KnowledgeBase Articles » Content Filtering

Thursday, November 29, 2012, 12:35

Content Filtering

Category: Filtering

Solution ID: 00000203

Summary:

Does PerfectMail have any way for me to block specific words and phrases?

Answer:

Use Content Filtering (Filters > Content) to identify messages containing content and language that is not acceptable to your organization. When adding entries to this table, please take some time to consider the various instances.

The content of each message is checked for the listed words and phrases. The word list is case-insensitive. Your words will be automatically converted to the simplest version our filter can handle, including character case conversion and stripping/converting of any characters that cannot be understood by the filter.

Two lists are implemented on your server: a system word list maintained by our staff and a local word list that can be maintained by your local e-mail support staff.

Scoring for specific phrases is generally different for the e-mail subject and other headers than it is for the e-mail body. Words and phrases that may be high indicators of spam when contained in the subject may be used frequently in legitimate e-mail bodies. It is important to use caution when managing content filtering.

Try to avoid very simple words that may appear in messages or in HTML constructs contained in e-mail; for example a word such as "aaaa" would be a very bad word choice.

Bonus Scoring

You can give negative values to words and phrases to drive down the score of known good content. If your business uses terms and phrases that are unlikely to appear in spam messages, add them here with negative scores to mark known good content.

Anti-Obfuscation

Anti-Obfuscation is a technique that identifies attempts to disguise words. For example:
Anti-Obfuscation maps \/ 1 @ g r @ to Viagra, ><@n@x to Xanax, etc. The word score is scaled to match the measure of obfuscation. This technique is very successful, but it can sometimes give erroneous results if the listed word is similar to other non-offensive words; so use this with care.

Suffix Matching

Suffix Matching is a technique that attempts to match a root word to variations of that word by suffix. For example, applying Suffix Matching to the word "run" will match variations "runs", "runned", "running", etc.

If the Suffix Matching option is applied to a phrase, then Suffix Matching will only apply to the last word in the phrase.

A Warning on Anti-Obfuscation

Understand the impact of Anti-Obfuscation and Suffix Matching when matching phrases in the content filters. These techniques try and match words and phrases by matching possible variations that may be used to try and avoid detection.

This may become a problem when you are trying catch a specific phrase. For example, if you try and match the word "C A S I N O" when looking for spam and have Anti-Obfuscation turned on it will also match "casino", which may result in inappropriate scoring. This may become more problematic when both Anti-Obfuscation and Suffix Matching are used.

Anti-Obfuscation and Suffix Matching are powerful tools that also require some consideration.

Updating the Content Filters

The fields for each word/phrase are in two groups for the Subject and other headers and the message body.

• Enable - Enable scoring for this word.
  
  
• Score - For each instance of this word score this amount.
  
  
• Rjct - If this word is found reject the message. (Score=99)
  
  
• Suf - Enable the Variable Suffix Engine. This engine matches against variations of word suffixes. For example, if you wanted to score the word jump the Variable Suffix engine would also catch: jumps, jumping, jumped, jumpy, jumper, etc.
  
  
• Obf - Enable the Anti-Obfuscation Engine for matching structural word variations. Spammers will attempt to change the structure of words so they are still readable by people, but difficult to recognize by machines. Depending on the amount of obfuscation found, the score of the found word will increase by the obfuscation factor. Our Anti-Obfuscation Engine is very good at catching and scoring for such attempts. However, this feature should be used with caution.

Tags: perfectmail, antispam, e-mail, content, filter, identify, obfuscation, words, phrases, suffix, features

Link to this article: https://perfectmail.com/kb/content_filtering

Updated: Thursday, November 29, 2012, 12:35

-- David Rutherford