Thursday, October 8, 2009

Understanding Spam Detection:

People do not mind it when they have spam slipping through their filters (false negatives) rather than having their desired good e-mail (“ham”) blocked (false positives). Most of the available techniques have both kinds of errors to varying degrees. Therefore, for example, some anti-spam systems may allow a lot of spam to prevent the good e-mail from being rejected.

Detecting spam based on the content of the emails like based on certain keywords such as “viagra” or through statistical means is very popular. However, this method suffers from the drawback that it does not determine whether the mail was unsolicited or bulk which are the two main features of spam. Therefore, if your friend sends you a message that contains the word “viagra” in it, the filters may block the message as spam even though it is neither sent unsolicited nor was it sent in bulk.

Most of the popular DNS Blacklists contain the IP addresses of known spammers, zombie spammers, open relays etc.

Spamtraps are often email addresses that are never valid or have been used to collect spam over a period of time. Spamtraps are often not announced and is usually found in dictionary attacks or by pulling off addresses off hidden web pages. Certain blacklists such as spamcop, use spamtraps to catch and blacklist spammers.