Re: Some last info regarding analysis

We use URL blocking here, but it seems, for our domain, that it is 
somewhat limited.

We begun adding some URLs a day, and the number of URLs grew till little 
more than a thousand. After that, I begun tweaking the URLs to lower the 
number. I also begun to remove URLs that weren't seen for more than four 
months. Now, I have only 130 URLs.

OBS - the time spent by the filter looking for regular expressions grows 
fast with the number of URLs (faster than linear).

So, I think there shall be some number of tweaked URLs that can be used 
to get some effectiveness with little maintainance - adding/removing few 
URLs a week.

After that threshold, the work necessary to increase effectiveness grows 
vary fast, and you need to add/remove too many expressions a week.

So, IMO, it's better to use URLs to get some effectiveness and complete 
it with a different approach.

This is what I feel for our domain (education/research institution). 
This probably depends on the size of the domain (number o 
users/addresses - messages a day).

Best,

Jose-Marcio


Yakov Shafranovich wrote:
> Kurt Magnusson wrote:
> 
>>
>> And since you bring up spam sources, from my own work, the phone 
>> numbers and URLs is still an important source of identification. After 
>> some months with a low number of spams in the mailbox, 3 weeks ago I 
>> hade a surge (from 1-2 a day to 10-15 of a steady 30-35 spams/day) and 
>> suspected a design flaw, but after analysing the spams it was a number 
>> of new domains. After extracting ca 10-15 new domains, I was back to 
>> my original figures.
>>
> 
> Kurt,
> 
> I attended the NIST workshop on spam yesterday and two ISPs (AOL and 
> Yahoo) gave a presentation on their anti-spam methods. They have begun 
> to utilize URL blocking which sounded similar to what you are trying to 
> do. So far it seems pretty effective, although no exact figures were 
> provided on the false positives.
> 
> Yakov
> -------
> Yakov Shafranovich / asrg <at> shaftek.org
> SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
> "One who watches the wind will never sow, and one who keeps his eyes on 
> the clouds will never reap" (Ecclesiastes 11:4)
> -------
> 
> 



-- 
  ---------------------------------------------------------------
  Jose Marcio MARTINS DA CRUZ           Tel. :(33) 01.40.51.93.41
  Ecole des Mines de Paris              http://j-chkmail.ensmp.fr
  60, bd Saint Michel                http://www.ensmp.fr/~martins
  75272 - PARIS CEDEX 06      mailto:[email protected]