Re: Email Web of Trust - Defining the metrics

Jeff,

At 10:05 PM 3/16/2004, Jeff Silverman wrote:
>Mark Baugher wrote:
>
>>...
>>Regarding the counters, I think this is something that the entire 
>>subgroup needs to participate in and contribute to.  If it were up to me, 
>>I would have two classes of counters, one for the mail that the relay 
>>flagged as "probably spam" and the second class of counters would be for 
>>mail that the user rejected as "spam."  This is probably naive.  And it 
>>assumes that there is some authenticated means for a user agent to 
>>communicate the disposition of a message to a designated MTA.
>>
>>There are probably other objects appropriate for an "antispam MIB" that 
>>have nothing to do with reputation such as counts of messages labelled as 
>>"probably forged."
>>
>>I'm fine with this if some other people are willing to contribute.
>>Several postings to this thread tell me that several people are at least 
>>thinking about this problem.
>...
>
>Regarding the counters, I would like to see number of messages 
>successfully sent and the number of messages successfully received.

That would be sent to and received from a particular IP address or owner of 
an IP address?

>My observation is that spammers send thousands of messages and receive few 
>- normal people receive few messages and send fewer.  So, in my mind, the 
>ratio of inbound to outbound messages is telling.  The other nice thing 
>about the ratio of inbound to outbound messages is that it yields a 
>floating point number which is directly related to the probabilty that a 
>messages is spam.  If a given MTA has an outbound to inbound ratio of a 
>thousand, then probably, it is a spammer.  If a given MTA has an outbound 
>to inbound ratio of 0.5, then it is probably not a spammer.
>The ISP that runs the MTA can look at these numbers himself and, if he 
>finds one of his users is spamming, can invoke a contract provision to Do 
>Something about it.

That collection, analysis and presentation would be done by the SNMP 
antispam MIB management application, which would poll or receive alerts 
from the SNMP management entity.  The management entity maintains the MIB 
as instrumentation to its protocol processing.


>It is not clear to me who maintains the SNMP server that holds the 
>counters, could somebody please address that question?

There is the entity that maintains the counters and one or more management 
applications that read them, reset them, and set alerts on the counters.

Mark



>Jeff