[Operators] Spammy servers

Kevin Smith kevin at kismith.co.uk
Sat Mar 2 12:22:31 UTC 2013


On Fri, Mar 1, 2013 at 11:07 PM, Marco Cirillo <maranda at lightwitch.org> wrote:
> Il 01/03/2013 23:03, Kevin Smith ha scritto:
>
>> On Fri, Mar 1, 2013 at 9:59 PM, Marco Cirillo <maranda at lightwitch.org>
>> wrote:
>>>
>>> expecially to the "high usage" ones (possibly more,
>>> those with unprotected IBR)... Did you actually ever make a census of how
>>> many of your concurrent users are actual human beings..?
>>
>> It's not immediately clear to me how one would reliably do this - do
>> you have any suggestions?
>>
> Well Kevin beside "greeting the target" (before or after), they may be very
> clichy... but 2 enough effective ways to profile bots in my opinion are:
> - They tend being either incredibly idle or incredibly active, and usual
> have sudden activity bursts (idleness is to be treated with care and checked
> with other factors...)
> - They tend doing stuff a normal user wouldn't do (e.g. large amount of
> random service discoveries, which could reflect on servers with a high
> amount of non human beings having a way larger s2s connections number for
> instance)
> - They could have very large rosters or, very empty ones (as usual treat the
> latter case with care...)

I think you're describing how bots may act in the above, but it also
seems to quite accurately describe how humans act so I think the FPR
here would be quite significant.

/K


More information about the Operators mailing list