On Mon, 26 Apr 2004, Chris Lewis wrote:
John Levine wrote:
80% of spam detected by this method (it's catching approximately 65-70%
of all of our spam) is coming from detections less than 4 days old. 90%
< 6 days old. 95% < 12 days old.
Can you tell us the number of hosts in each category? And how long hosts
remain infected? That would give us an idea of the gross flows into and
out of infected status.
If spam is proportionate to hosts, then the above figures suggest that 75%
of hosts are corrected within 4-6 days. My reasoning is that only 10x more
hosts are in the 6 day window than in the 4 day window. So if there are
80x infected hosts in 4 days, that is 20x hosts/day. But in 6 days there
are only 90x total infected hosts, or 5x hosts/day for the 2 additional
days rather than the expected (steady state) 20x hosts. That suggests that
15x hosts were cleaned up. This would be clear if we knew the number of
hosts, so that I didn't need the mystery factor x =spams/(hosts*100)
Daniel Feenberg
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg