Spam control Old emphasis: detect spam black lists, Bayesian content analysis danger: discard non-spam (“false positives”) often easily subverted by spammers CUIT measurements: most SpamAssassin filters are never triggered Also now needed for VoIP (“SPIT”) content-based techniques are not applicable

Spam & phishing prevention Our emphasis: detect ham (non-spam) not content-based Approaches: HTTP extensions for transactional email (Amazon, airlines, ...) and phone calls add response header with related mailto and SIP URLs social and professional networks e.g., outbound email and calls IETF mailing list archives EDAS (most networking researchers) IEEE/ACM member lists vast majority of ham is from users or domains known to receiver domain age (whois) URL lifetime for phishing detection