Do we need mathematicians? This question was addressed by Ian Steward, professor of mathematics at the university of Warwick, UK, during this years Queen’s Lecture at the Technical University of Berlin. The annual queen’s lecture is held in Berlin since 1965 and were initially a present by queen Elizabeth II on the occasion of her visit to Berlin. In this year, the attendees were looking forward to get an answer to Do We Need Mathematicians - will Ian Steward make his profession obsolete by answering with no or will there be more support for mathematics in the German Year of Mathematics?

Of course, everyone knew the answer, as many of the luxuries of the 20th century have their base in mathematics, and Ian Steward immediately rephrased his opening question to Why Do We Need Mathematicians? This may be essential in times when many countries are worried about decreasing amounts of first-semester students in “tough subjects”, such as mathematics.

He then quickly moved on to present some believes and showed why they are wrong:

• The only job one can get holding a degree in mathematics is becoming a school teacher: Less then 5% of the British students graduating in mathematics go into school politics, 25% are employed in the financial sector.
• We did all the math in school. There is nothing new happen in mathematics. If there would be something new, we would have heard about it. Why would someone invent even more math, there is already too much - There are about 1-2 million pages of math published per year.
• We don’t use maths in our daily life: Mathematics is the Cinderella that doesn’t come to the ball. It’s working behind the scenes and only some will notice it.
• We have computers: Drugs don’t make doctors obsolete, telescopes do not make astronomers obsolete and microscopes doesn’t obsolete biologists. In fact, a computer is just a tool that helps the mathematician with getting routine work done and concentrating on actually solving problems. But one always need a professional to use a tool efficiently.

Ninety Mile Beach in Australia (Source: Wikipedia)

A large part of his talk was devoted to demonstrating where mathematics is used in daily life by following the example of going on holiday from the early stage of looking for possible locations, over flying to the actual destination to lying at the beach taking pictures. In the course of his demonstration he showed that maths is inside everywhere.

When using the Internet to holiday planing, a user will use a search engine whose results are ranked by the Page Rank Algorithm and the data communication to the travel agency might be secured using several cryptographic techniques.

Aeroplane (Source: Wikipedia)

When using the air-plane to fly to the chosen destination, one will encounter a huge complexity. a) Why does the aeroplane fly? One needs the principles of fluid dynamics and Navier-Stokes equations. A digital wind tunnel is used to simulate and study the aerodynamics of a planed aircraft. The Navier-Stokes equations are thus solved in the simulator. b) How do they navigate? A bunch of number theory is involved in the Global Positioning System. c) How do they know when to send the plane where? Addressing this subject involves network analysis, which is a hot topic in mathematics and spreads from computer networks such as the Internet to biological networks such as epidemic of diseases.

Digital Camera (Source: Wikipedia)

Arrived at the beach, one wants to take souvenir photos, but how does the camera manage to store so many pictures in one memory card? Shrinking the amount of data without loosing the picture involves complex techniques of data compression, which Ian Steward demonstrated by explaining the basics of JPEG.

When the queen’s lecture was over, there was a nice reception where the university orchestra played traditional and modern British music and the university served food and drinks.

All in all, I really enjoyed listening to his talk. He presented a nice collection of examples showing why mathematics is neccessary. However, I belive the talk was addressed to a different audience and was somewhat less relevant for students and employees at a technical university that a very familiar with the presented topics. From a computer scientists perspective, the examples were well known and thus can be considered as boring—the way he presented them was not. Actually his audience consisted of exactly those people that did not need to be convienced that mathematics is important. However, he is doing a great job in actually communicating science and I believe such a powerful talk will have a very strong effect on an audience that is less technophile.

Spam (Image source)

Direct marketing is not a new approach and its history dates back to the 19th century when the first mail-order catalogues were distributed. Nowadays, the presence of unsolicited bulk e-mail is annoying Internet users world-wide on a daily basis. While there were some costs involved to distribute mail-order catalogues, the marginal cost to send  an e-mail is tiny. Therefore, e-mail based campaigns are profitable even when a negligible amount of receivers goes for the advertised product. The bad news, as highlighted by Kanich et al. is, “a perverse byproduct of this dynamic is that sending as much spam as possible is likely to maximise profit”. In order to maximise the reach of spam advertisement, spammers need to fight with developers of anti-spam technology; the developers of anti-spam software play a cat-and-mouse game with the senders of spam, who have to adapt to the latest spam filtering technologies in order to reach as many people as possible.

However, the presence of spam, despite years of energetic deployment of anti-spam technology, demonstrates the profitability of campaigns using spam. So the natural question rises up: who goes for spam?

This issue is addressed in a paper entitled Spamalytics: An Empirical Analysis of Spam Marketing Conversion presented at the 15th ACM Conference on Computer and Communication Security on Tuesday October 28.

The authors are interested in the conversion rate of spam, which is the probability than an unsolicited e-mail will ultimately elicit a sale. Therefore they infiltrate ongoing spam campaigns sent using the Storm botnet to provide measures for different stages of the spam conversion pipeline as shown in the above figure. In order to understand their methodology, we need to briefly review the way Storm works.

Storm is a peer-to-peer botnet that propagates via spam. The above figure shows the three primary classes of Storm nodes involved in sending spam: worker bots, proxy bots and master servers. While the worker bots are responsible for actually sending the spam, proxy bots act as conduits between workers and master servers. When downloading the Storm binary advertised in spam mails, the infected host becomes either a worker bot (if not reachable from the Internet, e.g. due to firewall restrictions) or a proxy bot. As the command and control traffic directed to the worker bots is unencrypted and always passes through a proxy bot, a man-in-the-middle attack is possible and carried out in the paper by Kanich et al.: by rewriting the comand and control traffic directed to worker bots, spam templates, dictionaries and addresses could be changed and adapted to their needs.

Their methodology can be summarised as follows. They hosted a set of Storm proxy bots, created duplicates of websites advertised in spam and have rewritten the command and control traffic to let the worker bots to advertise their sites instead of the original ones. Thus, no user received more spam, but some users received spam that is less dangerous that it would be otherwise.

Over the course of their experiment, they rewrote the content of about 470 million spam mails sent in three campaigns: about 347 million spams involved in a phamarcy campaign, 83 (38) million for a Storm self-advertisement campain using postcards (april fool). They received 28 purchases on the faked page for the advertised pharmaceutical product and 541 infections of the faked Storm binary, geographically distributed as shown below:

This translates into the following conversion rates (caution: results are not intended to be generalised in other contexts!):

• 1 in 12,500,000 pharmacy spams lead to a purchase.
• 1 in 265,000 greeting card spams lead to an infected machine.
• 1 in 178,000 April Fool’s Day spams lead to an infected machine.
• 1 in 10 people visiting an infection website downloaded the executable and ran it.

Many more information can be found in their paper (see below), such as top-10 most targeted email address domains, filtering statistics at each stage of the conversion pipeline, statistics about the efficiency of anti-spam methods deployed by typical free e-mail providers (e.g. hotmail and Google mail), time-to-click distribution (the first users visited the advertised page 10 seconds (sic!) after the spam was sent), effects of blacklisting and many more.
The paper is very well written and leads to new insights into how spam works. Interested readers should therefore consider reading this piece of well-conducted research.

Source: C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. 15th ACM Conference on Computer and Communications Security 2008, Alexandria, VA, USA. [Summary, PDF Paper, BibTeX]

Further Information:

• First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET’08) [Audio recordings of all talks available online]
• Frédéric Dahl, “Der Storm Wurm“. Diplomarbeit Universität Mannheim, 2008.
• Schneier on Security: The Storm Worm, 2007.
• Honeyblog: Measuring the Success Rate of Storm Worm, 2008.
• Announcement in the The ICSI Networking Group Blog