Re: [Asrg] "Uncaught spam" research project

[Martijn Grooten <[e-mail]>]

Aaron Wolfe wrote:
> In my experience, you will find more variation in performance between
> a properly configured / maintained spam filter and a system left at
> defaults and forgotten about than you will find between different
> vendors.  Filters will use a variety of tactics to detect spam but
> most are common and unless a vendor has implemented them incorrectly
> they should perform identically.  For instance RBLs, smtp syntax
> checks, dns checks, IP connection characteristics are all going to be
> common. There is variation in how the results of these things are
> used, but this is often configurable and needs to be tweaked for a
> particular type of site for best performance anyway.
>
> Are you planning to compare these systems in their default
> configurations?  If so your results may be more an indicator of which
> vendor's defaults work best for your system than anything else.

The setup is part of a comparative anti-spam test I'm running and products have been set up by their developers to run ideally in that context. I've been running these tests for some time and before I started running them I was a bit worried that all products would catch the same spam. However, while products easily catch 98% of (spam trap) spam, it's not the always same spam that is caught: 10-15% of spam is missed by at least one filter; barely no message isn't blocked by at least one filter. This is one of my motivations for wanting to do this project.

Martijn.


Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.