Subject: [Sipping] RE: New draft: SPAM score for SIP

From: "Dan Wing" <[email-masked]>
Date: Fri, 7 Sep 2007 08:16:30 -0700

I haven't seen any discussion on this draft.  In brief, it suggests a new
"spam" and "spam-detail" elements in the "Via:" header, like this:

       Via: SIP/2.0/UDP biloxi.com;branch=z9hG4bKnashds8
         ;received=192.0.2.1
  -->    ;spam=-5
  -->    ;spam-detail="Hormel-1.0;whitelist=-10,call_volume=5"

In internal discussions with some of our anti-spam people, they suggest using
a q-value-like range of 0-100 for the spam values (0=not spam, 100=definately
spam), rather than using the spamassassin-like scoring that is in the -00
version of the document (where a high negative value means it isn't spam, and
a high positive value means it's spam).

Does anyone feel spam scoring needs standardization?

-d

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Saverio Niccolini
> Sent: Monday, August 27, 2007 4:31 AM
> To: Signaling TO Prevent SPIT; SIPPING LIST
> Cc: [email-masked]; Jon Peterson
> Subject: [spitstop] New draft: SPAM score for SIP
> 
> Dear all,
> 
> following the discussions and what we previewed during the SIPPING
> Ad-Hoc meeting in Chicago, we recently submitted a draft on the spam
> scoring mechanism for SIP.
> 
> Please find it here:
> http://tools.ietf.org/html/draft-wing-sipping-spam-score
> 
> Since the discussion was so controversial during last meeting, we
> would like to stimulate discussion over the mailing lists to try to
> converge on this.
> 
> Cheers,
> Saverio
> 
> ============================================================
> Dr. Saverio Niccolini
> Senior Research Staff Member
> NEC Europe Ltd., NEC Laboratories Europe, Network Division	
> Kurfuerstenanlage 36, D-69115 Heidelberg
> Tel.     +49 (0)6221 4342-118
> Fax:     +49 (0)6221 4342-155
> e-mail:  [email-masked] <-- !!! NEW ADDRESS !!!
> ============================================================
> NEC Europe Limited Registered Office: NEC House, 1 Victoria
> Road, London W3 6BL Registered in England 2832014
>  
>  
> _______________________________________________
> spitstop mailing list
> [email-masked]
> https://listserv.netlab.nec.de/mailman/listinfo/spitstop
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Fri, 07 Sep 2007 10:32:23 -0500

> Does anyone feel spam scoring needs standardization?

I don't know about standardization, but it is indeed more intuitive
to have a q-value like range from 0-100, probably expressed as a
percentage.

I just finished a project we were doing on phishing; our filter
produced a number that represented -- as a percentage -- the
confidence that a particular email was a fishing expedition.
It was much easier to express the result as a percentage to
users of the system instead of representing the results on a
sliding scale a la Spamassassin.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs

---

From: "Charzinski, Joachim (NSN - DE/Germany - MiniMD)" <[email-masked]>
Date: Mon, 10 Sep 2007 13:39:27 +0200

> sliding scale a la Spamassassin.

Yes, a 0..100 is more intuitive. But: how do you differentiate 
between "This is definitely not SPIT" and "I do not have enough 
information to rate this caller"? That's what the second half 
of the rating scale can be used for. 

> Does anyone feel spam scoring needs standardization?

Not necessarily full standardization (with mathematical 
definitions how numbers have to be interpreted) but some 
basic semantics need to be clarified before a SPIT rating 
system becomes useful: 
- what parameters are used
- what do those parameters mean (qualitatively)
With this basic information, users (technically interested users 
at least) can figure out how to set their acceptance thresholds. 

Optionally, also the following could be standardized:
- what scale are the values on (see the discussion above)
- what does a certain range of values mean in normal language 
  e.g.: 
    0..20 most probably not a SPIT call
    20..50 probably a normal call, but might be SPIT
    50..80 probably SPIT, but might be a normal call
    80..99 most probably not a normal call
   100 definitely SPIT. We (the operator) know this because the 
     sender paid us for distributing this message :-)

Joachim. 

> ext Vijay K. Gurbani
> Sent: Friday, September 07, 2007 5:32 PM
> To: Dan Wing
> Cc: [email-masked]; 'SIPPING LIST'; 'Jon Peterson'; 'Signaling 
> TO Prevent SPIT'
> Subject: Re: [spitstop] [Sipping] RE: New draft: SPAM score for SIP
> 
> Dan Wing wrote:
----------------------------------------------------------
Nokia Siemens Networks
 
Joachim Charzinski
Principal Innovator

Machtlfinger Str. 1
D-81379 Muenchen
Germany
Tel: +49 89 722 46803

[email-masked] 
http://www.nokiasiemensnetworks.com/global/

Think before you print

Nokia Siemens Networks GmbH & Co. KG - Sitz der Gesellschaft: München / Registered office: Munich - Registergericht: München / Commercial registry: Munich, HRA 88537 - WEEE-Reg.-Nr.: DE 52984304 - Persönlich haftende Gesellschafterin / General Partner: Nokia Siemens Networks Management GmbH - Geschäftsleitung / Board of Directors: Joachim Malterer, Lydia Sommer - Sitz der Gesellschaft: München / Registered office: Munich - Registergericht: München / Commercial registry: Munich, HRB 163416

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 10 Sep 2007 12:20:52 -0700

> From: Charzinski, Joachim (NSN - DE/Germany - MiniMD) 
> [mailto:[email-masked]] 
> Sent: Monday, September 10, 2007 4:39 AM
> To: Signaling TO Prevent SPIT; Dan Wing
> Cc: [email-masked]; SIPPING LIST; Jon Peterson
> Subject: RE: [spitstop] [Sipping] RE: New draft: SPAM score for SIP
> 
> Vijay wrote: 

A missing score, or a score of 50 (using the 0-100 scale) both
indicate the same thing:  this might or might not be spam.

>      sender paid us for distributing this message :-)

Thanks, I'll add something like that to the draft.
-d

> Nokia Siemens Networks GmbH & Co. KG - Sitz der Gesellschaft: 
> München / Registered office: Munich - Registergericht: 
> München / Commercial registry: Munich, HRA 88537 - 
> WEEE-Reg.-Nr.: DE 52984304 - Persönlich haftende 
> Gesellschafterin / General Partner: Nokia Siemens Networks 
> Management GmbH - Geschäftsleitung / Board of Directors: 
> Joachim Malterer, Lydia Sommer - Sitz der Gesellschaft: 
> München / Registered office: Munich - Registergericht: 
> München / Commercial registry: Munich, HRB 163416

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 10 Sep 2007 18:12:08 -0400

> Thanks, I'll add something like that to the draft.

I don't think this is too helpful. There is no meaningful difference  
between a score 49 and score 50 call. Indeed, in the list above, a  
call with score 20 is both "most probably not a SPIT Call", and  
"might be SPIT". In practice, these probabilities tend to be fairly  
meaningless. For example, a version of Spam Assassin we used marked  
every non-spam message as having a spam probability of 7%, although  
far fewer of those non-spam messages were indeed spam. This gets into  
deep discussions of probability philosophy, but it is pretty  
meaningless to say "this message has a 70% chance of being spam".  
It's similar in accuracy to 20% chance of rain being predicted for  
tomorrow. Does anybody check whether only one of the five 20% days  
actually had rain?

A scale is useful as long as the limitations are remembered (for  
example, doing arithmetic on these values is probably dubious), but  
dividing it into segments isn't, except for the endpoints.

Henning

---

From: "Eric Rescorla" <[email-masked]>
Date: Mon, 10 Sep 2007 16:20:16 -0700

I agree it makes sense to define what the endpoints of the range are
and have some notion of what a score of X means with respect to a
score of Y. That said, I doubt it matters whether the defined
endpoints are [0,100] or [pi, 2pi]. It seems like a simple matter to
map one range onto the other if you don't like whatever people define

-Ekr