On Mon, 26 Apr 2004, Chris Lewis wrote:
Daniel Feenberg wrote:
On Mon, 26 Apr 2004, Chris Lewis wrote:
John Levine wrote:
80% of spam detected by this method (it's catching approximately 65-70%
of all of our spam) is coming from detections less than 4 days old. 90%
< 6 days old. 95% < 12 days old.
Can you tell us the number of hosts in each category? And how long hosts
remain infected? That would give us an idea of the gross flows into and
out of infected status.
Here's a table:
Age (days) IP Count/cum% Hit Count/cum%
0 67974/ 5.0 174862/25.4
1 65816/ 9.8 184589/52.1
2 54233/13.8 118338/69.3
3 48207/17.4 50991/76.7
4 38517/20.2 45567/83.3
5 42021/23.3 42143/89.4
6 55652/27.4 26002/93.2
7 57634/31.6 3889/93.7
8 50108/35.3 2445/94.1
9 45304/38.6 1551/94.3
10 54740/42.6 3264/94.8
11 60550/47.1 3612/95.3
12 43338/50.3 2883/95.7
13 42773/53.4 7164/96.8
14 47288/56.9 942/96.9
15 44260/60.1 524/97.0
16 48189/63.7 1087/97.1
17 43812/66.9 1147/97.3
18 39178/69.8 864/97.4
19 39474/72.7 611/97.5
20 38916/75.5 1320/97.7
21 40344/78.5 894/97.8
22 37221/81.2 3122/98.3
23 28497/83.3 907/98.4
24 32483/85.7 1000/98.6
25 38186/88.5 4719/99.3
26 42249/91.6 1393/99.5
27 41198/94.7 1816/99.7
28 39267/97.6 1487/99.9
29 33023/100.0 396/100.0
30 261/100.0 0/100.0
Totals 1360713/ 100 689529/ 100
We expire after 30 days.
If spam is proportionate to hosts, then the above figures suggest that 75%
of hosts are corrected within 4-6 days.
It isn't proportionate to hosts.
Comparing IP addresses only, it looks like that dropoff from day zero to
day 9 (10 days) is about 1% per day. That is, 5% of hosts in one day, but
38.6% in 10 days. 1% cure rate per day is much more in accord with my
expectations, but still better than never, which is what I feared.
Daniel Feenberg
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg