Reflections on CEAS 2009

The first session explored the dimension of spammer behaviour. The first paper observed that spam is generated through vast networks, and that pinpointing the original spam is difficult. Next, ‘Spamology: a study of spam origins’ explored the propagation of email addresses through spammers’ mailing lists. ‘Spamming botnets: are we losing the war?’ observed that the distribution of spam IP addresses is becoming more diverse, indicating that there are ever fewer ‘safe’ subnets that can be assumed to be uncompromised by spambots. Finally, in ‘How much did shutting down McColo help?’, Richard Clayton observed that while the volume of spam decreased acutely as the result of shutting down the large spam service provider, the decrease was temporary and consisted mainly of ‘easy to filter’ spam messages. The net effect was perhaps less than might be assumed from elementary measurements.

The second session considered the role of user input in spam filtering. First in this session was a paper considering the contrasting models of server-side vs. personal spam filtering, which observed that a personal spam filter can be trained using the results of a commercial server-side filter, requiring no input from the user. Next, ‘Going mini: extreme lightweight spam filters’ considered the problem of providing personalized spam filters in a server environment where a very limited amount of memory is available per user. The final paper in this session addressed the same problem by hashing personal and community judgements into a common feature space. The results presented indicate that this approach improves filter performance for those users who train the system as well as for those who don’t – a win-win situation.

The third session considered anti-spam techniques that might be employed by a large email service provider. The first paper, ‘Router-level spam filtering using TCP fingerprints’, presented an approach to identifying spam from the router’s perspective, where packets rather than complete messages are handled. Next, ‘An anti-spam filter combination framework for text-and-image emails’ considered how to combine the results of image- and text-based filters to improve overall accuracy. A group from Texas A&M University presented a tool designed to translate SpamAssassin regular expression rules into POSIX. SpamAssassin is slow, in large part due to the fact that it uses patterns written in Perl, which is an interpretive language. When translated into POSIX regexp syntax, the patterns can be compiled and executed much more efficiently. The translation is inexact, but yields good results. The final paper in this section explored the idea of using new spam and old ham to train products – based on the premise that spam changes much more quickly than non-spam, but is also much easier to collect.

In the next session, ‘An empirical analysis of phishing blacklists’ explored the impact of phishing page warning messages on the user – phishing detection is of little use unless the user heeds the warning. ‘Anti-phishing landing page: turning a 404 into a teachable moment for end users’ investigated a user interface design in which links from phishing pages lead to educational pages explaining why the user was duped, and how to be more wary. The final paper in this session examined the issue of inadvertently addressing email to the wrong user, and proposed a mechanism to warn the user in many such cases.

The paper ‘Training SpamAssassin with active semi-supervised learning’ considered the idea of asking the user to label a small subset of messages – selected by the filter – as spam or non-spam. The overall impact is to lessen the burden on the user, while providing better personalized filtering. The paper ‘Feature weighting for improved classifier robustness’ considered the problem of incorrect training examples: spam messages labelled as non-spam, and vice versa. Such examples may occur due to user error or due to a spammer being able to label messages (for example, in a collaborative filtering system).

In the final session, ‘Extracting product information from email recipients using Markov logic’ considered the problem of identifying electronic transactions. For example, a participant in CEAS may have subscribed to an information list, used a web system to submit a paper, and a different web system to register. How can an email system recognize and accumulate the various messages related to the conference? ‘CentMail: rate limiting via certified micro-donations’ considered an approach to engage both sender and recipient, excluding the spammer. Like all previous proposals for proof of payment, this paper generated controversy. Finally, ‘A human factors approach to spam filtering’ suggested that the user should be engaged differently, labelling rather than filtering spam.