I also want to take a moment to define some terms

• Merriam-Webster's New Collegiate Dictionary defines volatile as: "characterized by rapid or unexpected change"
• And I want to further define change, unexpected, and rapid
• For purposes of this talk, change refers to substantive, spam-related change, not mere "difference." No two email messages are identical, but that's neither surprising nor interesting. For purposes of this talk, a "change" has to alter, in some measurable way, the "spam profile," if you will, that a message presents. So, for example, a change in obfuscation tactic would constitute "substantive" change, but a random difference in obfuscation content using a single tactic would not.
• I'm prepared to define unexpected as synonymous with unpredictable (see also random) .
• Defining rapid is a bit more problematic. In order to look at variation over time, we'll need to aggregate data into some sort of time window. But we need to select a time window for measuring change that's sufficiently small to detect substantive change, while at the same time sufficiently large to allow repetition of stable features.
• Operational definitions for each of these concepts will become apparent as we look at the experimental setup.

---