Re: [gnso-ff-pdp-may08] Re: Mannheim score concerns (minority view)

["George Kirikos" <fastflux@xxxxxxxx>]

Hello,

On Wed, Sep 17, 2008 at 5:08 PM, Joe St Sauver wrote:
> But you know, I'd be *thrilled* to have someone else propose a formula
> that is both simple and efficient for screening fast flux domains,
> particularly one that's backed up by empirical research the way the
> Mannheim formula is. I just haven't seen that sort of alternative pop
> up yet, which is why I continue to ride the horse that's currently in
> the corral. :-)

I don't have data, so I'd not be the one to propose a formula (plus,
I'm not really for any fully automated formula).

But, suppose that one agreed on a basic model, and that the model's
coefficients are determined empirically/statistically. One thing
attackers might attempt to do is contaminate the dataset. For
instance, they could create legitimate sites (or buy ranking sites in
Alexa/DMOZ), and start fluxing them. Sites about recipes, music
lyrics, etc., all fluxing but legitimate (just like organized crime
owns various legitimate companies in the non-Internet world) -- even
host websites for others (i.e. become a webhosting company). When
these legit sites become part of the dataset used for calibration,
they might begin to cause the empirically-determined parameters to
shift enough that their future illegitimate sites now start passing
the tests, tests that they would have failed had they not contaminated
the data.

Sincerely,

George Kirikos
www.LEAP.com