Department of Computer Sciences The University of Texas at Austin Zmail : Zero-Sum Free Market Control of Spam Benjamin J. Kuipers, Alex X. Liu, Aashin Gautam, Mohamed G. Gouda

2The University of Texas at Austin Spam Problem  Volume of Spam ─ 2001: 8% of all traffic was spam ─ 2004: 60% of all traffic was spam ─# s per day: 31 billion (60% spam = 18.6 billion) ─# spam s per person per day = 6  Cost of Spam ─ 2003: $10 billion/year in U.S. (Ferris Research) $20.5 worldwide (Radicati Group) ─ Just cost for adding spam processing servers

3The University of Texas at Austin Anti-Spam: Legal Approaches  Punish spammers by anti-spam laws  Problems ─Hard to define spam ●First Amendment Right to Free Speech ─Hard to enforce anti-spam laws ●Spammers move to another country

4The University of Texas at Austin Anti-Spam: Filtering Approaches  Filter out spam based on text content  Problems ─False Positive ●What if a job offer gets filtered? ─Can be foiled by spammers ●For example, imbedding spam text in images

5The University of Texas at Austin Anti-Spam: Economic Approaches  Require senders to pay something  Human Effort: Sender pays human effort ─ Inconvenient ─ Inefficient ─ Challenge can be perceived as rude  Computational Cost: Sender pays CPU time ─ Inefficient

6The University of Texas at Austin Anti-Spam: Zmail  Current cost for spamming is almost zero  User’s attention is the important resource consumed  Basic idea of Zmail: ─The sender of an pays money directly to the receiver. ─Zero sum (unlike USPS): T he amount of money charged to the sender =The amount of money rewarded to the receiver ─The money earned can be used to send . ─The cost of sending one is a unit called an e-penny.

7The University of Texas at Austin Impact of Market Forces  Spammers ─ Cost of spamming significantly increases ─ Bulk advertising become more targeted  Normal Users ─ Most users receive more than they send ─ If not, pay money or subscribing commercial  ESPs ( Service Providers) ─ Less spam, less bandwidth, less computational cost

8The University of Texas at Austin Zmail Architecture ESP User Bank User

9The University of Texas at Austin The Zmail Protocol: two parties  Bank: ─ Each compliant ESP has an account with bank ─ Manage accounting for compliant ESPs ─ ESP buy and sell e-pennies with bank ─ Exchange e-pennies between real money for ESPs  ESPs: ─ Manage accounting for each of its users ─ Users buy and sell e-pennies with their ESPs

10The University of Texas at Austin The Zmail Protocol: Transfer  An user s of ESP A  user r of ESP B  Sending: ─ A reduces s’s balance by one ─ A records that A owes B one more e-penny  Receiving: ─ B increments r’s balance by one ─ B records that A owes B one more e-penny

11The University of Texas at Austin The Zmail Protocol: Misbehavior Detection  What if an ESP lies?  Periodically, every ESP reports to the bank how much they owe to every other ESPs  Misbehavior Detection ─ A says that A owes B x e-pennies ─ B says that A owes B y e-pennies ─ If x != y, then Bank further investigates who lies. ─ Most ESPs are honest.

12The University of Texas at Austin Mailing Lists  List server: distributor + subscriber DB  A subscriber sends an to distributor, distributor forwards the to everyone  Solution: for each from distributor, receiver’s ESP sends back an ack .  Extra benefit: subscriber DB is always updated Distributor Sender

13The University of Texas at Austin Zombies and Viruses  Zombie: sends out spam at user’s expense  Virus: sends to everyone in address book  Solution: each user specify a limit on the number of that he can send a day.  Extra benefit: detecting virus and zombies

14The University of Texas at Austin Incremental Deployment  Zmail runs on top of SMTP  No change to SMTP  Deployment: starting from two compliant ESPs  A user may decide to segregate, filter, or discard from non-compliant ESPs.

15The University of Texas at Austin Bank Setup  Internet already has some central authorities such as IANA that controls IP assignment

16The University of Texas at Austin Conclusions  Zmail gives no free ride to spammers  Zmail requires no definition of spam  Zmail works with other anti-spam techniques  Zmail can be incrementally deployed