Possible venues of defense: - Authentication. Forces the identity of the spammers so that they can be more easily tracked. See CMTP. - Flood prevention. Counters the "bulk" aspect. - Block based on true identity. What We Want. Will cause problems with mailing lists. - Block based on CPU expense. Can be thwarted by DDoS and in general, control of multiple computers; not equal for all - Block based on time. Parallelizable. - Block based on content. True hashes could easily be prevented by varying the amount of space or whatnot in the mail. Maybe some sort of fluid blocking that slows down more the more similar a message is to one sent in the past? Would require immense storage. - Block based on time and IP. Still can't prevent DDoS, or any attack with multiple sources or multiple targets. Look around for general DDoS prevention ideas or papers. A fully fledged system would require some sort of peer to peer structure. Such a structure could handle all the other problems too. - Leges and automatic TOS countering. Works on the meaning aspect. Also includes things like tracking down the originators easily. Terms Of Service is kind of an intra-ISP law. Once authentication is in place, this can be automated to a much greater degree. Creating standardized spam report formats is also of use. - Content filtering. Bayesian works fairly well, but we may be able to squeeze more out of it by Markov models (don't know how they work) or NNs, or even multi-gram Bayesian. The classifier should also distinguish higher order information, like the difference between HTML tag options, HTML comments, and text. This could be programmed manually. [blurring heuristic and content filtering?] Could possibly be backed up with letter statistical analysis tools, or as Minsky put it, mechanisms that deal with "numerous effects of small value".