SpamAssassin Methods Of Usage Anti spam Techniques

SpamAssassin is generally regarded as one of the most effective spam filters, especially when used in combination with spam databases. Even simple text-matching alone may, for most users, be sufficient to correctly classify a majority of incoming mail.

1 Methods of usage

SpamAssassin is a Perl-based application (Mail::SpamAssassin in CPAN) which is usually used to filter all incoming mail for one or several users. It can be used as a standalone application or as a client (spamc) in combination with a daemon (spamd) which runs in the background. The latter modus operandi has performance benefits, but potential security downsides.

Typically either variant of the application is set up in a generic mail filter program, or it is called directly from a graphical mail user agent that supports this, whenever new mail arrives. Mail filter programs such as procmail can be made to pipe all incoming mail through SpamAssassin with an adjustment to user's .procmailrc file.

2 Anti-spam techniques

SpamAssassin comes with a large set of rules which are applied to determine whether an email is spam or not. To decide, specific fields within the email header and the email body are typically searched for certain regular expressions, and if these expressions match, the email is assigned a certain score, depending on the test, and several (customizable) headers are added to the mail. The total score resulting from all tests or other criteria can then be used by the end user or by the ISP to set the conditions under which email is moved to a separate spam folder, deleted, flagged etc.

Each test has a label and a description. The label is usually an all upper case identifier separated with underscores, such as "LIMITED_TIME_ONLY", with the description for that label being "Offers a limited time offer". A mail that passes that test (in this case, contains certain variants of the "limited time only" phrase) might be assigned a score of +0.3. With a spam threshold of 5 (default as of version 2.55), several other tests would usually have to pass for the mail to be classified as spam. On the other hand, some tests, such as those for invalid message IDs or years, result in a very high score being assigned, where even a single test can almost put a mail "over the edge".

E-mail recognized as spam by SpamAssassin, here in the Novell EvolutionEvolution or Novell Evolution (formerly Ximian Evolution is the official personal information manager and workgroup information management tool for GNOME. It combines E-mail, calendar, address book, and task list management. It has been an official part o email client.

When a mail's total score is higher than the "required_hits" setting in SpamAssassin's configuration, the mail is treated as spam and rewritten according to several options. In the default configuration, the content of the mail is appended as a MIMEMultipurpose Internet Mail Extensions MIME is an Internet Standard for the format of e-mail. Virtually all Internet e-mail is transmitted via SMTP in MIME format. Internet e-mail is so closely associated with the SMTP and MIME standards that it is sometim attachment, with a brief excerpt in the message body, and a description of the tests which resulted in the mail being classified as spam. If the score is lower than the defined settings, by default the information about the passed tests and total score is still added to the email headers and can be used in post-processing for less severe actions, such as tagging the mail as suspicious.

The user can customize these filters using a file "user_prefs" in their home directoryOn Unix systems, a home directory (sometimes called a home folder is a path on the local file system where a user's personal files are stored. Typically this includes configuration files (usually hidden, i. starting with a ". documents, locally installed. Within this file, they can specify individuals whose emails are never considered spam, or change the scores for certain rules. The user can also define a list of languages which they want to receive mail in, and SpamAssassin then assigns a higher score to all mails that appear to be written in another language. This can be very useful to users receiving a lot of foreign spam but never actually corresponding with people in that language.

3 Network-based filtering methods

SpamAssassin also supports:

DNS-based blackhole listsA DNS-based Blackhole List or DNSBL is a means by which an Internet site may publish a list of IP addresses, in a format which can be easily queried by computer programs on the Internet. As the name suggests, the technology is built on top of the Internet, and checksum-based filters
checksum-based filters such as the Distributed Checksum Clearinghouses and Vipul's RazorVipul's Razor is a checksum based distributed, collaborative, spam detection and filtering network. Through user contribution, Razor establishes a distributed and constantly updating catalogue of spam in propagation that is consulted by email clients to f
HashcashHashcash is a proof-of-work system designed to limit email spam and denial of service attacks. It was proposed in March 1997 by Adam Back. How it works A sender of non-spam email attaches a header line to his email which proves that he has invested a mode as a means to tell 'ham' from 'spam'

4 Bayesian filtering

SpamAssassin by default tries to reinforce its own rules through Bayesian filteringBayesian filtering is the process of using Bayesian statistical methods to classify text documents into one of several categories. Bayesian filtering gained currency when it was described in the paper "A Plan for Spam" by Paul Graham, and has become popul, but Bayesian learning is most effective with actual user input. Typically, the user is expected to "feed" example spam mails and example "ham" (useful) mails to the filter, which can then learn the difference between the two. For this purpose, SpamAssassin provides the command-line tool sa-learn, which can be instructed to learn a single mail or an entire mailbox as either ham or spam.

Typically, the user will move unrecognized spam to a separate folder for a while, and then run sa-learn on the folder of non-spam and on the folder of spam separately. Alternatively, if the mail user agent supports it, sa-learn can be called for individual emails. Regardless of the method used to perform the learning, SpamAssassin's Bayesian test will subsequently assign a higher score to e-mails that are similar to previously received spam (or, more accurate, which are similarly different from non-spam as previously received spam e-mails).

5 Licensing and usage elsewhere

SpamAssassin is free softwareThis article refers to free software as defined by the Free Software Foundation. For software available free of charge, see Freeware. The term free software refers to software which, once obtained, can be used, copied, studied, modified and redistributed., licensed under the Apache Software License. Versions prior to 3.0 are dual licensed under the Artistic License and the GNU General Public License.

SpamAssassin has been used in several commercial products:

McAfee uses SpamAssassin in its anti-spam tool SpamKiller
Spamnix is also based on SpamAssassin
Kerio MailServer uses SpamEliminator, which is based on SpamAssassin, for heuristic spam filtering

6 External links

Spam filtering

<Hide>

Home > SpamAssassin