Kaspersky Lab kaspersky mail gateway 5.5 Mode D'Emploi
The principles of program operation
37
The purpose of spam filtering is to decrease the volume of unwanted
messages in the mailboxes of your users. It is impossible to guarantee
detection of all spam messages because too strict criteria would
inevitably cause filtering of some normal messages as well.
messages in the mailboxes of your users. It is impossible to guarantee
detection of all spam messages because too strict criteria would
inevitably cause filtering of some normal messages as well.
The application uses two main methods to detect messages with suspicious
content:
content:
• comparison with sample messages (by matching their lexicons)
• detection of typical terms, i.e. words and word combinations.
• detection of typical terms, i.e. words and word combinations.
All the data employed by the Spamtest for content filtering: hierarchical list of
categories, typical terms, etc. are stored in the content filtration databases.
categories, typical terms, etc. are stored in the content filtration databases.
Our linguistic laboratory constantly works to supplement and improve
the content filtration databases. Therefore, you are advised to update
the databases regularly (see section 5.1 on p. 40).
the content filtration databases. Therefore, you are advised to update
the databases regularly (see section 5.1 on p. 40).
A message may be referred to one or several classification categories of the
content filtration database according to the results of content analysis.
content filtration database according to the results of content analysis.
Preservation of all useful mail must be the top priority for the system
administrator because the loss of a single important message may
cause more trouble for the end user than receipt of a dozen of spam
messages. To avoid the loss of necessary mail, you are advised to use
only non-destructive actions with mail identified after content analysis
as spam or probable spam. E.g.:
administrator because the loss of a single important message may
cause more trouble for the end user than receipt of a dozen of spam
messages. To avoid the loss of necessary mail, you are advised to use
only non-destructive actions with mail identified after content analysis
as spam or probable spam. E.g.:
•
append labels to the Subject header, such as [!! SPAM] or [??
Probable Spam];
Probable Spam];
•
append an additional Keywords=... header, which would allow the
users to transfer such messages to special folders using their own
mail user agents (MUA).
users to transfer such messages to special folders using their own
mail user agents (MUA).
4.3.3. Spamtest filter actions
Actions performed over a message processed by the Spamtest filter is
determined by the ActionSpam option in the [smtpgw.policy] (or
[smtpgw.group:group_name]) section of the application configuration file. The
action result depends on the status assigned to that message during analysis.
Please see section 4.2 on p. 32 for a description of statuses assigned by the
Spamtest filter to messages.
If ActionSpam=subject has been specified as the action in the configuration file:
determined by the ActionSpam option in the [smtpgw.policy] (or
[smtpgw.group:group_name]) section of the application configuration file. The
action result depends on the status assigned to that message during analysis.
Please see section 4.2 on p. 32 for a description of statuses assigned by the
Spamtest filter to messages.
If ActionSpam=subject has been specified as the action in the configuration file:
• Messages with the Spam status will be marked with the [!! SPAM] label
added to the Subject header.