Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks

From: "Peter Kay" <[email-masked]>
Date: Thu, 31 Jul 2003 21:42:54 -1000

I think you've laid out a good foundation. We would be happy to provide
reasonable computing/account/domain/etc resources to assist.

Peter

> -----Original Message-----
> From: Alan DeKok [mailto:[email-masked]] 
> Sent: Thursday, July 31, 2003 4:28 PM
> To: [email-masked]
> Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - 
> Titan Key reduces spam attacks 
> 
> 
> Paul Judge <[email-masked]> wrote:
> > He has put forth some very preliminary data. He is requesting input 
> > towards a better analysis. Those that have constructive feedback 
> > please provide it.
> 
>   "More data, please!"
> 
> > Ok, what else would be interesting to see?
> 
>   There was some discussion on this topic a few months ago, 
> but it got lost in the volume of list traffic.
> 
> > A broader set of test cases ( more addresses, different 
> domains, ...) 
> > A control set of email addresses with different systems (no spam 
> > detection, detection with a different response such as: DSN, 
> > challenge, etc) What else?
> 
>   I believe that there are three orthogonal characterizations:
> 
> 	a) time
> 	b) recipient domain or name
> 	c) anti-spam system
> 
>   For each combination of (time, recipient, anti-spam), there 
> are two numbers which should be collected:
> 
> 	a) total number of messages received
> 	b) of that, the number of messages determined to be spam
> 
> 
>   To avoid political issues, I would suggest that 
> sender-oriented measurements should be explicitely not asked 
> for, or collected.  I would also suggest that the anti-spam 
> systems be explicitely not named, other than as a broad 
> characterization such as "challenge-response", etc.
> 
>   An independent third party should collect these 
> measurements.  I believe there was a volunteer a few months 
> back, who was waiting for consensus from the group, before he 
> would start the actual collection of data.
> 
>   The data analysis should be fairly straightforward.  After 
> a cursory evaluation of the data to avoid political issues, 
> the raw data should be made available to all.  Multiple 
> independent analyses can then be done.
> 
> 
>   Other measurements which should be done are measurements of 
> SMTP weirdness which doesn't involve message delivery.  e.g. 
> "connect, EHLO, disconnect".  These behaviours are closely 
> related to spam, but in many cases do NOT involve anti-spam 
> systems, as no messages are delivered.  I believe that the 
> anti-spam systems can then be further sub-divided into two 
> categories: message-based systems, and network/SMTP systems.
> 
>   Alan DeKok.
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 01 Aug 2003 17:08:10 -0400

> reasonable computing/account/domain/etc resources to assist.

  I think for transparency, it would be better to have a third party
(non-vendor) do the data collection.

  What I would suggest is to collect the data with respect to the use
of your product, and to make that data public, where possible.  If a
few vendors do that, then it will not only be easier to compare
solutions, it will be easier to see where ASRG should focus its
efforts.

  Alan DeKok.