PDA

View Full Version : Miscellaneous Hacks - SpamBot Detector: An alert algorithm designed to detect and act on anomalous activity


calorie
10-05-2008, 10:00 PM
Bot Detector is good for detecting mass proliferation of spam actions on your board. The premise is similar to flu outbreaks. If only a few people have the flu, no outbreak is detected, but if a number of people have the flu, then an outbreak is declared. Bot Detector is for preventing the massive spamming of your board by detecting spam outbreaks. This prevents your board from being overrun with spam to the point that your board is useless. You need to remove the current spam from your board and configure the Bot Detector settings to match with the traffic on your site. With the right settings, spammers/bots won't be able to flood your board with spam. The best that they could do is to post spam at the same rate as your other users post, which means that yes, some spam will get through. Bot Detector isn't meant for occasional spam. It is meant to prevent the massive spamming that makes your board useless. You can configure various options for the following actions: registering, logging in, creating threads, and replying to threads. For each of these actions, if there is a peak that is inconsistent with the typical actions of your legitimate users, then an alert/outbreak occurs, and the users/spammers/bots that are active within a small window of time are moved to a usergroup that you set to not have posting capability. It is theoretically possible that a legitimate user is caught in that small window of time, and moved to the non-posting usergroup, but Bot Detector comes with certain options that you can set to only check for outbreaks based on usergroup and post count. This means that you can completely avoid having users in trusted usergroups, and users with over X posts, from ever going into the non-posting usergroup. If a legitimate new user winds up in the non-posting usergroup, all you need to do is to find the user via the ACP and move that user out of the non-posting primary usergroup. Spammers shouldn't be able to code anything that breaks Bot Detector, as recently happened with CAPTCHAs, because Bot Detector is an alert algorithm designed to detect anomalous activity.

For the occasional spam that does not cause Bot Detector to alert, try HuangA's "keyword weight based spam detector" here:
https://vborg.vbsupport.ru/showthread.php?t=184757

For other spam/bot reduction tips visit:
http://www.vbulletin.com/forum/showthread.php?t=275800

R-D
10-06-2008, 07:18 AM
Tagged for future use. Sounds really good but I guess I'm one of the lucky ones right now (no spam).

Thanks for posting. :)

farzana
10-06-2008, 12:20 PM
i am looking for the full version.. thanks i think you have done a great job..

RonH.
01-05-2009, 10:10 PM
A site that I like to use to check on the IP activity when evaluating new registrations is called:

Stop Forum Spam (http://www.stopforumspam.com/)

It should give you enough information to make a reasonable decision on the registering IP. I've stopped well over 100 (mostly porn) spammers so far in the past month alone. Just another tool in the war on the spammer.