Re: thoughts on spam

[Stainless Steel Rat <ratinox@peorth.gweep.net>]

* "Jason R. Mastaler" <jason-dated-1005692781.f201f7@mastaler.com>  on Mon, 05 Nov 2001
| Yup.  That works until the spammers figure this out and start to use
| different words and phrases.  This is an time-wasting infinite loop.

No, it isn't.  Watch.

Take a well-known spam-friendly but otherwise legitimate mail service like
mail.ru.  Yes, they really should lock things down, but they do not, and my
company has several customers who use mail.ru as their mail service.
Sucks, but we're stuck with it.  Add spam for "Super Pheromones" which was
originated there, or at least appears to be.  Here is how it is dealt with
heuristically using a scoring system.

The spam-friendly ISP gives the message a base score of 1000.  The first
instance of the word "pheromone" is worth 500 points and each additional
occourance is worth 100 points (the message I am using as an example has
four occourances).  The HTML-only message, no text part, is worth 500
points.  There are additional checks that can be applied, but I am keeping
this example simple.

We decide to set our threshold to 2200.  This will cause any message that
orginates from mail.ru or another known spam-friendly source (1000), is
HMTL only (500), and contains the word "pheromone" three times or more
(700) to be marked as spam.  No matter how much the spammer changes his
form letter, the product he is advertising is going to be mentioned several
times, if he doesn't mention his product and what it does then his
advertising is going to fail.  That is what you scan for.

This also works for "You gotta see this", which dubiously advertises
unsecured credit cards, sattelite descramblers, long distance telephone
theft, water and electric theft, X-Ray envelope spray, internet sleuth,
radar jammers, anonymous mail relaying, some kind of test cheat scam,
another credit scam, how to pass drug tests, cable TV theft, lie detector
fakout, and lockpicking tricks.

The actual scores and threshold values are arbitrary, and there are some
useful formulae for calculating keyword weights depending on how agressive
you wish to be.

Now, this message would get a score of absurdly high because of the 14 "you
gotta see this" products (for only $19.95!), which is why a better keyword
weighting system might be to start small and increase by some scaling
factor.  So the first instance of "pheromone" would be 50 points, the
second 250 points and the third 500 points, for a total of 800 points.
I'll let you know what spambouncer says the score of this message is once I
get it back from the list :).
-- 
Rat <ratinox@peorth.gweep.net>    \ Warning: pregnant women, the elderly, and
Minion of Nathan - Nathan says Hi! \ children under 10 should avoid prolonged
PGP Key: at a key server near you!  \ exposure to Happy Fun Ball.