RE: [gnso-ff-pdp-may08] Data Annex for Report - First Draft

[Joe St Sauver <joe@xxxxxxxxxxxxxxxxxx>]

Hi Martin!

#Based on conversations and suggestions to date, I've included 4 data  
#visualizations for the 8/23 - 11/23 period:
#New Fluxing Domains Detected by Date
#Total Number of Fluxing Domains Detected by Date
#Total Number of Fluxing Domains by TLD
#Number of Fluxing Domains per 10,000 Registered Domains by TLD

Nice work!

Couple of suggestions:

-- For the first bar chart, because of the wide range of values, I'd 
   consider using a logged Y axis (usually just a matter of toggling 
   that one axis attribute). I'd also love to see the raw data included
   as a table, or made available for folks to download as a URL.

   If that data was available, the thing I'd *love* to see would be a 
   cross correlation between that time series and global spam volume
   per day. I suspect the cross correlation might be quite high, albeit
   potentially lagged by one or more days.

-- On the pie chart, I have a tough time with the color coding of the
   pulled out micro slice from the main pie; mapping the color in the 
   legend to the colors in the pulled out pie is more than my 
   near-color-blind tired old eyes can do (and this problem will only
   end up getting worse as the report gets downloaded and printed and 
   then re-xeroxed, etc.)

   How about having the pull out as a column, with the legend for each
   slice of the column adjacent to the column, or having a data table
   along side the graphic?

   And while we're talking about colors, some of the blues may be hard to 
   reproduce cleanly on some equipment (the chosen blue looks like a
   near perfect "non-repro" blue :-)).

-- For the flux domain per 10,000, can we attempt to somewhow represent
   the size of the underlying domain base as well as the rate? For example,
   how about this:

   -- make the width of each bar proportionate to the size of the total
      size of each TLD, so that com would be wide, and cn would be wide 
      (both have lots of registered domains), while the tiny ccTLDs 
      would be skinny bars (vertical lines?)

      We need some way to get the absolute "N" associated with each of
      those bars in there, because w/o it, the last graph is horribly
      misleading (dot gs is *not* where the problem is!)

      Because the debate about what is and isn't fast flux also is 
      ongoing, it would also be very helpful if the list of domains
      or underlying data set used to build the chart could also be made 
      available (e.g., as a URL that researchers or other interested
      parties could download).

#In line with the APWG report, perhaps I should also include the raw #  
#registered domains/TLD in here as well?

Yes please!

Thank you for your work on this, and for contributing data from KS!

Regards,

Joe