|
Our approach to image spam combines two gears
of the Mailshell engine: SpamTricks and SpamRepute.
SpamTricks:
Mailshell's engine looks for image attributes that are unlikely
to exist in legitimate email. These include, but are not
limited to:
- Jigsaw puzzle-style images.
- CAPTCHA-style images that intentionally obscure content.
- Images designed to emulate plain text.
Though the presence of these techniques does
not guarantee that the message is spam, Mailshell's scoring
algorithms can penalize these messages to ensure consistently
high accuracy.
SpamRepute:
Mailshell's image analysis is a subset of our approach to
quantifying the reputation of each attribute of each message.
- Mailshell treats images—and parts of images—as
attributes that can be extracted and tracked over large
numbers of messages.
- Mailshell defines reputation of an attribute as the
difference between the number of spam versus the number
of legit messages for that attribute.
- For example, the reputation of an IP address is the
difference between the number of spam messages sent from
that IP address versus the number of legit messages sent
from that IP address.
- Similarly, the reputation of an image is the number
of spam containing that image or, usually, parts of that
image versus the number of legit that includes similar
attributes.
|
|
