On Fri, 17 Oct 2008, Alessandro Vesely wrote:
> May I ask how do you manage black list entries rehabilitation? I'm planning to
> do something similar to Stockade(*), i.e. to have a decay rate so that the
> probability that a listed IP gets blocked is automatically halved every that
> many seconds, until it eventually vanishes. That implies fuzzy blocking,
> though.
I use GOSSiP for domain reputation, where the confidence in a reputation
decays with time. Blocking doesn't begin until confidence reaches
a threshold.
IPs are on a 7 day rotation. So a given spammer IP gets to attempt to send 1
spam per week. The IPs are blocked at a low level, before getting to my filter
(although the filter decides when to blacklist them). That's short enough
to allow an IP sold to a legit party to get back in service.
--
Stuart D. Gathman <stuart@bmsi.com>
Business Management Systems Inc. Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com
> May I ask how do you manage black list entries rehabilitation? I'm planning to
> do something similar to Stockade(*), i.e. to have a decay rate so that the
> probability that a listed IP gets blocked is automatically halved every that
> many seconds, until it eventually vanishes. That implies fuzzy blocking,
> though.
I use GOSSiP for domain reputation, where the confidence in a reputation
decays with time. Blocking doesn't begin until confidence reaches
a threshold.
IPs are on a 7 day rotation. So a given spammer IP gets to attempt to send 1
spam per week. The IPs are blocked at a low level, before getting to my filter
(although the filter decides when to blacklist them). That's short enough
to allow an IP sold to a legit party to get back in service.
--
Stuart D. Gathman <stuart@bmsi.com>
Business Management Systems Inc. Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com