[anti-abuse-wg] Re: update on netsecdb project

IMHO just having blacklists based on IP addresses is not enough:
* rapidly increasing mobile internet (which has dynamic IPs unless
  one keeps a connection open indefinitely - hardly ever the case)
* tendency to reuse one bot for an ever decreasing number of spam messages
- so blacklist are and always getting to be less helpful.

We did an analysis of a commen DNSBL and found that only 3% of
active bots could be found there at the timepoint when they were
active. Roughly the same number (6%) can be got when comparing with
originating IPs from incoming spam. If spam volume is sinking - and it
definitely does at least for me - this has nothing to do with any
countermeasures but is probably just a delayed effect from the economic
crisis. Let's not delude ourselves here.

Actually, our paper on automating botnet tracking was downloaded
quite often (we got a mail from Computers & Security / Elsevier that
it was among the top 25 downloaded paper in Q4/2009 - whatever that
means ;-) so there seems to be a lot of interest in tracking bots
with more intelligent techniques. My opinion was and still is that we
need to automate detection and tracking techniques and not necessarily
rely on old obsolete filtering techniques (although they can be
helpful in some cases). But I see the limits of RIPE to make such an
approach happen and frankly I don't see any other supranational
organization that can pull that off.

So here's to hoping the spammers die out from the current crisis and
we can switch off all our spamfilters...

Best,
  Alex
-- 
Dr. Alexander K. Seewald

Seewald Solutions
www.seewald.at
Tel. +43(664)1106886
Fax. +43(1)2533033/2764