Re: IMF Problem

"Jim McBee [MVP Exchange]" <jmcbee@xxxxxxxxxxxxxxxxxx> wrote:

>Is your domain something like @getviagraforfree.com or something. :-)
>Sorry, I could not resist.
>
>One thing that the IMF always seems to snag is very small messages (less
>than a single sentence) with a couple of URLs in it.

That's the problem with depending on only statistical filters. When
there's only a little bit of text, the filter is starved for data.
When that happens the likelihood of having "guilty" tokens
outnumbering (and outweighing) "innocent" tokens rises. The filter
then computes the probability of the message's "spammieness" heavily
weighted with "guilty" tokens. The result is the classification of an
otherwise "normal" message as "probably spam".

Microsoft hasn't said how it tokenizes messages, but you can be sure
that it includes stuff in the message headers and message body. I'd
guess that the tokenizer uses multi-word pairs or triplets, too. So
the presense of a pair of words common to spam (or to the spam that MS
has seen -- which may be different to the spam someone else has seen)
in a message can have a disproportionate effect on the outcome of the
probability calculation. This is especialy true when mail contains
text that's unlikely to be seen outside a particulare industry -- or,
in the opposite case, if you're selling mortagages, stocks, financial
information, software, or dealing with medical terms, yur mail is much
more likely to be seen as spam no matter how innocent it might be.

>You might ask the people whose Exchange servers are snagging your mail to
>include you in the Connection Filtering's Exceptions list. This is a pain
>for you to track down all the people that might need to do this, but the IMF
>is in use in quite a few smaller businesses that use Exchange. It is, after
>all, free.

It also has relatively high false-positive numbers when compared to
other such software -- some of which is also free.

--
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx
Or to these, either: mailto:h.pott@xxxxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxxxx
.

Relevant Pages

  • Re: Distribution Group
    ... Do you host your own exchange server or are ... I guess I can change the junk email to 6. ... expired we started receiving all of these spam emails. ... What are your SCL settings for IMF? ...
    (microsoft.public.windows.server.sbs)
  • Re: web email enquiry
    ... we are only using the spam filtering in exchange, ... If your exchange server ... Are you using IMF? ... messages or filing them as spam. ...
    (microsoft.public.windows.server.sbs)
  • Re: Distribution Group
    ... SPAM that has been filtered in case a legitimate email happens to get ... That's when you can whitelist them using IMF. ... We are using only the Intelligent Email Filtering that came with ... We are using Exchange 2003 ...
    (microsoft.public.windows.server.sbs)
  • Re: Simple Exchange config Q
    ... Sinch I switched to it, my spam has gone done by orders of magnitude, even though I was running IMF before. ... Connection filtering using the Spamhaus ZEN blocklist http://www.spamhaus.org/ ... I think the article you're referring to is on this page, which also includes other very useful info relating to Exchange on SBS. ...
    (microsoft.public.windows.server.sbs)
  • Re: IMF Problem
    ... told me it ended up in his junk mail folder I started testing on another ... > outnumbering "innocent" tokens rises. ... > the presense of a pair of words common to spam (or to the spam that MS ... >>is in use in quite a few smaller businesses that use Exchange. ...
    (microsoft.public.exchange.admin)
Loading