Killing the Corporate Hydra: Spam E-Mail

Methods of Detection: The Power of Five

Utilizing its underlying rule-set process, McAfee
SpamKiller simultaneously checks each e-mail message
that is received by using five different methods of
detection:

• Integrity analysis: SpamKiller examines the header,
layout, and organization of each e-mail message to
identify the common characteristics of spam. An
advanced pattern-matching engine simultaneously
applies thousands of algorithms during a single
pass. The results determine a probability rating and
the e-mail is then classified spam or not.

• Heuristic Detection: Within its score-based
framework, the SpamKiller engine employs a
number of heuristic methods of detection to
identify e-mail as probable spam. Heuristic
detection uses a series of internal tests to
determine the likelihood that as message might be
spam and each test carries a point value to reduce
false positives. These methods can include: header
analysis, body analysis, and the presence of
structural tricks employed by spammers to disguise
the content of the message. The SpamAssassin
engine handles the mechanics of this, so fewer rules
need to be created.

• Content Filtering: The content filtering functionality
within SpamKiller can be used to help identify key
words or phrases that appear in an e-mail to
indicate the message is spam. The administrator or
user (depending on whether server or client-based
software is being used) can add words or phrases to
a database such as “XXX,” “free,” “cheap
mortgages,” etc. This functionality complements,
and is in addition to, the rule set supplied with
SpamKiller products.

• Blacklists and Whitelists: SpamKiller supports
blacklists (commercial lists of domains know to send
spam) and whitelists (organization-specific lists of

Page 1 2 3 4 5 6 8 9 10 11 12

Download the entire article in PDF