Current email spam filtering solutions and emerging approaches

¶ … spam filtering solution available and tries to analyze and compare the best way to fight email spam and come up with new ideas and approaches to decrease the amount of email spam received by the organizations. This is important because e-mail spam is causing the it industry billions of dollars annually and it is also interfering with legitimate e-commerce and communication. Therefore, this case study gives detailed and unbiased information on the current solutions being used by the it industry and shows the new approaches that will be used. The tactic involved in the data gathering process has been that of a collection of the largest possible number of existing information related to the spam filtering tools from articles published in various scientific journals and magazines by individual researchers, as well as, research institutions. From the data gathered, it is clear that no past studies of this magnitude on this subject have been conducted. The results indicate that whilst, numerous anti-spam products exist in the market, many diverse anti-spam methods and procedures are being used by these products to filter spam. Some of the most widely used techniques found in these products have been summarized and newer ideas and recommendations are also given so that comprehensive steps can be taken to eliminate the phenomenon of spam.

CHAPTER I

INTRODUCTION

Statement of the problem

The thesis takes a look at the current spam filtering solution available and tries to analyze and compare the best way to fight email spam and come up with new ideas and approaches to decrease the amount of email spam received by the organizations.

Significance of the Study

E-mail Spam is causing the it industry billions of dollars annually and it is also interfering with legitimate e-commerce and communication.

Purpose of the Study

In my thesis I will give detailed unbiased information of the current solution used by the it industry and show the new approaches that will be used.

Introduction

Spam has become a nuisance for all email users because the element of privacy is compromised and also valuable time and money is at stake. Michael J. Blotzer (2002) highlights the difficulties related to spam. Besides attacking the secrecy and discretion of individuals and wasting valuable time, spam costs valuable money to the organizations. He writes, "Spam arrives at significant cost to the consumer. Spam typically makes up 10% to 30% of e-mail traffic and accounts for as much as 50% of all traffic at some Internet service providers (ISPs). The added expense of bandwidth, servers and engineering support to accommodate spam can cost an ISP millions of dollars per year. One telecommunication company estimates that each spam e-mail costs $1 in lost productivity. You can bet those costs are reflected in subscribers' monthly bills (Michael J. Blotzer, 2002)."

Spam causes financial losses to businesses through the traffic it generates, the time taken to delete these emails. The present environment presents significant threat to the businesses through increased competition and globalization and the last thing businesses want is for their employees to waste valuable and congested Internet traffic. Peter Piazza (2003) reveals the economic and financial problems related to spam: "What can be done to halt the onslaught of spam? The problem is reaching ever-higher proportions, both for corporations and users. On the corporate side, the concern is the rising cost of the traffic (more than $10 billion for American businesses this year, according to a recent report by technology research firm Ferris Research), while for Web surfers, the concern is time and convenience; for example, deleting offensive or annoying messages takes 10-20 minutes per day, according to antivirus firm Symantec. And according to a 2001 study for the European Commission, simply receiving spam cost users $10 billion euros a year worldwide. One pioneer has an idea that he believes may stem the tide: charging spammers for their messages (Peter Piazza, 2003)."

Eric Krapf (2003) explains that email has transformed the lives of ordinary people, business executives and organizations because of the extraordinary usefulness and efficiency of this tool. However, the application of this tool is being endangered by unsolicited commercial advertisements (also known as spam) because businesses are loosing valuable assets because of uncalled-for commercial advertisements. Over the years spam has become a global problem and it has become impossible for any individual nation to act individually to solve this problem. These complications have made businesses use other alternatives, which for now are less problematical, such as "instant messaging." (Eric Krapf, 2003).

Eric Krapf (2003) disagrees with this development and notes, "As if the spammers won't be able to figure out a way to reach us through IM (instant messaging). Right now, chat rooms and enterprise systems make up a universe that's narrow enough that protecting your privacy may not be too difficult. But if and when IM becomes the common mode of electronic communication, don't expect to keep your contact information private. Technology can't defeat a problem when the perpetrators are determined to use technology to further their own ends. The overwhelming popularity of the anti-telemarketing 'do not call' list shows that people want public networks to be used for the public good. it's time for 'do not spam' legislation with teeth (Eric Krapf, 2003)."

It has been revealed, in one latest study, that spam is more destructive and harmful that hackers and global viruses. While many studies have revealed that there has been a noteworthy decline is spamming, the costs of this menace are still staggering.

Tim Lemke (2003) writes, "London-based computer-security firm mi2G said in a report on Thursday that computer outages and lost productivity because of spam led to $10.4 billion in worldwide economic losses in October. Meanwhile, the company said viruses and worms - also known as malware - caused $8.4 billion in losses, while hackers contributed to $1 billion in financial damage worldwide (Tim Lemke, 2003)."

The war being waged against spam has become a household battle as Internet users, throughout the world, have been subscribing to spam filtering software companies. This is because the percentage of spam in the total quantity of emails is very high. William Powell (2003) reveals, "Gartner Research estimates that spam accounts for half of all corporate email. Surprising, isn't it? Spain filters keep much of it from reaching your in-box, but what slips through creates an increasing drain on productivity. Ferris Research estimates that drain will cost corporations U.S.$10 billion in 2003. Brightmail reports that nearly 40% of all email is spam. That figure is up 32% from late 2001 (William Powell, 2003)."

The future outlook of spamming is also not very encouraging because as the number of Internet users and businesses are increasing rapidly so are the figures of unsolicited commercial advertisements. As William Powell, 2003 notes, "Some people actually buy the products that spam advertises. Estimates for follow-ups run 0.1 to 1%. That may sound insignificant, but consider that eMarketer estimates that 76 billion messages are sent out annually through legitimate opt-in email marketing campaigns and that, all told, 2.3 billion spam messages are sent daily. Even at a 0.1% return, the dollars start adding up. Jupiter Media Metrix expects expenditures on legitimate email marketing alone to reach U.S.$9.4 billion by 2006 (William Powell, 2003)."

Spam affects more than one area as revealed by the elevated costs of damage and devastation done through spam. Celia Wren, (2003) writes, "That $9-billion figure takes into account variables like 'consumption of bandwidth' and 'loss of worker productivity' (the average worker, according to Ferris's analysts, wastes 4.5 seconds on each morsel of spam). What these figures do not measure or explain, of course, is the subjective dimension -- the pent-up fury experienced by the helpless spam recipient (Celia Wren, 2003)."

Fred S. Knight (2004) downplays the role technology may play in solving the menace of spam. He writes, "I'm sure that the spammers will find ways to fight and delay the deployment of new technology, and they will do everything they can to keep carriers from locking down the public network. Spam is one of those issues where technology's ability to solve the problem is limited by the public's will (Fred S. Knight, 2004)."

It is clear that spam is a significant threat to the it industry and it has become imperative that an in-depth study of the present spam filtering solutions available are examined and analyzed so that the best way to fight email spam can be discovered and new ideas and approaches to decrease the amount of email spam received by the organizations are also determined.

CHAPTER II

METHODOLOGY

This dissertation is a case study that takes a look at the current spam filtering solutions available and tries to analyze and compare the best way to fight email spam and comes up with new ideas and approaches to decrease the amount of email spam received by the organizations.

Collection of Data

The tactic involved in this process has been that of a collection of the largest possible number of existing information related to the spam filtering tools from articles published in various scientific journals and magazines by individual researchers, as well as, research institutions.

Data analysis and Search tactics

The data analysis and search tactic depended on manifold means so as to guarantee the most advantageous totality of facts and statistics available. At the outset, a comprehensive literature exploration had been performed by means of internet, as well as, university and public library. In this manner the bulk of published information relating to the spam filtering tools had been distinguished and compiled.

The analytical strategy employed in this paper has firstly identified the gravity of the situation at hand relating to the phenomenon of spamming and its affects on the global ecommerce industry. Appropriate theories and facts have been given to prove not only the seriousness of the situation but also the validity of the arguments. Subsequently, an in-depth overview is given of the spam filtering solutions presently being offered it companies in the ecommerce market by evaluating the strengths and weaknesses of these products and the opportunities and threats in the ecommerce environment. In the conclusion, not only a thorough analysis of the most suitable tools has been provided so that the ecommerce industry can eventually decrease the costs related to spam and increase productivity, but also new ideas and approaches have been given to recommend unique ways to decrease the amount of email spam received by the organizations.

Limitations

It is imperative to analytically assess the outcome and the entire case study. This is because this case study has some limitations that should be observed when taking into consideration the importance of the case study and its assistance. This case study has concentrated on a subject that has been an extremely large and leading one, that is, the best spam filtering tools available presently. Undoubtedly, this characterizes an extremely difficult assignment for research in spite of the more precise interests that the case study might have. This wide-ranging and difficult subject has been analyzed from a somewhat limited experimental perception. The choice of the single case study design obviously draws out numerous limitations in so far as the simplification of the outcome of the case study is involved. Consequently, the case study setting can simply be termed as a sort of direct framework of the ecommerce market procedures.

One more limitation of this case study has been the viewpoint assumed. Rather than attempting to thoroughly comprehending the past, present and futuristic market trends related to the phenomenon of spamming, this case study has been primarily limited to the best spam filtering tools presently available. Even though the case study has also considered additional observations related to newer ideas and approaches along the hypothetical strategic recommendations, the most important point-of-view from which results have been sketched is that of the spam filtering solutions presently being offered to it companies in the ecommerce market.

CHAPTER IV

RESULTS

To cope with the rising spam dilemma, it companies have been making great strides to discover newer methods and tools to block spam, at the same time making certain that genuine e-mails are not delayed or deleted. Despite the fact that there are numerous it companies providing real time solutions for jamming spam, only the leading it companies and their most favored solutions are considered for this study. This is important because in order to successfully understand, discuss and compare the methods being used to fight spam and give new solutions and recommendation, it is imperative that we review the salient features of the best and the most used spam filtering products. Following is a brief description of the main features of the spam filtering solutions being offered by the leading it companies:

BrightMail

Brightmail is considered to be leading the market of spam filtering solution by consistently delivering products that have an edge over the other products available in the market. The basic features of Brightmail's spam filtering products are:

Source: filtering based on where the spam is coming from, identifying and blocking IP addresses that generate spam (PR Newswire, 7/21/2003);"

Content: filtering based on the messages themselves and what their content is (PR Newswire, 7/21/2003);"

Call-to-Action: filtering based on the sites where spammers want to take you to (PR Newswire, 7/21/2003)."

The success of Brightmail can be gauged from the fact that a number of world's leading businesses are using their products to tackle the spam menace. Some of these companies include, Avaya, eBay, Booz Allen Hamilton, Cypress Semiconductors, Deutsche Bank, Lucent Technologies and Terra Lycos. Brightmail also provides spam protection for the leading Internet service providers, including at&T WorldNet, EarthLink, MSN, and Verizon Online (PR Newswire, 7/21/2003). Brightmail consistently upgrades its products to stay ahead of the spammers and the features newly added in the Brightmail's latest spam filtering product are highlighted below:

Improved Effectiveness-blocks more spam with no additional administrator effort (PR Newswire, 7/21/2003)."

Improved Custom Rules-blocks spam based on an administrator's definition of spam (PR Newswire, 7/21/2003)."

Improved Administration -- even easier to install, administer and upgrade (PR Newswire, 7/21/2003)."

Improved Submissions-end users now have more control in fighting spam (PR Newswire, 7/21/2003)."

Improved System Support-support for Windows 2003 and Exchange 2003 (PR Newswire, 7/21/2003)."

NEMX's Intelligent Message Filter (IMF)

In 1994, Nemx Software Corporation had been founded with the primary objective to offer flexible security tools to the Microsoft Exchange environment. The company has been extremely successful in achieving its objective. (PR Newswire; 10/18/2004). The latest spam filtering product offered by Nemx has been widely used by companies all over the world. Some of the basic features of the product are: "The IMF complimentary functionality of Power Tools 5.0 offers it administrators more flexibility over their Exchange security responses. The new product enables better control over Spam Confidence Level (SCL) handling and offers a wider selection of filtering actions than are available through the standard filtering options provided by Microsoft. With the easy-to-use Power Tools 5.0, it administrators can define and control SCL thresholds at various levels within their Exchange organization including servers, groups, and mailboxes, and assign different reactions to each level. For instance, in a K12 school environment, staff receiving spam may have the offending message automatically moved to a subfolder, while the same message to a student would be deleted (PR Newswire; 10/18/2004)."

The McAfee Spam Killer

While many spam filtering solutions require manual training, which can be very difficult for novice users, the McAfee spam filtering products are completely automated providing the users ease of use and relief (PR Newswire, 4/12/2004). Furthermore, McAfee provides its users a comprehensive solution be analyzing every email message from six different tools. These tools include (PR Newswire, 4/12/2004):

Bayesian Filtering -- the McAfee SpamAssassin engine Bayesian filtering comes pre-configured with an out-of-the-box filtering database, and features an innovative auto-learning system which will adapt to the users' particular email stream."

Integrity Analysis -- Examines the header, layout and organization of every incoming email message and applies thousands of algorithms to determine if the email is spam."

Heuristic Detection -- With a set of automated rules based on known spam characteristics, McAfee SpamKiller works proactively to secure the network against spam."

Content Filtering -- the administrator-defined set of words and phrases helps further identify unwanted email and inappropriate content."

Personalized Black and White Lists -- a set of standards defined by the administrator and users utilizing white and black lists to determine both acceptable senders of email, as well as unwanted and unacceptable senders of email."

Self-tuning -- With the ability to learn the characteristics of email received at the desktop, McAfee SpamKiller powered by McAfee."

Spam-Assassin is able to adjust the overall spam score for messages received from known senders. This functionality is provided in McAfee."

With regards to the mail servers, "DNS-Blocklist Support -- the McAfee SpamKiller appliances are able to integrate with Internet-based DNS blocklists to ensure that email sent by known 'spammers' is automatically blocked."

SurfControl

SurfControl is another company that has provided the it industry with superior products to combat spam. The latest spam filtering product being offered by the company has added several new features so that the users can maintain and secure the information they obtain, whilst avoiding all the junk mails to save time and valuable resources. The major new features of SurfControl spam filter comprise:

Virtual Learning Agent (VLA): SurfControl now offers this optional intelligent tool that ensures content is understood in context for each organization (PR Newswire; 4/29/2002)."

Header Modification: SurfControl now strips the IP address and all routing information from e-mail messages before they reach their destination to offer additional security protection against spammers and hackers (PR Newswire; 4/29/2002)."

File Attachment Compression: SurfControl now saves more time, bandwidth and storage. Large file attachments are automatically compressed to minimize the file size when sent over the server. The process is completely transparent to the user (PR Newswire; 4/29/2002)."

Infocrossing, Inc.

Infocrossing, Inc. is another it company that introduced several successful products related to information and data security. Its clients include many fortune 500 companies, as well as, many small businesses, showing diversity in the application of its products. Its most successful product is called MailWatch (TM), which has been upgraded several times. The latest version, MailWatch (TM) 5.0, has several layers of anti-spam protection and discourages spam by using multiple techniques. The main features of MailWatch (TM) 5.0 are:

Enhanced Spam Protection. MailWatch (TM) 5.0 incorporates Infocrossing's innovative Threat Throttling feature and Symantec's Brightmail Anti-Spam (TM) to effectively and accurately block spam. Threat Throttling discourages attacks by using proprietary scanning and correlation techniques to present spammers with randomized patterns 'acceptance', and congests their networks to prohibit them from quickly sending more messages through the MailWatch (TM) system. Symantec's Brightmail Anti-Spam (TM) has been deployed as the initial spam verdict engine in the multi-layered MailWatch (TM) spam filtering architecture (PR Newswire; 4/11/2005)."

The consumers who are not aware of the technical details associated with email servers can also successfully manage the MailWatch (TM) 5.0. "Tailored Administration. With MailWatch (TM) 5.0, companies can choose the level of administration and control best suited to their business. The Professional Edition is ideal for companies of any size that want an effective email security solution that can be managed by a non-technical administrator or department manager. The Enterprise Edition was designed for companies with a security administrator that wants full control to monitor and enforce compliance policies down to the end-user level, create custom reports and guard against spam and viruses (PR Newswire; 4/11/2005)."

Symantec

Many organizations and domestic Internet users have been tired of using products that serve single purposes. In this light Symantec has introduced its latest beta version of Norton Internet Security 2005. Norton Internet Security 2005 AntiSpyware Edition is being built with multiple scanning levels to provide extensive protection against spyware risks. Unlike most standalone antispyware products that can't fully detect spyware and adware in real time, Norton Internet Security 2005 AntiSpyware Edition identifies spyware at the point of entry, leveraging Symantecs highly effective mechanisms already in use to block viruses today (M2 Presswire; 4/19/2005).

This latest version has been upgraded to counter the challenges posed from spyware along with spam, viruses, worms and hacker attacks. This single product with multiple benefits has won many awards and its latest version has already created an innate sensation amongst organizations and Internet users. This is because, "Norton Internet Security 2005 AntiSpyware Edition is being built with multiple scanning levels to provide extensive protection against spyware risks. Unlike most standalone antispyware products that can't fully detect spyware and adware in real time, Norton Internet Security 2005 AntiSpyware Edition identifies spyware at the point of entry, leveraging Symantecs highly effective mechanisms already in use to block viruses today (M2 Presswire; 4/19/2005)."

This latest version has also been upgraded to produce a lot more accurate results. The spamming and spyware tools used in this latest edition have been structured to accurately produce the desired results. "Another advantage of Norton Internet Security 2005 AntiSpyware Edition will be its ability to accurately differentiate between actual spyware risks and legitimate software applications. The potential for false positives with Norton Internet Security 2005 AntiSpyware Edition will be significantly reduced because real-time detection will be based on known signatures that are posted by Symantec Security Response and deployed via Automatic LiveUpdate rather than on the rudimentary system monitoring typically associated with other standalone spyware solutions. (M2 Presswire; 4/19/2005)."

Trend Micro

Trend Micro has been producing products that have been protecting valuable information flowing from email servers, Internet gateways, and file servers. This method of stopping spam at the main server allows the workforce of organizations to focus on their work. An email content filter to block email based on certain keywords or phrases, enabling administrators to stop potentially infected email messages from being delivered to unsuspecting users and to prevent distribution of confidential or inappropriate information into or out of the enterprise. Filter profiles are based on keyword lists, Boolean ("not") keyword lists and synonyms. Blocked email can be deleted, quarantined or archived (Business Wire; 11/13/2000).

InterScan eManager allows the mangers to control the content of the message, as well as, block file attachments, and filter spam. This is achieved through Intelligent Message Filtering (IMF) tools featured in the latest version of their product. Its main features include, "A file attachment blocking feature that allows administrators to block incoming files by file name, type, etc., while still permitting other non-threatening email to pass through." Also, "A rule-based spam filter to block junk mail before it reaches a company's mail server. The spam filter includes both a self-updating list of common spam sources and a customizable list of sources. The filter checks message headers (to, from, cc and subject fields) for routing domain, in-bound/out-bound status and message size, and checks the message body for designated keywords and phrases (Business Wire; 11/13/2000)."

ProofPoint

The Server (TM) produced by Proofpoint checks all email messages, whether they are incoming or outgoing, in three separate parts; (1) Spam Detection, (2) Content Compliance and (3) Virus Scanning. With the rising demand of customized email examination, Proofpoint Server (TM) has been upgraded to meet the specific demands of individual companies. The three different procedures for spam checking can be briefly described as:

Spam Detection analyzes attributes of incoming email messages in real-time. The attribute extraction process inspects all aspects of incoming messages, from the network connection-layer to message envelope, headers and structure, as well as unstructured content in each message. (PR Newswire; 7/21/2003)."

Content Compliance works in conjunction with an organization's established corporate policies and training programs to ensure that compliance is enforced throughout a company's email infrastructure. This limits an organization's exposure to costly liability and mitigates email risk. (PR Newswire; 7/21/2003)."

Messages are scanned for viruses in parallel with spam and content inspection, and administrators are presented with a unified interface for email protection, resulting in the most efficient processing and management (PR Newswire; 7/21/2003)."

MailFrontier

While numerous different methods exist to tackle the growing threat of spam, very few companies have been able to produce the right combination of tools to tackle the problem effectively. Many organizations believe that MailFrontier is one such company. This is because it protects the time and resources of the organizations by successfully stopping all spam at the gateway. "MailFrontier Anti-Spam Gateway creates a dynamic eProfile -- a distinct blocking profile based on the nature of a corporation's communication. The eProfile is constantly updated, automatically tuning its spam blocking capabilities in order to optimize effectiveness specifically based on the mail characteristics of the corporation (PR Newswire; 2/17/2003). "

Furthermore, the fact that many large and small businesses have opted for spam filtering solutions provided by MailFrontier, it goes to show that the products being offered are not only relatively cost-effective and successful but also flexible enough to meet the unique requirements of different organizations. "MailFrontier Anti-Spam Gateway offers flexible deployment options, including per-user spam management capabilities for power users and gateway configurations for centralized it control (PR Newswire; 2/17/2003)."

Spammers have been consistently looking for newer ways and means to overcome the latest technology it companies have to offer to combat spam. Many have been successful in their endeavors; therefore it is imperative for it companies to consistently upgrade their products to confront the spammers head on. Up-grading spam filtering products is one area where MailFrontier has been very successful. Their latest version includes many new tools and features. "MailFrontier Anti-Spam Gateway has the most comprehensive spam blocking available -- using proven techniques such as blacklists and content filters as well as innovative dynamic whitelists (automatically-generated lists of approved senders whose email always gets through) and a collaborative global spam reporting network. First generation spam products have shown that products offering only one blocking technique are not effective against the increasing sophistication of spam. MailFrontier is the first company to offer the most comprehensive set of spam blocking techniques integrated into an enterprise gateway solution (PR Newswire; 2/17/2003)."

Vircom

The major distinction between the spam filtering solutions offered by Vircom and other spam gateway products is that Vircom allows a lot more flexibility and control to its customers so that the customers can design their mail servers to match their specific needs. This move has allowed the company to sell additional products associated with spam filters. "The difference with VOP modusGate is it re-introduces the concept that customers should be in control of their corporate communications. VOP modusGate features a built-in compiler to create customized scripts and, if desired, to submit them to Vircom for validation and distribution to all customers. The response from the ISP community has been immediate. More clients are not only sharing Sieve scripts but are also joining Vircom's new VOP Anti-Spam Coalition (VASC) to obtain full open access to scripts to design even better and more intelligent anti-spam filters. Sieve scripts are made available in different categories including financial, pornographic, medical, educational, and gambling spam emails (Business Wire; 6/6/2002)."

Furthermore, the Intelligence Message Filters offered by Vircom are no ordinary gateway filters because they have utilized the latest and the most unique technology to detect and delete all unwanted emails. "Layered with intelligence, VOP modusGate is the first Windows-based gateway to be user-aware, meaning it can first determine whether an enterprise employee actually exists on the company mail server before scanning for spam and viruses. If not, VOP modusGate simply rejects the message. Before scanning, VOP modusGate simulates a connection to the mail server to verify if the user exists with the results cached for greater performance. This is an effective method to prevent spammers from flooding email systems and to save system resources (Business Wire; 6/6/2002)."

Bayesian Spam Filtering

Many critics believe that Bayesian spam filtering can be developed into the world's most prolific and dynamic anti-spam tool covering all the features of other tools currently being used to counter the threat of spam. However, this is only a theory and practical steps have to be taken so that the true potential of this tool can be utilized. Bayesian filters are designed to handle these shades of gray, dealing in probabilities rather than definite rules. They're named after Bayes' Theorem, the equation they use to calculate the likelihood that a message is spam. Unlike a filter, this calculation takes into account both the factors that mark a message as spam and the factors that mark it as legitimate e-mail, thus ensuring that evidence is weighed fairly (Andy Dornan, 2004).

The process used by the Bayesian filters is also very unique. However, many critics believe that the process needs to be upgraded so that more accurate results can be obtained from this tool. It is worth noting here that this technology is in its infancy and a lot of work needs to done to propel the true potential of this tool. "When a Bayesian filter receives an e-mail message, it scans for particular tokens-strings of characters that are likely to be significant in determining whether or not a message is spam. A token is usually a word, but it doesn't have to be: The best Bayesian filters scan message headers as well as bodies, in which case tokens are likely to be IP addresses or domain names for every token, the Bayesian filter's database contains a probability value that measures how likely it is to appear in spam vs. regular e-mail. The clever part is that these probabilities are themselves continuously recalculated, based on the e-mail and spam that a particular user receives. This means they quickly adapt to new spammer tricks and are automatically customized to fit each user's definition of spam. Users don't have to understand probability theory or fiddle with filter settings. All they have to do is train the filter by marking which incoming messages they want to receive and which they don't (Andy Dornan, 2004)."

Mirapoint

Mirapoint is another company that has been very successful in producing products that stop spam and other security threats at the network gateway so that the workforce of any organization can channelize their energies on productive work and leave the battle against spam to be fought by the Mirapoint servers. "Designed to complement an existing email server, the Mirapoint Message Director provides multi-layered security protection at the network edge to block hackers, spam, and virus threats, as well as provide advanced management of message traffic through policy enforcement tools, content filters, and detailed reporting. For small- to medium-sized businesses or for highly distributed organizations, Mirapoint also offers the RazorGate line of email security appliances that employ the same industrial-strength technology as the Message Director and can be deployed to secure and protect any existing email server (M2 Presswire; 5/25/2004)."

Not only is the Mirapoint Server dedicated to adapt to the specifications of the organizations but also provide a multi-layered security services to protect the network from unwanted emails. "The Mirapoint Message Server is the industry's only dedicated appliance that integrates email routing, storage, access and management with Mirapoint's comprehensive, multi-layered Full-Spectrum email security technology. The Message Server is designed to support any enterprise, service provider, government or education customer trying to deliver email to a broad base of users that demand anytime, anywhere access to carrier-grade email services (M2 Presswire; 5/25/2004)."

Tumbleweed

Founded in 1993 and headquartered in California, the company has made huge strides in providing a variety of security solutions to a number of private and public organizations. These include, Bank of America Securities, ABN Amro, JP Morgan Chase & Co., Catholic Healthcare West, the Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the U.S. Food and Drug Administration, and the U.S. Navy and Marine Corps. Spam filtering servers provided by Tumbleweed are considered to be the most effective in business today. "Tumbleweed Email Firewall has been recognized as having the best email security product functionality by META Group, and was rated the #1 enterprise software solution for fighting spam, according to Network World (http://www.nwfusion.com/reviews/2003/0915spam.html).Tumbleweed Email Firewall protects, filters and secures email traffic at the Internet gateway with an integrated set of anti-spam, anti-virus, anti-hacker, content filtering, email relay and encrypted messaging capabilities -- minimizing email communications risks and reducing email management costs. Tumbleweed Email Firewall is used by more than 400 of the world's largest, most demanding messaging infrastructures, and is available in both appliance and software editions (Business Wire; 12/15/2004)."

Sybari

Sybari is another widely used tool to fight spam at the network gateway so that the administrators can successfully reduce the influence of spam emails on their local networks. Sybari gives a great deal of flexibility and control to the administrators so that they can convert and adapt the email servers to their specific requirements. "Administrators are able to filter messages and apply designated actions through multiple methods: Real-Time Black Hole List (RBL) lookup, DNS Lookup, Sender/Domain Filtering, Rules-based Message Body Scanning, and Subject line content-filtering. The module identifies Spam, offensive language and confidential information based on pre-packaged filters and customized configuration information. Identified messages can be purged to further reduce the amount of unsolicited employee e-mail traffic entering a messaging infrastructure. The Sybari Spam Manager also enables companies to set and enforce policy regarding content of e-mail destined for e-mail addresses outside the organization (Business Wire; 6/2/2003)."

Sunbelt Software

Sunbelt provides both the end-users and the administrators to deal with the menace of spam. This flexible approach has been a major factor in their success. Furthermore, the consumers can easily install the software because the company has simplified the process of installation and setup. Some of the most dynamic features of Sunbelt email servers (known as iHatespam) are as follows: "The constantly updated anti-spam engine uses built-in content-based filters that utilize approximate pattern matching, forged header analysis, rule-based filtering and internal lists of known spammer email addresses and domains. The spam engine also uses spam mutation detection, which looks for variations in junk email as spammers attempt to bypass detection engines."

Furthermore, the potential for false-positives are extremely low and the inclusion of the end-users allows these users to create their own personal whitelists and blacklists. "iHateSpam Server provides multiple options for dealing with potential false positives: Administrators can fine-tune the aggressiveness of spam detection through threshold settings as well as set client- or server-side lists of acceptable senders (whitelists) or unacceptable senders (blacklists). Furthermore, end-users always get email from people in their own Contacts folder (PR Newswire; 4/29/2003)." Lastly, "One unique feature of iHateSpam Server is its ability to include the end-user. While managing the spam detection at the server level, the program can optionally place spam caught into a spam folder in the user's inbox for review by the user. End users can also create their own whitelists or blacklists, which are then automatically used by the server in filtering spam for that user (PR Newswire; 4/29/2003)."

SpamCure

SpamCure is another server that has been extremely successful in countering the threat of spam. Their process includes three different modules. These e modules are explained as follows: "SpamCure uses three ways to maximize the amount of spam detected while minimizing false positives. First, each e-mail is subjected to eleven different categories of tests. Second, these tests and the associated spam 'signatures' are updated by the minute to reflect new spam on the Internet and any new tricks being tried. Third, users and administrators can customize their filters to pass or stop e-mail based on their specific preferences (PR Newswire; 8/13/2002)."

It is very easy to install and use the software as only a few minutes are needed for installation. "The software is installed on a Windows 2000 Server computer. It typically takes just a few minutes to get the software up and running -- integration into a customer's existing e-mail server is not required (PR Newswire; 8/13/2002)."

SpamCure is not only very easy to handle but also very reliable, when it come to protecting sensitive information. The user also has a variety of options to choose from, after spam has been detected and can also control and redesign the major functions of the software to suite the personal requirements of the organization. "The SpamCure has built in measures to insure the servers are secure from intrusion, such as retrieving new spam signatures via an encrypted channel from Mail-Filters. E-mail security is unaffected by the use of SpamCure. Additionally, SpamCure is a redundant e-mail server to existing e-mail systems, thus offering increased reliability for the corporate e-mail system. Mail-Filters uses ultra-fast proprietary filtering technology that allows e-mail to reach the user with no perceptible delay (PR Newswire; 8/13/2002)."

GFI Mail essential 7

GFI Mail essential 7 unique features that effective combat the threat posed by spam. Spam can be blocked at the server allowing the end-users to focus on their work. "GFI Mail essentials 7 includes an advanced anti-spam module that detects typical spam practices, such as incorrect Reply to addresses, from headers with nonexistent domains, and so on. GFI Mail essentials also allows administrators to configure lists of keywords and phrases enabling it to identify most spam mails (PR Newswire; 6/20/2002)."

Furthermore, organizations can add several useful messages and promos along with the message and thereby save the time of the workforce. "With GFI Mail essentials, organizations can add a legal disclaimer and/or a standard corporate message to each outgoing email at server level. GFI Mail essentials supports disclaimers in text and HTML format (PR Newswire; 6/20/2002)."

Furthermore, the GFI Mail software has manifold procedures to ensure that the most accurate results are obtained and at no point should the information security be compromised. "GFI Mail essentials allows administrators to archive all inbound and outbound Internet mail to a database, for back-up or monitoring purposes. It also includes a module that can create reports on Internet mail use such as detailed logs of sent mail, daily statistics and reports per user or by date range (PR Newswire; 6/20/2002)."

Lastly, a major new feature has been added to the GFI Mail essential 7 version. "Unlike previous versions, GFI Mail essentials 7 does not include email content checking and anti-virus features. These now form part of GFI MailSecurity for Exchange/SMTP, an email content checking, exploit detection, threats analysis and anti-virus solution that removes all types of email-borne threats before they can affect an organization's email users (PR Newswire; 6/20/2002)."

CHAPTER V

CONCLUSIONS and RECOMMENDATIONS

Unsolicited e-mail might look like a minor frustration, however, left unchecked; it can block a server and turn out to be a channel for network-threatening bugs and worms. The most excellent method to defend against spam is to combine and counterpart numerous spam filters. Furthermore, in the near future, spam will be contended mainly by Internet service providers (ISPs), business it sections, end consumers, as well as, to a smaller extent, the legal sectors of bigger businesses along with the governments.

The result so far has been that spam (unsolicited bulk E-mail) has been similar to a storm whose wind velocity continues to augment, damaging the assets of it units and congesting Internet bandwidth. To articulate that spam figures are depressing and miserable is putting it kindly. It is safe to predict that the phenomenon of spamming will quickly surpass preferred E-mail messages on key backbones and there is little agreement in the Internet community on a long-standing explanation to the predicament.

The simplest method to do away with the expenses related to spam is to get rid of spam. However, this is easier said than done. Nonetheless, organizations can make efforts to achieve this by employing one or more e-mail filtering tools. From the abovementioned results, it is clear that many alternatives are present; however, not all the alternatives can be considered to be feasible for every business or consumer. For example, a lawyer may be obligated to stock a duplicate of every e-mail received. Further, several spam filters give the best results when they function at the edge, whereas other filters need end-user management.

At the same time numerous anti-spam products exist in the market (as is evident from the results), many diverse anti-spam methods and procedures are used by these products to filter spam. Some of the most widely used techniques found in these products have been summarized below. From the results of this study, it is clear that these techniques are being utilized, in one structure or another, by approximately all the spam filtering products, whether these products focus on end-users or on the gateways and servers or the ISPs. Characteristically, all spam filtering products will present a combination of these techniques to bring the best possible results, a method that has achieved relatively greater success.

Managing Possibilities: all spam filters utilize substances to negate e-mail; therefore organizations using spam filters analyze how the substances are allocated. Straightforwardly, "possibility grades" have been found to be helpful when two or more analyses have been activated before an email can be dependably discarded. This has been characteristically required when any solo analysis is not considered to be strong enough to be utilized to discard emails separately, and has been considered to be useful with spam filters that are recognized to give fake-positives occasionally. For instance, an organization might make a decision that the majority of the e-mail from a particular domain is spam; however, all of its emails cannot be rejected. Correspondingly, the organization might acknowledge that e-mails with a particular string are almost certainly spammed; however, this cannot be depended on with complete certainty. In these instances, organizations keep away from "unconditional filters" and persist with "possibility substances."

Another technique used by spam filters is Network blacklists. Network blacklists directly reject traffic from particular IP addresses, as well as, networks. Since majority of the e-mail servers maintain these filters, numerous e-mail administrations attempt to obstruct e-mails from recognized wrongdoers with a blacklist. On the other hand, this type of spam filtering is a realistic method only in very limited circumstances.

Another method used by spam filters is distributing DNS blacklists. Distributed DNS blacklists have been a fresh supplement in the spam filtering tools; however, in such a short time, they have already become enormously helpful. These listings utilize name-to-value research services on DNS. The inquiry recognizes the doubtful hosts, and the reply specifies whether that host is registered in the suspected blacklists.

Another tool used by spam filters is blacklists. Blacklists have been a great spam filtering tool for maintaining recognized junk off the local network, however, these blacklists are certain to create a number of faults. Consequently, organizations have some sort of whitelists to assist them in suitable e-mails to overcome the spam filtering tools. Majority of the e-mail systems that maintain whitelists have been be utilized with the similar array of spam filters as their blacklist equivalents. At the same time blacklists are successful at several instances in the transfer pathway, one negative response is sufficient to keep the email from making any advances into the local network -- whitelists are utilized at each transfer point to guarantee that a legitimate message is not discarded.

Another current development in the clash against spam mail is the utilization of procedure validity trials. These trials, which try to establish if a specific sender or email matches to recognized customs are considered to be successful. On the other hand, since these trails rely on conventional and common measures, they also produce a remarkable figure of fake-positives. The organizations utilizing this spam filtering tool have to make excellent judgments because this tool is best utilized for assessing possibilities instead of for completely declining emails.

Additional spam filters examine and authenticate the content of the email. Characteristically, these examinations can be executed only after the email has been transmitted.

The capacity of these spam filtering tools might give the impression to be great and awkward, however this is the situation at hand: people engaged in spam have been continuously in search of innovative methods to get around filters, therefore, latest technologies have got to be developed to plug those openings being consistently created by the spammers. On the positive aspect, the present spam filtering tools can be relatively successful at fighting spam should a suitable quantity of procedures and organizational funds are devoted to the dilemma.

Furthermore, educating the end users on ways to distinguish and keep away from spam merits a lot more consideration than it is presently receiving. Regularly, a small proportion of a business' consumers are getting the bulk of the spam. At the same time that can occasionally happen owing to issues beyond a user's power, it also happens on account of people who have not been sensible about where or how they disclose their email addresses and other personal information. Responding to inquiry within a spam email has been a characteristic trick utilized by spammers because replying simply informs the spammer that the email address is legitimate. In order to keep away from these kinds of end-user mistakes, an organization-wide spamming policy informing all the workers what to do and what not to do should be a clever alternative to reflect on.