Using Early Results from the 'spamHINTS' Project to Estimate an ISP Abuse Team's Task

ISPs operate "abuse" teams to deal with reports of inappropriate email being sent by their customers. Currently, the majority of this work is dealing with insecure systems that have become infected with viruses or that have been hijacked by the senders of email "spam". This paper examines the performance of an abuse team at a large UK ISP over the past few years, and shows that email log processing tools have provided significant improvements in their efficiency. A new email measurement system called spamHINTS, using sampled sFlow packet header data from a major Internet exchange, is currently under development. Early results from this monitoring suggest that the ISP abuse team needs to step up their activity by an order of magnitude to get on top of their problem.

• Type: Conference
• Year: 2006
• Where: CEAS
• Authors: Richard Clayton
• Keywords: Abuse Team, CEAS 2006, Email, Inappropriate Email, Internet Technology