1. Spam control Old emphasis: detect spam
black lists, Bayesian content analysis
danger: discard non-spam (“false positives”)
often easily subverted by spammers
CUIT measurements: most SpamAssassin filters are never triggered
Also now needed for VoIP (“SPIT”)
content-based techniques are not applicable

2. Spam & phishing prevention
Our emphasis: detect ham (non-spam)
not content-based
Approaches:
HTTP extensions for transactional (Amazon, airlines, ...) and phone calls
add response header with related mailto and SIP URLs
social and professional networks
e.g., outbound and calls
IETF mailing list archives
EDAS (most networking researchers)
IEEE/ACM member lists
vast majority of ham is from users or domains known to receiver
domain age (whois)
URL lifetime for phishing detection