Subject: Re: [Asrg] 2a. Analysis - Spam filled with words

From: "John Fenley" <[email-masked]>
Date: Thu, 11 Sep 2003 23:15:58 -0600

From: "Terry Sullivan" <[email-masked]>
>I recently had occasion to try to do some (decidedly non-Bayesian) 
>statistical characterization of ham/spam differences.  I ended up with two 
>interesting results:
>
>1) There were four distinct "types" of spam.     Variation within each 
>spam-type was much    smaller than the variation between    spam-types.
>
>2) Only one of the four spam-types was even    remotely close to "ham."
>

This reminds me of something I heard about a few years ago while attending a 
lecture on multidimensional math. One example use of extra dimensions was 
clasification of dinosaur vertebrae from various species. On each specimen a 
simple measurement was taken and used as a base line, then N other 
measurements were taken as compared to the base line(to correct for 
different ages). When plotted in N dimensions vertebrae from different 
species of dinosaurs formed distinct clouds that could be distinguished 
easily.

Perhaps a multidimensional Bayesian classifier could find these spam/ham 
groups on it's own. Each method for bypassing filters in a strange way might 
be easily discernable as a different cloud.

John Fenley

_________________________________________________________________
Need more e-mail storage? Get 10MB with Hotmail Extra Storage.   
http://join.msn.com/?PAGE=features/es

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 12 Sep 2003 11:55:38 +0100

> be easily discernable as a different cloud.

Good point, of course, many anti-spam content analysis type things collapse
measures made on a number of axes into one
metric. eg, spamassassin seems to turn the results of many local and
network tests into a single compact spam-score. This is throwing away some
information (?) Some way of preserving the "depth" of the "test-space"
might well give better discrimination... I'd guess you're right.

--

---

From: "Pete - Madscientist" <[email-masked]>
Date: Fri, 12 Sep 2003 12:09:54 -0400

|-----Original Message-----
|From: [email-masked] [mailto:[email-masked]] On 
|Behalf Of Jon Kyme

<snip>

|> Perhaps a multidimensional Bayesian classifier could find these 
|> spam/ham
|> groups on it's own. Each method for bypassing filters in a 
|strange way
|> might
|> be easily discernable as a different cloud.

<snip>

|Good point, of course, many anti-spam content analysis type 
|things collapse measures made on a number of axes into one 
|metric. eg, spamassassin seems to turn the results of many 
|local and network tests into a single compact spam-score. This 
|is throwing away some information (?) Some way of preserving 
|the "depth" of the "test-space" might well give better 
|discrimination... I'd guess you're right.

There is a lot of heavy lifting involved when performing an analysis of
"strange attractors" - so real-time systems like filters cannot usually
afford the cpu budget involved. With Message Sniffer we solve this
problem by performing a rudamentary evaluation "in the wild" that
results in a single result that can be used by the filtering system -- 

Then, systems that wish to participate send back their log files which
contain the detailed datapoints developed from each scan. The systems
here can do heavy analysis on the features extracted from each message
and use that data to refine the rulebase. 

This is based on AI & real-time robotics research where a "reflex"
system capable of responding in real-time is continuously trained by a
slower, more sophisticated learning system.

A multidemensional Bayesian classifier would likely require a similar
division of labor to be practical - even if operated at the MUA.

_M

PS: In future we will divide the "heavy lifting" among the systems that
participate using distributed parallel processing techniques & cellular
automata mechanisms rather than having it done at a central location.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 12 Sep 2003 13:58:52 -0400

>automata mechanisms rather than having it done at a central location.

The amount of work people are throwing at content-analysis stuns me. 
When we start talking about taking the kind of computing resources we 
normally throw at, say, finding aliens, or a cure for cancer, I think 
people are really starting to go overboard.  Spam is being presented 
to the user via a mechanism which is essentially NP-complete.  This 
really isn't a battle that can be won this way, because the content 
will continue to change (especially as spammers sell more and more 
mainstream products).  People keep treating this as though it were a 
technical problem that can be "solved" in some sense.  It's not. 
It's an ongoing battle.  As such, you should pick those areas where 
the enemy has the least flexibility and attack there.  In content 
they have *infinite* flexibility.

Or to put it another way.

Peolpe keep taniretg tihs as thoguh it wree a tichcaenl plreobm taht 
can be "seolvd" in smoe ssene.  It's not.  It's an ogninog bttale. 
As scuh, you slhuod pcik toshe araes werhe the emeny has the lseat 
flbieitixly and atctak terhe.  In cnotnet tehy hvae *iintinfe* 
fxltiiiebly.

But this group is not about comparing techniques for blocking spam, 
so I'm not sure this is a productive thread.  If you want to know how 
I *would* (and do) block spam without looking at content, contact me 
off line.
-- 
Kee Hinckley
http://www.messagefire.com/  Anti-Spam Service for Companies and Individuals
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: "Pete - Madscientist" <[email-masked]>
Date: Fri, 12 Sep 2003 15:03:16 -0400

|Behalf Of Kee Hinckley

<snip>

|The amount of work people are throwing at content-analysis stuns me. 

<snip>

| will continue to change (especially as spammers sell more and more 
| mainstream products).  People keep treating this as though it were a 
| technical problem that can be "solved" in some sense.  It's not. 
| It's an ongoing battle.  As such, you should pick those areas where 
| the enemy has the least flexibility and attack there.  In content 
| they have *infinite* flexibility.

Actually, the "message" of the spammer has some rigidity to it so it's
not without merit to attack there under this argument. The *infinite*
flexibility you speak of is not truly there - only apparently.

|Or to put it another way.
|
|Peolpe keep taniretg tihs as thoguh it wree a tichcaenl plreobm taht 
|can be "seolvd" in smoe ssene.  It's not.  It's an ogninog bttale. 

By the way... this obfuscation technique could easily be generalized and
captured by many content analysis systems...

|But this group is not about comparing techniques for blocking spam, 
|so I'm not sure this is a productive thread.  If you want to know how 
|I *would* (and do) block spam without looking at content, contact me 
|off line.

Agreed. However, as this group is about developing mechanisms for
consent, and since there is no universally applicable definition for
*spam*, discussions of content analysis and other mechanisms for
identifying spam are important parts of the activity of this research
group.

In order to define consent in a way that is executable we must define
the "to what" part of the equation. In practical terms, I frequently
have two users on the same system disagree about the definition of a
single message and that definition is often only resolvable by content
analysis... 

With the exception of the application of explicit consent tokens & C/R
mechanisms (which have their ups and downs) there is no clear way to
establish "what" a RECEIVER is giving CONSENT to receive. In the end,
the best practice will be for the RECEIVER to have any and all
mechanisms at their disposal for this purpose so that the greatest
diversity of needs can be met. Also, as with much of the Internet, once
the raw technology and mechanisms for this ability are in place the
costs of these tools will sink into obscurity as a tiny fraction of the
infrastructure - All of this is heightened right now because it's not
managed well - that will change one way or another... it is up to us to
decide how it will change so that we don't end up someplace else we
don't want to be. Simply getting to "someplace else" without deciding
"where" is like hitting the hyperspace key - you might end up in the
middle of a rock. (for the asteroids fans)

Spammers are being used to market mainstream products more and more
frequently (this is sad but inevitable),... and the same organizations
that send out ink, insurance, and travel spam are just as likely to send
you the IBM newsletter you signed up for or your latest RedHat notices.
Need I mention McAfee and Norton who seem to have an army of spammers
selling their wares... all without their permission of course (yeah
right). Or what about the amazing (cough) trend of anti-spam vendors
spamming to sell their software! (I hate those guys - we filter them and
we look like we're being unfair, we don't filter them and we get pounded
with customer complaints and submissions... and we're not allowed to use
this practice!! - we refuse!!!)

It's a zoo.

By all of that I'm actually agreeing with you that sorting out what is
"legitimate" from what is not is now and will continue to become
extremely difficult.

That said, if RECEIVERs are going to have control of what they receive
then content analysis will have to play a role in that mechanism -
simply because recipients, more often than not, define what they want
and don't want by the content of the message, not by the sender, not
even by agreements they may have with that sender (explicit or implied).

Filtering systems are now and will be as important as search engines for
precisely the same reasons... the amount and variability of information
that is "out there" or in the case of email on it's way to your mailbox
is *infinite*. Selecting what you want and ignoring what you do not want
is the critical task of the information age. 

Making that capability a practical reality requires technology - and
content analysis is part of that arsenal.

People keep thinking of this problem in terms of abuse, attacks and
illegal activities that should be stopped... much of that is true since
there are few controls in place... however the deeper "meaning" in all
of this mess is that once you can access anything you ever could want -
you then need a mechanism to manage that ability.

The information age is upon us. You can get anything you want
(practically) on the 'net.... and, as it turns out, it can get you too
(wither you want it or not) - if you don't have tools in place to
control that aspect of things.

Be careful what you wish for - you might get it. We all did.

</soapbox>
_M

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 12 Sep 2003 21:58:54 -0400

[I'm still iffy on how on-topic this is, so I've provided the 
following handy pointer.  If you want to skip the side discussions 
and see the small part which I actually think is actually relevant to 
the consent discussion, search for the string "BEGIN RELEVANT CONSENT 
SECTION".  The rest of the text is just me being unable to stop from 
responding to things. -kee]

>flexibility you speak of is not truly there - only apparently.

No, I'm not talking about apparent flexibility.  I really mean 
infinite.  Javascript, and CSS to a lesser extent, and HTML to some 
extent as well, provide the ability to present the same content in an 
infinite number of ways.  (If you want to get picky, I'd agree that 
message size and presentation time are limitations, but otherwise I 
don't see any.)  So to beat the game you either need to provide a 
full, bug-for-bug-compatible, implementation of the end-user's email 
program (tough for server implementations) or start playing the 
virus-signature game.  (Which has recently been shown to incapable of 
responding as quickly as viruses, never mind spam.)

At some point you presumably stop trying to look for content per-se, 
and start analyzing the techniques used to present it to see if they 
show signs of deliberate obfuscation.  Of course this introduces a 
whole new class of false positives since there are companies out 
there whose business model is "active email".  On the bright side, if 
you fail as an anti-spam provider, you can always sell the software 
to universities for grading students' programs.  :-)

>captured by many content analysis systems...

Absolutely.  And the next, and the one after that, and the one after that....

Actually that particular technique is probably of most concern to 
people doing checksums.  And it can clearly be solved there as well. 
But like all of these things, it continues to be a battle because of 
the fantastic flexibility of the presentation software, that of the 
human mind viewing the final result, and that of the human mind 
coming up with the evasive techniques.  This is not something I want 
to try and pit a computer program against.

>single message and that definition is often only resolvable by content

I was with you there for a sentence and a half.  I did my undergrad 
thesis on natural language processing.  I have good friends who are 
still in the business (well actually, who are out of jobs, which says 
something in itself.)  I've seen nothing that has given me any 
indication that the technology is at the stage where it can read an 
email message and make a better assessment about its content than two 
arbitrary humans.  *Especially* content that someone is deliberately 
trying to obscure from the program.

>establish "what" a RECEIVER is giving CONSENT to receive. In the end,

I'm not sure what C/R does in this discussion.  I suppose the 
challenge can specify what content is permitted, but it provides no 
control (and some Nigerian-scam spammers *do* respond to C/R systems).

A while ago on this list I brought up the idea of having bulk-mailers 
categorize email at a more granular level.  In particular, I thought 
distinguishing between transaction related email "your shipment is on 
its way" and straight sales mail "we have a special on".  (I confess, 
the idea wasn't mine, but came out of discussions I'd had with one of 
the legit bulk email houses.)  At the time the response was rather 
negative.  Then again, this group hadn't really gotten into the 
consent thing at the time.

>diversity of needs can be met. Also, as with much of the Internet, once

This is really an aside, but that's a best practice that flies in the 
face of market realities.  Doing that without making the whole thing 
too complicated for the user to understand is extremely hard.  And if 
they don't understand, they tend to give up.  Messagefire's web site 
has complicated code for doing a lot of things, including viewing 
held messages safely on the web, providing webmail, and lots of other 
stuff.  But the single most complicated and difficult page to 
develop, and the one which we get the most feedback on, is the one 
where we let them report errors and give them options on how to make 
sure the error doesn't occur in the future.  (In other words--the one 
where we try and meet the diversity of their spam-blocking needs.) 
I'm sure it seems simple to us on this list.  Depending on what we 
know about the message you can block the user, block the domain, 
block the country, report it as abuse to an ISP, unsubscribe from the 
list, and (of course) tell us we made a mistake (reverse all that if 
we made the error in the other direction).  No big deal, right? 
Wrong.  Too many choices.  We tested it, and our beta customers just 
got confused.  They didn't *want* any options.  They didn't want the 
options to change.  They'd be happiest with a button at just said 
"Just deal with it.".  But if we took out choices, our advanced users 
(you know, the ones that make the purchasing decisions) felt too 
limited.  There are obvious solutions to that problem.  But the main 
issue is that in a competitive environment, the guy who has a "Just 
deal with it button" may well win over the one that lets you solve 
the problem correctly.

>selling their wares... all without their permission of course (yeah

Those are excellent arguments against content analysis.  Because in 
fact the people *transmitting* the message are not the same.  They 
aren't the same because the mainstream bulk mailers do *not* want to 
get blocked, and they know that if there are too many complaints, 
they *will* get blocked.  So long as  governments (and here I point 
my finger primarily at the U.S. Congress) don't change that dynamic 
by legitimizing unsolicited email, that will continue to be the state 
of affairs.  So then the question is, how do you tell the difference 
between the Norton Anti-Virus ad from an "unsanctioned" reseller and 
the one that you actually requested?  Clearly not by looking at the 
content.

Yes, if legitimate mailers start sending illegitimate, unsolicited 
content, then my argument has major problems.  That is very rare 
right now, and I don't expect that to change.  Mostly it occurs when 
a spammer tries to go legit and gets some real customers.  I've seen 
that happen with an online catalog I get.  I explained the problem to 
the catalog vendor and apparently I wasn't the only one, because 
within a few months he had switched bulk mailers.

>this practice!! - we refuse!!!)

Hey, the way I see it, they are the only people who actually do use 
spam for targeted marketing.  Their target is people who receive spam!

BEGIN RELEVANT CONSENT SECTION

>even by agreements they may have with that sender (explicit or implied).

I agree that there are lots of people who *think* they define what 
they want by content.  But in a wide open system I think they'd 
change their mind very quickly.  I'm looking for a new jacket right 
now.  If I sign up at a store I like and ask them to send me mail 
about jackets, I've just asked *them* to send me email about jackets. 
I don't want to hear from their affiliated companies, their vendors 
or their retail locations.  Nor do I want to hear from every other 
jacket manufacturer in the world.

To put that in consent terms.

Consent is first and foremost an agreement with a particular sender.

Secondarily it is an agreement about the content that can be sent to 
me by that sender.

If you're arguing that consent is first about content, and secondly 
about sender, then I disagree.

If you're arguing that content analysis is necessary in order to 
enforce a consent agreement, then I also disagree.  I believe the 
content clause of a consent agreement is primarily enforced by trust. 
Because if I can't trust a sender to listen to my content request, 
then clearly I can't trust them to maintain the overall integrity and 
privacy of the consent agreement itself.

Case in point.  Microsoft.  Many years ago I signed up on their site 
for something or other, and I happened to use my personal email 
address since I was between companies.  I requested that they not 
send me any content.  The email address was just for logging in.

Years later, and all of a sudden Micrsoft is sending that address 
virus alerts telling me to patch my (non-existent) Microsoft system. 
They think that this issue is so important that it overrides any of 
my content requests.  They think that this is so important that they 
provide no way for me to get off the list, or delete the login (I 
don't even thing the original place I signed up exists any more).  A 
content filter isn't going to fix that problem.  That's a trust 
problem.

END RELEVANT CONSENT SECTION

>is the critical task of the information age.

Ah.  Now that hits on something close to my heart--auto-filing my 
email.  But that's a very different class of activities.  In that 
case you're trying to identify content that was actually constructed 
so as to be understood.

>content analysis is part of that arsenal.

Yes!

>you then need a mechanism to manage that ability.

It *is* abuse and attacks.  And the key indicator is that when you 
try to fix it one way, they comes up with a new way to send it.  That 
is not a problem that normal content systems have to deal with.

You sound like someone who has a nail-gun and is trying to fire nails 
at the enemy.  I think that nail-gun is a fantastic tool for 
processing my email, but a machine gun will work much better on the 
spammers.
-- 
Kee Hinckley
http://www.messagefire.com/  Anti-Spam Service for Companies and Individuals
http://commons.somewhere.com/buzz/  Writings on Technology and Society