Chapter 7: Spam Filters: Detection and Evasion

---

Introduction

This chapter explains how to block spam and the tricks used to detect and stop spam in its tracks. It then covers some of the techniques used to bypass spam filters. However, before you can learn the tricks behind evasion, you must understand how spam filters work from the mindset of the developers to the fundamentals of statistical analysis and complex algorithm processing. Spam analysis is becoming increasingly complex because spam is becoming smarter and people need to rely on their legitimate e-mails not being accidentally dropped by spam filters. There has been some serious thought and work put in by both programmers and statisticians in the war against spam.

In the beginning, spam filters were very simple. The pinnacle of filter intelligence involved checking to see if the e-mail contained a bad (or flagged) word; if so, it was obviously spam. Simple blanket rules were applied to all e-mail, which meant if you sent an e-mail and mentioned “Buy Viagra Now” in the body, the chances were your e-mail was classified as spam and deleted. Many of these blanket rules are still applied today, but newer spam filters are increasingly intelligent and produce fewer false positives, mostly from the use of complex statistical algorithms that analyze the spam and can ensure it is spam.

Notes form the Underground…

Effects of Spam

It is a strange phenomenon that certain words can produce such a prolific effect when used in e-mail. Today, if you change your e-mail signature line to something like “Buy Viagra Now,” chances are that at least 80 percent of your outgoing e-mails will be blocked and discarded as spam.

Think about it for a second: that phrase will now cause any message you send to raise a red flag and be deleted on arrival. Spam has such an impact on our lives that it can change our own language habits. Pfizer (the maker of Viagra) can never use the slogan “Buy Viagra Now!” as a company e-mail signature, because that phrase has been blacklisted globally.

---