none of the sins, and showed none of the
> > characteristics, that you listed. Could they still send spam?
> > I believe the answer is yes.
>
>Perhaps some incorrect assumptions were made about why these 
>characteristics
>are important.
>
>Your question above also assumes that spammers can change their operation 
>to
>avoid exhibiting ALL of these characteristics. I believe that to not be
>accurate.
>
>Secondly, your question asks if they could still SEND spam. In some cases,
>our goal is not to stop them from sending spam, but just to be able to
>DETECT the spam. Now, the question should be 'Will we be able to detect
>and/or prevent the spam?'
>
>The two questions underneath all of this are: 1) Is this characteristic an
>effective indicator of spam? And 2) Can they change the characteristic?
>
>There are four possible situations, but three that matter:
>
>Question 1: Yes. Question 2: Yes.
>Means: Valid indicator now, but not necessarily in the future.
>A number of these characteristics provide a good indication of spam
>messages. Even though spammers are able to change some of these
>characteristics: some of it changes and some of it does not. Either way,
>currently they provide effective means of spam detection. Also, realizing
>that these characteristics evolve, the good spam detection systems have
>also. See any heuristics-based spam detection system for reference. 
>Problems
>arise when a system creator mistakenly assumes that one of these
>characteristics can not change.
>
>Question 1: Yes. Question 2: No.
>Means: Valid indicator now and moving forward:
>This provide a good point of focus for new proposals. One quick example of
>such a characteristic is the call-for-action. Most (not all) spam messages
>include and must continue to include some call-for-action. There are of
>course exceptions such as spam sent for the sake of sending and the
>possibility of brand awareness spam that does not directly attempt to sell
>anything.
>
>Question 1: No.
>Means: Not a valid indicator now:
>Some of these characteristics do not provide a strong enough indication;
>therefore we should not focus on detecting or preventing those. Such a
>measurement study could make a strong statement about the usefulness of
>certain paths that are being considered.
>
> > Otherwise, all that you are doing is focusing on side-effects.
>

Mark's Response:

This area has been well defined any amount of times.  This is going back to 
the start again.

Mark McCarron.

_________________________________________________________________
Find a cheaper internet access deal - choose one to suit you. 
http://www.msn.co.uk/internetaccess

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Mark McCarron" <[email-masked]>
Date: Sun, 06 Jul 2003 17:07:55 +0000

Mark McCarron.

>--__--__--
>
>Message: 4
>From: "Hallam-Baker, Phillip" <[email-masked]>
>To: "'Paul Judge'" <[email-masked]>,
>         "'Dave Crocker'"
>	 <[email-masked]>
>Date: Sat, 5 Jul 2003 19:08:36 -0700
>
>I think it might be unreasonable to expect a particularly accurate
>measurement of spam characteristics. There are a lot of potential biases in
>any sample that is constructed.
>
>However I think we could hope to create a series of measurements that show
>long term trends in various characteristics. So while a measurement of the
>proportion of spam that is 419 scams is going to be heavily biased by the
>means used for measurement a series of measurements taken in the same way
>could provide highly accurate trending.
>
>I think it will be very useful to have measurements that allow the
>effectiveness of anti-spam measures to be judged as they are implemented.
>

Mark's Response:

Another post designed to go round in circles.  This has been covered SOOOOO 
many times.  Move on.

Mark McCarron.

_________________________________________________________________
Get Hotmail on your mobile phone http://www.msn.co.uk/msnmobile