| |||||||||||||
|
| |||||||||||||
E-mail filters not fooled by signed spam (News.com)E-mail filters not fooled by signed spam (News.com)Posted Oct 12, 2003 19:32 UTC (Sun) by nix (subscriber, #2304)In reply to: E-mail filters not fooled by signed spam (News.com) by arcticwolf Parent article: E-mail filters not fooled by signed spam (News.com) Er, SA's Bayesian algorithm is (an enhancement of) bogofilter's. I think that any single-method attack is likely to fail; to catch things you really need every method you can find: so body-content heuristics and statistical methods and network checks and header analysis combined will be stronger than any one on its own. (The immune system uses the same approach; strength in depth.)
(Log in to post comments)
E-mail filters not fooled by signed spam (News.com) Posted Oct 16, 2003 5:14 UTC (Thu) by arcticwolf (guest, #8341) [Link] Actually, I think that body-content heuristics and header analysis can be viewed as being included in statistical analysis, at least as far as bayesian filtering is concerned. Outside of that, I agree that having both depth and breadth in your approach to spam is a good thing; but for now, bayesian filtering (as implemented by bogofilter - I don't have experience with other tools) seems to do the job so well that there's no need to worry, and with the filter training itself automatically as it classifies messages, only requiring user interaction for false positives or negatives, it seems that there is little that spammers can do, either.In fact, more or less the only approach I can think of right now would be to change spam characteristics so drastically that the (bayesian) filters wouldn't catch them anymore; however, this would require not only a concerted action in which most spammers participate (otherwise, only a few pieces of spam would get through), it would also be effective only for a very short amount of time, until the filters' token databases have been updated. What else could a spammer do? Try to make messages look as much as legitimate email as possible, I assume, but then again, this likely won't be effective - spam is, after all, ultimately about advertising, and a message that does not advertise products anymore in any way does not justify being sent. The filters *will* catch on, and the fact that they are completely dynamical in generation (no static rules) and specific to each user means you can't just attack them. Or at least that's what common sense tells me. Maybe the future will show that there is a fundamental flaw not only in the existing tools, but in the bayesian approach in general, but I can't see it right now; and even if there is, a better technique will follow. Ultimately, the war against spam can only be won. (and I probably shouldn't post comments this early in the morning - or, rather, this late at night -; I seem to get a bit overdramatic. oh well.)
|
|
||||||||||||