6. Solutions - Detection (was Re: [Asrg] Two ways to look at spam)

Yakov Shafranovich <research@solidmatrix.com> Wed, 02 July 2003 16:15 UTC

Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29492 for <asrg-archive@odin.ietf.org>; Wed, 2 Jul 2003 12:15:47 -0400 (EDT)
Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19XkGK-0003ii-6s for asrg-archive@odin.ietf.org; Wed, 02 Jul 2003 12:15:20 -0400
Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h62GFGdG014294 for asrg-archive@odin.ietf.org; Wed, 2 Jul 2003 12:15:16 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19XkGK-0003iT-22 for asrg-web-archive@optimus.ietf.org; Wed, 02 Jul 2003 12:15:16 -0400
Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29406; Wed, 2 Jul 2003 12:15:12 -0400 (EDT)
Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19XkGI-0003Gz-00; Wed, 02 Jul 2003 12:15:14 -0400
Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19XkGI-0003Gw-00; Wed, 02 Jul 2003 12:15:14 -0400
Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19XkG6-0003ZQ-5u; Wed, 02 Jul 2003 12:15:02 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19XkFF-0003Jp-EU for asrg@optimus.ietf.org; Wed, 02 Jul 2003 12:14:09 -0400
Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29221 for <asrg@ietf.org>; Wed, 2 Jul 2003 12:14:05 -0400 (EDT)
Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19XkFE-0003EB-00 for asrg@ietf.org; Wed, 02 Jul 2003 12:14:08 -0400
Received: from 000-257-002.area7.spcsdns.net ([68.27.243.209] helo=68.27.243.209 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19XkFB-0003Dx-00 for asrg@ietf.org; Wed, 02 Jul 2003 12:14:06 -0400
Message-Id: <5.2.0.9.2.20030702121302.00b9f008@std5.imagineis.com>
X-Sender: research@solidmatrix.com
X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9
To: Kee Hinckley <nazgul@somewhere.com>
From: Yakov Shafranovich <research@solidmatrix.com>
Subject: 6. Solutions - Detection (was Re: [Asrg] Two ways to look at spam)
Cc: asrg@ietf.org
In-Reply-To: <p06001717bb2772375593@[192.168.1.104]>
References: <5.2.0.9.2.20030629012311.00bd5e38@pop.pocketmail.com> <5.2.0.9.2.20030629012311.00bd5e38@pop.pocketmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
X-MimeHeaders-Plugin-Info: v2.03.00
X-GCMulti: 1
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=unsubscribe>
List-Id: Anti-Spam Research Group - IRTF <asrg.ietf.org>
List-Post: <mailto:asrg@ietf.org>
List-Help: <mailto:asrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=subscribe>
List-Archive: <https://www1.ietf.org/pipermail/asrg/>
Date: Wed, 02 Jul 2003 12:13:40 -0400

At 01:19 PM 7/1/2003 -0400, Kee Hinckley wrote:

>At 1:37 AM -0400 6/29/03, Yakov Shafranovich wrote:
>>It seems to me that the members of the group are looking at the spam 
>>problem from two different angles:
>>
>>1. Network Abuse - some people including Barry Shain and Eric Brunner 
>>specifically, have been proposing that we look at the entire spam problem 
>>as one of network abuse. The Internet in general, and SMTP in particular, 
>>have been built as open systems trusting all network users to behave 
>>themselves. Spam is caused by those users abusing the network and its 
>>resources.
>
>I've been thinking about this every since Barry posted is "call every 
>phone" mail.  And it seems to me that there is another way to look at 
>solving the problem.  Or rather, not _solving_ the problem, but addressing it.
>
>How about technical solutions (and DCC is an example of this) for 
>detecting spam in progress.  In other words.  When some set of machines 
>start spewing millions of messages, why shouldn't there be a dynamically 
>early alert-system for detecting that.  Perhaps even one that could be 
>installed on gateway machines--not just mail servers?

Take a look at DShield.org


_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg