distributed spam filtering

[Wouter de Vries-2]

Hi,

For my research project I have been looking at distributed fake file identification systems in p2p networks. What i noticed from gtk-gnutella is that it returns very few spam results while searching compared to Limewire. This is largely due to the 6mb spam.txt file which while not distributed seems to work quite well.

What I'm wondering however is the option to 'Globally drop results..' from search requests as opposed to the normal 'Drop results..'. Does this mean it propagates the SHA1 to other agents or does it place the SHA1 in spam.txt?

thanks,
Wouter
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
gtk-gnutella-users mailing list
gtk-gnutella-users@...
https://lists.sourceforge.net/lists/listinfo/gtk-gnutella-users

[Christian Biere]

Wouter de Vries wrote:
> For my research project I have been looking at distributed fake file
> identification systems in p2p networks. What i noticed from gtk-gnutella is
> that it returns very few spam results while searching compared to Limewire.
> This is largely due to the 6mb spam.txt file which while not distributed
> seems to work quite well.

Most of these items are actually ZIP (and ZIPs labeled as RAR) from infected
Gnutella peers. You could filter most of these by a simple filename + filesize
rule but this would cause some false-positives, very few though.
 
> What I'm wondering however is the option to 'Globally drop results..' from
> search requests as opposed to the normal 'Drop results..'. Does this mean it
> propagates the SHA1 to other agents or does it place the SHA1 in spam.txt?

No, those are completely unrelated. "Globally" just means for all searches
instead of just the current one. I don't know whether those were ever really
meant to filter spam because it's not a good idea to use them for this purpose.
This might have had some use when results contained no fake data. Also it
scales even less than spam.txt because it requires more memory.

The spam which derives from real spammers (in contrast to infected peers) such
*freeclub, Macrovision and others uses fake addresses and often even fake
SHA-1s. So you should not use those GUI filters against these. Actually most of
that is already discarded by a mix of several diverse filters under the hood
anyway.

--
Christian

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
gtk-gnutella-users mailing list
gtk-gnutella-users@...
https://lists.sourceforge.net/lists/listinfo/gtk-gnutella-users