Preventing E-mail Spam: The Conceptualization and the Analysis of an Infrastructure Framework - Schryen, Guido
Spamming remains a form of Internet abuse, which burdens the Internet infrastructure, is generally regarded as an annoyance, and is said to cause a huge economic harm. Many technological, organizational, and legislative anti-spam measures have already been proposed and implemented, but have not led to any substantial decrease in the number of spam e-mails. We propose a scalable and flexible infrastructure framework that integrates several anti-spam measures and that features both a technological and an organizational facet. The key element of our infrastructure is a new organizational unit that reliably and transparently limits the number of e-mails that can be sent per day and per account. We also analyze the proposed framework in terms of its theoretical effectiveness, the required resources, and its limitations.
Keywords: Email; Infrastructure; Internet; Spam

Do anti-spam measures effectively cover the e-mail communication network? A formal approach - Schryen, Guido (The Journal of Information Systems Security (AIS Special Interest Group in Security))
Spam e-mails have become a serious technological and economic problem. Up to now, by deploying complementary anti-spam measures, we have been reasonably able to withstand spam e-mails and use the Internet for regular communication. However, if we are to avert the danger of losing the Internet e-mail service in its capacity as a valuable, free and worldwide medium of open communication, anti-spam activities should be performed more systematically than is currently the case regarding the mainly heuristic, anti-spam measures in place. A formal framework, within which the existing delivery routes that a spam e-mail may take, and anti-spam measures and their effectiveness can be investigated, will perhaps encourage a shift in methodology and pave the way for new, holistic anti-spam measures. This paper presents a model of the Internet e-mail infrastructure as a directed graph and a deterministic finite automaton and draws on automata theory to formally derive the spam delivery routes. The most important anti-spam measures are then described. Methods controlling only specific delivery routes are evaluated in terms of how effectively they cover the modeled e-mail infrastructure; methods operating independently of any particular routes receive a more general assessment.
Keywords: e-mail; spam; e-mail infrastructure; anti-spam measures; spamming options

The Impact that Placing Email Addresses on the Internet has on the Receipt of Spam ? An Empirical Analysis - Schryen, Guido (Computers & Security)
Email communication is encumbered with a mass of email messages which their recipients have neither requested nor require. Even worse, the impacts of these messages are far from being simply an annoyance, as they also involve economic damage. This manuscript examines the resource ?email addresses?, which is vital for any potential bulk mailer and spammer. Both a methodology and a honeypot conceptualization for implementing an empirical analysis of the usage of email addresses placed on the Internet are proposed here. Their objective is to assess, on a quantitative basis, the extent of the current harassment and its development over time. This ?framework? is intended to be extensible to measuring the effectiveness of address-obscuring techniques. The implementation of a pilot honeypot is described, which led to key findings, some of them being: (1) Web placements attract more than two-thirds (70%) of all honeypot spam emails, followed by newsgroup placements (28.6%) and newsletter subscriptions (1.4%), (2) the proportions of spam relating to the email addresses? top-level domain can be statistically assumed to be uniformly distributed, (3) More than 43% of addresses on the web have been abused, whereas about 27% was the case for addresses on newsgroups and only about 4% was the case for addresses used for a newsletter subscription, (4) Regarding the development of email addresses? attractiveness for spammers over time, the service ?web sites? features a negative linear relationship, whereas the service ?Usenet? hows a negative exponential relationship. (5) Only 1.54% of the spam emails showed an interrelation between the topic of the spam email and that of the location where the recipient?s address was placed, so that spammers are assumed to send their emails in a ?context insensitive? manner. The results of the empirical analysis motivate the need for the protection of email addresses through obscuration. We analyze this need by formulating requirements for address obscuring techniques and we reveal to which extent today?s most relevant approaches fulfill these requirements.
Keywords: Address-obfuscating techniques; email; empirical analysis; honeypot; security by design; security by obscurity; spam

An e-mail honeypot addressing spammers' behavior in collecting and applying addresses - Schryen, Guido (Proceedings of the 6th IEEE Information Assurance Workshop)
Spam has become one of the most annoying and costly phenomenon in the Internet. Valid e-mail addresses belong to the most valuable resources of spammers, but little is known about spammers? behavior when collecting and harvesting addresses and spammers? capabilities and interest in carefully directed, consumer-oriented marketing have not been explored yet. Gaining insight into spammers? ways to obtain and (mis)use e-mail addresses is useful in many ways, e.g. for the assessment of the effectiveness of address obscuring techniques and the usability and necessity of hiding e-mail addresses on the Internet. This paper presents a spam honeypot project in progress addressing these issues by systematically placing e-mail addresses in the Internet and analyzing received e-mails. The honeypot?s conceptual framework, its implementation, and first empirical results are presented. Finally, an outlook on further work and activities is provided.
Keywords: Spam; ham; e-mail; honeypot; address obscuring technique; address taxonomy

Effektivität von Lösungsansätzen zur Bekämpfung von Spam - Schryen, Guido (Wirtschaftsinformatik)
Spam als unerwünschte Massen-E-Mail hat die Grenze von der Belästigung zur ökonomischen Relevanz längst überschritten. Ihr relativer Anteil am gesamten, weltweiten E-Mail-Aufkommen stieg in den vergangenen Jahren auf mehr als 50% im Jahr 2003. Es entstehen jährlich volkswirtschaftliche Schäden in Milliardenhöhe. Zur Bekämpfung des Spam-Problems werden neben gesetzlichen Regelungen vor allem technische Lösungen eingesetzt, bei denen das Blockieren und Filtern von E-Mails in praktisch eingesetzten Anti-Spam-Systemen dominieren. Dieser Artikel führt in die Spam-Problematik ein und beschreibt, bewertet und klassifiziert die derzeit bedeutendsten Verfahren zur Bekämpfung von Spam.
Keywords: Spam; E-Mail; Spoofing; Blockieren; Filtern; Lightweight Mail Transfer Agent Authentication Protocol (LMAP)

Fighting Spam: Motivating an Account-based Approach - Schryen, Guido (Proceedings of the IADIS International Conference WWW/Internet 2004. vol. 2)
Spam as unsolicited e-mail to a large number of recipients is known to ecome an increasingly disturbing and costly issue of electronic business and internet traffic. Mainly technical-oriented approaches are applied with a focus on blocking, filtering, and authentication mechanisms based on the domain name system. They come along with different drawbacks and have all low effectiveness in common. The article sketches these approaches, shows its limitations, and proposes an account-based approach where the number of e-mails per day and account is restricted.
Keywords: e-mail; spam; filtering; blocking; LMAP; SMTP account