Tracking Email Reputation for Authenticated Sender Identities.
Gautam Singaraju, Jeffrey T. Moss, Brent Byunghoon Kang · 2008
With the amount of unsolicited emails on the rise, domain authentication schemes have been widely deployed to identify senders. Establishing a sender's identity does not guarantee its adherence to best practices. To maintain a history of sender activity, in our prior work, we had proposed RepuScore: a collaborative sender reputation framework and demonstrated its effectiveness using simulated logs. In this paper, we share our initial experience in deploying RepuScore along with its SpamAssassin plug-in that we recently developed. From the deployed RepuScore, we learned that a variation in the received email volume disguises the real reputation of the sender. To solve this problem, we propose Volume-Enhanced RepuScore that, in addition to spam rate, considers the received email volume. Based on the deployment since 10/9/2007 at two organizations, we show that: a) RepuScore data can be used to identify authenticated senders and classify their emails. Using the computed reputations for 23 days, RepuScore classified emails from about 42 % of the authenticated sender identities that correspond to about 72 % of the authenticated email volume; b) sender identities with low reputations have a shorter lifetime compared to ones with high reputations. 1.