Kaspersky Anti-Spam Enterprise / ISP Edition

Developer: Kaspersky Lab (www.kaspersky.ru)

Spam is a lot of trouble for home users, but for enterprises this problem is even more acute, as the number of mailboxes available in the company corresponds to the number of employees. However, email and Internet service providers, who have hundreds and thousands of mailboxes and provide access to them to their customers, suffer most from spam.

Kaspersky Anti-Spam Enterprise / ISP Edition is positioned as a tool to solve spam problems across the enterprise and Internet service provider. The program recognizes and filters unwanted e-mail messages while receiving e-mail using the SMTP protocol (the protocol used to forward e-mail between servers), i.e. before messages are delivered to the recipient's mailbox.

 

 

Fig. 14.6. Kaspersky Anti-Spam Enterprise / ISP Edition - spam protection for enterprises and providers

 

The program implements a multi-level system of analysis of incoming correspondence.

The letter is analyzed according to formal signs: the email address of the sender and recipient, the IP address of the sender, the size and format of the message, etc.

The analysis of the distribution in the text of the letter of words or phrases characteristic of spam is carried out.

The content of the letter is also checked by the SpamTest intellectual linguistic core, which performs pattern recognition of letters. For each letter classified as spam, a lexical signature (template) is automatically created, which in the future allows you to recognize this message, even if it differs slightly from the template.

The program uses third-party blacklists (RBL ² ) - a standard means of filtering letters by addresses recognized by spam sources and listed in constantly updated public lists, as well as black and white lists of addresses created directly by the product administrator.

Kaspersky Anti-Spam allows you to check not only the text of the message itself, but also its attachments, including attached files in HTML, Microsoft Word and TXT formats. To work with letters in different languages, the program uses built-in linguistic support modules for Russian, English, German, French and Spanish.

It should be noted that, as in the case of anti-virus products, the effectiveness of spam filtering depends on the volume and frequency of replenishment of the linguistic database. The database is updated every two hours, in addition, the administrator can add his own spam email templates to it.

Kaspersky Anti-Spam allows you to detect spam-related messages that are not recognized by standard filtering methods. For example, the program is able to recognize tricks such as doubling letters, replacing individual letters with Latin letters, inserting spaces and dots in words, etc., and also allows you to detect so-called HTML tricks (invisible text, underlay text, font of various sizes etc.). The product supports the mode of working with special graphic signatures, with the help of which it is possible to analyze the images contained in mail messages even if spamming includes images containing slight differences. The operation scheme of Kaspersky Anti-Spam is shown in Fig. 14.7.

 

 

 

Fig. 14.7. Kaspersky Anti-Spam application workflow

 

As a result of the verification, each incoming letter receives a special “label” corresponding to a certain level of its “purity” and semantic content. Further, in accordance with the processing rules and user settings of the system, the message can be delivered to its destination, deleted or redirected to another address.

Anti- Spam Filter " Spam Defense "

Developer: Yandex (www.yandex.ru)

We give the anti-spam filter " Spamooborona " in corporate decisions, but it should be noted that it can be implemented in the form of various solutions - for companies, for postal service users " Yandex ", and as a free public service (for all users) (Fig. 14.8).

 

 

Fig. 14.8. Options for using the anti-spam filter " Spamooborona "

 

" Spam defense " for companies

" Spamooborona " for companies - is a corporate software product, which is based on algorithmic and linguistic development, used in the search engine " Yandex ".

The application is installed on the mail server, after which all messages identified by this program as spam will have a corresponding header. On this basis, letters can be easily sorted - for example, put spam in a separate folder.

The system performs a comprehensive analysis of all possible data about the letter, analyzing thousands of its characteristics. Each rule has a specific weighting factor; for the decision “spam - not spam” the weights of the triggered rules are summed up. If the total score exceeds a predetermined threshold, the system considers the message as spam. This approach makes the product very stable: a decision is made only on the basis of a multitude of features. Moreover, new types of spam are successfully determined by a large set of existing rules.

" Spam defense " is constantly being trained, i.e. the knowledge base on the basis of which decisions are made is regularly updated. Data on new types of spam, mass mailings and the sources of their distribution is automatically supplied by the service " Yandex it dry ochta ".

The solution has the following features:

• over 90% of spam is stably detected;

• the probability of a false positive is about 10 ^-5 ;

• accounting of personal information allows you to minimize the number of filter errors;

• the decision "spam - not spam" is made on the basis of a comprehensive assessment of several thousand parameters of the letter, taking into account their significance, which makes the filter resistant to new types of spam;

• Knowledge base " Spamooborony " kept up to date automatically by the system updates the data for which are supplied by the service " Yandex it dry ochta " around the clock;

• Both foreign and Russian-language spam are effectively identified.

" Spamooborona " users " Yandex "

If your mailbox is located on Yandex, then all incoming mail is automatically checked for spam and viruses.

On " Yandex it dry ochte " letters are three filtering levels.

At the first stage, explicit spam is discarded - messages coming from unmanaged (hacked, open) mail servers. It is important that rejected letters do not disappear without a trace, the sender's mail server receives a receipt indicating the reason for the denial of access. The server administrator can contact Yandex and discuss the problem.

Then each letter is checked antivirus program Dr. Web (www.drweb.ru). At the same time, infected messages containing nothing but the virus itself are discarded, and infected messages with the text are marked "Scan for viruses."

The last filter that works is that puts suspiciously similar letters in the Mailing + Spam folder sent to too many addresses, as well as letters in which the Spam Defense program has detected signs of spam.

" Yandex it dry ochta " filters not only incoming, but also outgoing correspondence. Mass mailings and letters with viruses are blocked.

Spam defense for everyone

If you do not use the mailbox to " Yandex it dry ochte " and you do not have a corporate email server " Spamooborona ", you can set up a through check all your mail through a free public service " Spamooborony ".

Each user of the service receives a "special" mailing address: [e-mail]. All correspondence must be forwarded to this address from the "official" address. After checking for spam and viruses, all mail will be forwarded to your "secret" address. More detailed information can be obtained at http://so.yandex.ru/all/index.xml

 

Proventia mail filter

Developer: Internet Security Systems (ISS) (www.iss.net).

Proventia Mail Filter is a corporate anti-spam and email filtering tool that improves employee productivity, frees up network resources, protects confidential information and protects the company's reputation.

Proventia Mail Filter analyzes incoming and outgoing mail to protect against spam and corporate information leakage. In addition to spam, the program blocks viruses, pornography and MP3 files.

Intelligent analysis tools in Proventia Mail Filter combine with a database of more than 200 thousand of the most common examples of spam. The product does not allow blocking of necessary letters through the use of a 10-step analysis of the letter, including comparing messages with the spam database and comparing URLs in e-mail messages with the addresses of web sites listed in the database.

The program constantly updates the database from which updates are sent to end users four times a day to provide real-time protection.

Proventia Mail Filter analyzes outgoing e-mail messages and blocks messages with inappropriate content, while maintaining intellectual property and confidential documents. The program analyzes the message text, images and attached documents, regardless of format. In addition, it allows you to create special mail policies, set rules for incoming and outgoing e-mail.

Automatic document scanning prevents fragments of confidential information, financial reports and contracts from leaking. The program recognizes more than 80 different file types and checks for hyperlinks, so that unwanted e-mail content such as job offers, horoscopes and greeting cards will be blocked.