Spam Filtering

April 29, 2020 by

Greg Belding

Introduction

Anyone who has had email is well familiar with the often sloppy, bungling menace that is spam. You know that that Nigerian prince that keeps telling you he found money with your name on it? Or that email from an unknown source with an unknown attachment? Yes, those are examples of annoying (and sometimes funny) spam emails. Spam filtering helps email users steer clear of these at-the-least unwanted annoyances and at-the-most serious threats by using different measures to filter them from your email inbox. 

This article will detail what spam filtering is, including the different types of spam filtering and how they work. Understanding the modern email threat landscape would be difficult without first understanding spam filtering.

Learn Cybersecurity Data Science

Build your skills using machine learning and other cutting-edge tools to perform various cybersecurity tasks.

Start Learning

Spam

No, spam is not referring to the canned meat that helped feed Hawaii during the Second World War. Rather, this well-known email-based annoyance refers to unsolicited messages. It should be noted that while different types of messages can qualify as spam, this article will focus on spam emails.

Spam filtering

But let’s add a bit of perspective to this. 

There are approximately 269 billion email messages sent daily, and nearly half of all of these messages are spam. Spam is a multi-billion-dollar global money-making scam and can be a threat to users, systems and information. This is not a new problem.

The solution to avoid most of this spam is known as spam filtering.

What is spam filtering?

Spam filtering refers to the practice of detecting unwanted, unsolicited and malware-infested emails and stopping these emails from reaching user email inboxes. Internet Service Providers (ISPs) and email normally implement spam filtering, and third-party providers offer their spam filtering services online.

How does spam filtering work?

There are different types of spam filtering in use today and they all work slightly differently. Despite these differences, all spam filtering features function as a sort of firewall for emails. 

No, spam filters are not security hardware devices, but they use rules similar to a firewall’s Access Control List (ACL). ACLs apply rules to inbound network traffic and if communication matches a rule on the ACL, it is denied. Spam filtering uses heuristic analysis to deny email messages from reaching unsuspecting inboxes.

What are heuristics?

This method of information analysis and processing refers to subjecting email messages to predefined rules, or algorithms. These rules assign a numerical probability score to messages about the likelihood of messages being spam or not. If these messages earn a score that surpasses a certain score threshold, the email message is then flagged as spam and will end up in your spam or junk mail folder.

Different types of spam filters

Spam filtering solutions use different sets of protocols which leads to different types of spam filters. The most commonly used include:

• General blacklist spam filters: This type of filter stops all email messages coming from a list of known spammers
• Rules-based spam filters: While all spam filters use rules to filter spam from legitimate email messages, this type is referring to user-defined criteria rules. Users who enjoy configuring their own services will find this type to be the most compatible filter type with their view on configuration customization
• Content filters: This type reviews email message contents and scans for common words that spam emails tend to use
• Header filters: Header filters scan the source of the email header in search of suspicious information. This can come in the form of spammer email addresses or other suspicious information that tends to be in spam emails
• Challenge-response filters: This type requires senders to enter a code to gain permission to send their message
• Permission filters: Permission filters require email senders to be pre-approved by the email recipient
• Gateway filters: This type is a physical server at the border of an organization's network that acts as a first line of spam defense. Whether your organization uses one or not depends on its business need
• Desktop filters: This type of highly customizable filter resides on a user’s computer and is a favorite among customization fanatics
• Third-party filters: This type is offered by a third party and varies widely in terms of capability, functionality, ease of use and cost

Conclusion

Spam filtering isn’t perfect. An important email occasionally ends up in the spam folder, but filtering continues to significantly minimize the receipt of annoying and possibly damaging email. As long as there is email, there will be spam, but there will also be spam filtering. 

Learn Cybersecurity Data Science

Build your skills using machine learning and other cutting-edge tools to perform various cybersecurity tasks.

Start Learning

Sources

1. How Do Email Spam Filters Work?, Lieberman Technologies
2. ULTIMATE GUIDE TO DELIVERABILITY: HOW SPAM FILTERS WORK, Return Path
3. What is Spam Filtering?, MailChannels
4. Spam Filter, Techopedia