The silent network: denying the spam and malware chatter using free tools: BSDCan, Ottawa, May 18th 2007
PrevNext

The comedy of our errors

No method has a nonzero error rate; countermeasures and bad luck produce false positives and false negatives::

  1. We match on keywords: they misspell (V1AGR4, pr0n)

  2. We use word frequency, other stats: they include random text

  3. We scan text, they put their text in pictures

  4. We use OCR on their pictures, they muck up backgrounds

(actually FuzzyOcr helps) - In the next round, who knows?