Subject: [Asrg] 2. Analysis (specifically, trap addresses)

From: "Terry Sullivan" <[email-masked]>
Date: Wed, 01 Oct 2003 12:21:35 -0500

This particular message actually crosses a couple of different area 
boundaries.  (I assume the message will be recharacterized if/however 
the chairs see fit.)

A little while back, I posted a message solicting ideas for a kind of 
"shakedown run"--a "pilot project" that could be run in a short 
period of time, and I promised to summarize the results back to the 
list.

Well, I received a total of two responses.  One proposed an 
analysis-and-characterization of "passive" (i.e., archival) data (an 
excellent proposal, but not quite suitable for "shakedown" purposes).  
The second suggested studying greylisting along the lines of evan 
harris' previous work.  I've had a brief flurry of off-list 
correspondence with folks regarding greylisting, and any pilot 
project would, among other things, need to establish its own baseline 
data.

Again, the whole idea behind doing a pilot study was to discover what 
special requirements or problems anti-spam research studies might 
face.  And I think we've discovered the first: trap addresses and 
their traffic.

Data from multiple independent sources (including Liam Meany, Scott 
Nelson, and myself) indicate that "otherwise identical" trap 
addresses receive *vastly* different amounts of spam traffic.  This 
unexplained variance in spam traffic is *very* large and all of it is 
"statistically 'bad' variance."  That "bad variance" at least 
potentially compromises any ASRG effort that might use trap 
addresses.  (Without some sort of "balancing" in trap address 
traffic, experimental effects might need to be as as large as an 
order-of-magnitude in order to achieve "statistical significance.")

I can imagine a couple of possible solutions (though there may also 
be others I haven't thought of).  One might be for ASRG to "borrow" 
trap addresses from large organizations/ISPs who were (or at least 
might be?) willing to share.  The other is for ASRG to have an 
independent trap address maintenance effort.  I floated this latter 
idea a while back, and it generated almost no interest at all.

Obviously, a trap-address maintenance effort would be privvy to 
extremely sensitive data, and would probably need to be a handful of 
people (at most), whose efforts where "closed" to the larger group.  
Ultimately, the need/desired outcome would be on-demand availability 
of an appropriate number of comparably-trafficked trap addresses for 
research purposes, said addresses to be selected randomly from a 
larger pool.

Ultimately, it seems to me that there is a need for a some sort of 
active (though not necessarily particularly time-consuming) trap 
address maintenance effort.  Otherwise, the only real opportunity for 
*research* (as opposed to debate) lies in analysis/characterization 
of archival data.

- Terry

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 1 Oct 2003 20:03:18 -0400

>"statistically 'bad' variance."  That "bad variance" at least

I had reason to think about this yesterday.  I was going over the 
records from our spam filter, and somewhere.com's email in 
particular.  I discovered that one single spammer (see 
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL6857 for details) 
attempted to initiate a connection with our anti-spam proxy server 
500,000 times over a day and half or so (4 connection attempts a 
second, non-stop).

It's frequently been said that there are really only about 200 major 
spammers.  And certainly there are fewer types of spamming software 
than that, and fewer sources of target addresses.

I think we get fooled somewhat by the large amount of spam and assume 
that we are dealing with a very large sample size; one which should 
therefore show standard statistical distributions.  If in fact the 
actual number of senders (or software/target combinations) is quite 
small, than we will in fact *not* see standard distributions--even if 
the volume of spam itself is very high.  What we are sampling is not 
spam, but spammer targets/techniques.  Accurately measuring such a 
small population may require a much greater distribution of 
spamtraps.  And it's definitely not a random population.  Spammers 
specialize.  There are some who do nothing but AOL accounts.  And as 
my experience suggests, there are apparently some who are simply 
broken.
-- 
Kee Hinckley
http://www.messagefire.com/         Next Generation Spam Defense
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: Dennis Gearon <[email-masked]>
Date: Wed, 01 Oct 2003 19:47:55 -0700

Kee Hinckley wrote:

> my experience suggests, there are apparently some who are simply broken.

Well, there are just that many dedicated spammers, then I personally 
would make the assumption that at least one of them is on this list. I 
know if that were MY business, **I'd** be here.

-- 
"You are behaving like a man",
is an insult from some women,
a compliment from an good woman.

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 02 Oct 2003 00:07:24 -0400

> *research* (as opposed to debate) lies in analysis/characterization 

What is the bottom line? Can you elaborate on your desired steps and 
what resources you require?

As for archival data, SpamArchive and others provide lots of it. The FTC 
also maintains a spam archive and they might be open to the idea of 
running something against it if we ask them.