Re: Labelling spam through the analysis of protocol patterns

Some random thoughs... (I've read quickly the paper and just got the idea).

1. In a standalone setup, one incoming mail server (or other device), can detect a spammer after 
some number of messages received. It's more a method to detect spammers than to filter spam. Sure, 
after a spammer have been spoted, one can reject connections coming from him.

2. In a collaborative setup (many distributed devices/probes) this may be used to identify networks 
of botnets or to dynamicaly manage some kind of blacklist.

3. What's interesting to evaluate is the marginal gain of this method when filtering spam, or how it 
performs when compared with some other methods

4. What I can see at our domain is that classical spam is easily filtered. What's harder are 
phishings, which most of the time comes from compromised accounts or UCE (unsollicited commercial 
email), which most of the time filter vendors say that aren't spam. It seems to me that both kind of 
unwanted messages aren't detected by this method.

On 11/27/2014 01:44 AM, Martijn Grooten wrote:
> (In the interest of full disclosure, I should say that this paper was
> published by my company and presented at a conference we organise. I
> have not been involved in the research myself.)
>
> Alexandru Trifan and Andrei Husanu, two researchers from Bitdefender in
> Romania, published a paper in which they looked at IP packet sizes in
> SMTP connections and how oddities in the sizes could help spot a
> spammer. I thought it is a neat idea, that may have applications in
> other areas of security.
>
> The full paper is here:
> https://www.virusbtn.com/virusbulletin/archive/2014/11/vb201411-protocol-patterns
>
> Here's a video of the conference presentation:
> https://www.youtube.com/watch?v=cNny5i0eQ-8
>
> Martijn.
>
> -
> This is the asrg mailing list.  To change your subscription settings, see
> http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org




-- 

  Envoyé de ma machine à écrire.
  ---------------------------------------------------------------
   Spam : Classement statistique de messages électroniques -
          Une approche pragmatique
   Chez Amazon.fr : http://amzn.to/LEscRu ou http://bit.ly/SpamJM
  ---------------------------------------------------------------
  Jose Marcio MARTINS DA CRUZ            http://www.j-chkmail.org
  Ecole des Mines de Paris                   http://bit.ly/SpamJM
  60, bd Saint Michel                      75272 - PARIS CEDEX 06

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org