ietf-asrg
[Top] [All Lists]

Re: [Asrg] Collecting IP reputation data from many people

2010-11-05 10:55:54
On 11/5/10 1:07 AM, Alessandro Vesely wrote:
 On 04/Nov/10 20:49, Darxus(_at_)chaosreigns(_dot_)com wrote:
> On 11/04, Alessandro Vesely wrote:
>> On 02/Nov/10 21:39, Darxus(_at_)ChaosReigns(_dot_)com wrote:
>>> Now I'm thinking about providing non-spam percentages, and a
>>> number indicating relative total volume of email from the IP,
>>> probably both with a range of 256 values. Basically all the
>>> precision I think anybody could find useful.
>> The second format might allow some sort of projective
>> conglomeration of results.
> What?

 If I have reports from both A and B about S, I may want to add their
 results. I can extrapolate the real volumes Va and Vb that A and B
 got from S by scaling the relative volumes Ra and Rb by, say, the
 volumes I send to A and B, respectively. Call Ma and Mb these
 "projections" of A and B on My site, and Pa and Pb the percentages
 found in the report. Then I can reckon their sum as

 (Pa*Va + Pb*Vb) / (Va + Vb) = (Pa*Ra*Ma + Pb*Rb*Mb) / (Ra*Ma +
 Rb*Mb)

 One may want to season the projection factors with more ingredients,
 such as the trust granted to the relevant reporter.

Not all email is bidirectional, where an amount sent will not reflect an amount received. Received rates are poor predictors of sending rates due to nonlinear relationships between sending and receiving. People are able to read only so much. Volume over time can be expressed as absolutes using natural log with as little as 4 bits. As sending volume increases, a receiver's relative volume will decrease due to a required greater diversity of sending destinations. Natural log can approximate receiver reductions resulting from a greater diversity of destinations.

Summing log volume requires conversion back to linear values adjusted to the same time interval. When not converted, natural log might better predict expected individual receive volumes when a very large number of receivers have been aggregated to better approximate actual sending rates.

-Doug




_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg