What Is A Spam Filter?

A Spam filter looks at the body of an email and uses a set of rules to decide whether or not it is spam.

• Sample rule: If the email has the word "Viagra" in it -- it is spam.

• Sample rule: If email has many words IN ALL CAPS -- it is spam.

How is it different than a Spam Blocker?

A spam blocker looks at the header (e.g., To:, From:, IP Address, etc.) and based on a list of known spam header characteristics, decides whether or not it is spam.

• Sample rule: If the email comes from a known spam address -- it is spam.

• Sample rule: If the email comes from a known spam domain -- it is spam.

You can see that spam filters and spam blockers do the same thing in different ways.

What are the best spam filter techniques?

Not too long ago, it was pretty simple: you could look at an email and tell it was spam -- at least as far as you were concerned. So you'd just click the delete key and move on.

But a couple of things happened.

• The volume of email increased;

• The percentage of those emails that was spam increased

The solution was straightforward: automate the process. Use software to scan the emails and calculate a score for each one. The higher the score, the more likely it is to be spam. If the score is high enough, move the spam to a separate folder, e.g., the "spam" folder or the "Junk" folder.

The spammers, understanding how lucrative spam can be, responded by doing one or more of the following:

• Disguising the words that made the score too high (e.g., change the spelling) so that a human could read it, but the software could not.
  

• Adding a flood of neutral (or even gibberish) words to throw off the score. Humans ignore the gibberish and act on the spam.
  

• Disguising the website address so that a human could read it, but the software could not.

It was a regular arms race. Sending out lists of spam keywords became impractical; a better system was developed:

Bayesian filtering.

This kind of spam filter calculates a score but it also gets smarter the more you use it.

Here's how it works:

(continued on next page)