In message <20050512144430.ACE394511A@???>, Matt
Fretwell <mattf@???> writes
> If I remember correctly, someone once posted a paper correlating the
>volume sent with regards to invalid recipients and recipients per message,
>and also to the general usage patterns seen from each client. It was
>literally a three to four pronged approach, working on cumulative data by
>building the info from the logs.
there are indeed people working on this sort of idea, eg:
S. J. Stolfo, S. Hershkop, K. Wang, O. Nimeskern and C. Hu: A Behavior
Based Approach to Securing Email Systems, Proceedings Mathematical
Methods, Models and Architectures for Computer Networks Security
(MMMACNS- 2003), LNCS 2776, Springer, 2003, pp. 57--81.
http://www1.cs.columbia.edu/ids/publications/EMT-ACNS03.pdf
they are also looking at an academic environment and there is the
inbuilt assumption that their users won't suddenly start running mailing
lists (or inviting all their friends to a birthday party)
>( BTW, if I am drifting off topic, let me
>know. I have only lightly perused the thread since it started :)
it's not a spam-fighting list, but things-that-sysadmins-can-do seem to
be tolerated :)
a further caution (again the academics may meet this a lot less) is that
a great many people seem to be forwarding email these days -- from
company accounts to home accounts, or onward to Hotmail for their road-
warriors to pick up, or just to their offspring at Uni..
If this forwarded email didn't go through the ISP filtering system (or
went through <n> minutes ago, before the latest tweak) then the presence
of filters on outgoing email (or better/different filters at the new
destination) will cause a delivery failure... and you don't want to get
over-excited with a customer who's merely forwarding junk rather than
generating it or letting it into the system in the first place
- --
richard Richard Clayton
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. Benjamin Franklin
