On Wed, 11 May 2005, Chris Edwards wrote:
> For detecting local users sending out spam, the OP might like to check out
> Richard Clayton's paper:
> http://www.cl.cam.ac.uk/~rnc1/extrusion.pdf
> which suggests watching failure rates makes a better metric than simple
> submission rate.
This is true if you have a very heterogeneous user population, as is the
case with Demon (where Richard works). I'm expecting this will be less of
a problem for us, since our user-base is more uniform and we have
separated message submission for MUAs from outgoing relays for MTAs. We
will still need to classify senders according to their typical sending
rate, but this should be fairly manageable.
Tony.
--
<fanf@???> <dot@???>
http://dotat.at/ ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}
