Re: [9fans] re: spam filtering fs

[steve.simon@snellwilcox.com]

[-- Attachment #1: Type: text/plain, Size: 623 bytes --]

Markov chains are the next generation of spam filtering tools
(some of the GPLed tools already do this).

It involves keeping frequencies for token sequences rather than just
individual tokens. It makes the spammers job a lot harder, though
not impossible. The downside is the increase in filters database size
as the number of tokens increases exponentially with chain length.

It all comes down to making the filters model of written emails have more
parameters and being more accurate than the spammers until in the limit
the spam email looks like a valid one (IE. it contains usefull information :-)

-Steve

[-- Attachment #2: Type: message/rfc822, Size: 1092 bytes --]

From: 9fans@cse.psu.edu
To: 9fans@cse.psu.edu
Subject: [9fans] re: spam filtering fs
Date: Mon, 01 Sep 2003 21:31:16 +0100
Message-ID: <1270037699@snellwilcox.com>

in light of recent forged To: & From:
the challenge/response method is going to generate twice as much traffic for such a mail.

As far as I can tell, without trying it, the example pipeto sends a copy of the message, virus payload and all to whoever the From: headers suggest, obviating the need to infect the plan9 host to spread itself.

You also run the risk of ending up sending to an infected host and throwing your email address into another steaming pot.

The next generation will snarf text from existing mails with the intention of defeating Bayes type filters.