ReadMe for

Anti-spam Filter version 1.6

This ReadMe document contains information on the installation and configuration of Anti-spam Filter. It also contains information on issues discovered late in the development cycle, and details on how to work with these issues.

Anti-spam Filter is an integral part of Anti-spam Solution.

Anti-spam Solution consists of:

• MAILsweeper for SMTP
• spamActive datafeed
• Anti-spam Filter software

The MAILsweeper Anti-spam Solution provides high performance anti-spam filtering, resulting in high rates of spam detection and low false positives. It uses a datafeed of 'known spam' (spamActive) to compare new incoming email against known spam profiles and addresses to look for similarities in the message structure and message content. Based on the results of this comparison the software is able to process the email according to the company e-policy in place. For example, it can deliver the emails deemed to be 'clean', quarantine or annotate those that are 'maybe spam' and delete those that are identified as spam.

This ReadMe document for Anti-spam Filter contains the following topics:

Contents

• Known problems in this release
• Installing Anti-spam Filter
• Creating the Anti-spam Filter scenario
• Configuring Anti-spam Filter
• Using the Trainer with Anti-spam Filter
• Downloading current spam data

Other Release Documents

Details of other aspects of this release of Anti-spam Filter are provided in the following release documents:

• New Features for Anti-spam Filter

Known problems in this release

• Uninstalling Anti-spam Filter causes service to fail

Uninstalling Anti-spam Filter does not automatically remove the Anti-spam scenario. If the scenario is still present after uninstalling Anti-spam Filter, the service will fail at start-up. Also, you are unable to delete the scenario after you have uninstalled Anti-spam Filter.

Before uninstalling Anti-spam Filter, remove the Anti-spam scenario using the MAILsweeper console.

If you have already uninstalled Anti-spam Filter without deleting the scenario first, you must:

1. Re-install Anti-spam Filter, following the installation instructions.
2. Start MAILsweeper for SMTP.
3. Delete the Anti-spam scenario.
4. Uninstall Anti-spam Filter.
• Timeout error on low-specification systems

On lower specification systems, starting the Security service with Anti-spam Filter installed will be slower than the Control Manager expects.

If this occurs, a Timeout error will be reported. However, the service does start and you can carry on as normal.

Contents

Installing Anti-spam Filter 

The installation issues for PMM and all other MAILsweeper Business Suite II components are discussed in the document ReadMe for MAILsweeper Business Suite II.

Contents

Creating the Anti-spam Filter scenario

The Anti-spam filter will automatically upgrade existing installations with default settings or create a new scenario for new users.

New scenarios will be created in the Incoming scenarios folder with the name Anti-spam Filter. The default settings for new users are:

• Messages with spam probability over 80% will be classified as SpamDetected16.
• Messages with spam probability between 60% and 80% will be classified as MaybeSpam16.
• The annotation for MaybeSpam16 messages will be [Maybe Spam] and will be applied to the subject line.
• Messages classified as SpamDetected16 will be sent to the quarantine area: Spam Messages for PMM.
• Messages classified as MaybeSpam16 will be annotated and delivered.
• Messages with spam probability below 60% will be delivered as clean.

Contents

Configuring Anti-spam Filter

The default settings after the initial installation of Anti-spam Filter are configured for a general anti-spam policy. This will be ideal for many installations, but may not fully meet the needs of some organisations.

You can configure Anti-spam Filter to represent your company’s anti-spam needs precisely. You do this by opening the anti-spam filter scenario properties dialog and changing the properties set in the configuration.

• Thresholds define the probabilities to be used when determining the classification.
• classifications act on the probability resulting from processing by the Anti-spam Filter.

Contents

Using the Trainer with Anti-spam Filter

The Anti-spam Filter is highly optimised and therefore it is vital that you use the Trainer software to fine tune you system.

This utility re-tunes your system by analysing business messages you have collected, and using the common parameters found in these messages to reconfigure the parameters for detecting business messages.

By doing this, the Anti-spam Filter becomes more efficient at detecting clean messages. This significantly reduces the number of false positive detections. False positives are messages declared to be spam when in fact they are clean business messages.

Further information on how to use the Anti-spam Filter Trainer application is given in the Supplemental Reference, which you can access from the product CD-ROM.

Note:

ASFTrainer generates an optimised AsfDT16.xml decision tree configuration file as well as a new business message data file NsAsf15.txt. These are used to re-tune the Anti-spam Filter to increase spam detection and decrease false positives.

Contents

Downloading current spam data

The MAILsweeper Anti-spam Solution provides high performance anti-spam filtering, resulting in high rates of spam detection and low false positives. It uses a datafeed of 'known spam' (spamActive) to compare new incoming email against known spam profiles and addresses to look for similarities in the message structure and message content.

It is important that you regularly update your spamActive datafeed information from the Clearswift website. Instructions for doing this can be found in the Supplemental Reference, which you can access from the product CD-ROM.

Contents

Revision 1.4 April 2004
Published by Clearswift Ltd. April 2004
© 2004 Clearswift Ltd
All rights reserved

The materials contained herein are the sole property of Clearswift Ltd. No part of this publication may be reproduced or disseminated or transmitted in any form or by any means electronic, mechanical, photocopying, recording, or otherwise stored in any retrievable system or otherwise used in any manner whatsoever without the express permission of Clearswift Ltd.

Information in this document contains references to fictional persons, companies, products and events for illustrative purposes. Any similarities to real persons, companies, products and events is coincidental and Clearswift shall not be liable for any loss suffered as a result of such similarity.

The Clearswift Logo and Clearswift product names including MIMEsweeper^TM, MAILsweeper^TM, e-Sweeper^TM, IMAGEmanager^TM, REMOTEmanager^TM, SECRETsweeper^TM, ES^TM, ENTERPRISEsuite^TM, ClearPoint^TM PMI, ClearSecure^TM, ClearEdge^TM, ClearBase^TM, ClearSurf^TM, DeepSecure^TM, Bastion II^TM, X.400 Filter^TM, FlashPoint^TM, ClearDetect^TM, ClearSupport^TM, ClearLearning^TM are trademarks of Clearswift Ltd.

All other trademarks are the property of their respective owners.

Clearswift Ltd. (registered number 3367495) is registered in Britain with registered offices at 1310 Waterside, Arlington Business Park, Theale, Reading, Berkshire RG7 4SA, England. Users should ensure that they comply with all national legislation regarding the export, import, and use of cryptography.

Contents