The ISP I use switched on Brightmail at the beginning of th isyear.I
have never used a munged address. I have used a real address for about
ten years and so I was on every spam list. My incoming spam ran into
hundreds every day. I had to manage it myself with filters and anti
spam applications but the introduction of Brightmail immediately got
rid of about 90% of the spam and now it is only letting 2 or 3 a day
get through to me. I no longer need any anti spam applications. I
still have lots of the old filters but they rarely need to do
anything.
Steve
Steve:
The following link to a PDF by Brightmail, provides techinical details on
how there anti-spam works:
Symantec Brightmail AntiSpamT 6.0: A Product Overview
http://enterprisesecurity.symantec.com/content/displaypdf.cfm?pdfid=1023
Since I use SpamPal as my client side spam filter which uses either DNSBLs
(public blacklists), I find the private sector Brightmail technique to be
quite interesting. This is what Brightmail says:
A prime responsibility of the BLOC is management of the Probe Network, an
extensive array of over
2 million decoy email addresses, also known as spamtraps or honeypots. This
patented global network of
email accounts attracts and collects large quantities of spam-tens of
millions of spam messages pass
through the Probe Network every day. Symantec uses these decoys to stay
current with the very latest
spamming tactics.
Messages flow directly from the Probe Network to the BLOC for analysis.
Then, sophisticated tools
and automated processes go into action, analyzing incoming spam and
developing effective countermeasures.
The BLOC also develops and tunes other more proactive filters, such as
heuristic-based filters.
Such filters, which examine characteristics and behaviors that are unique to
spam messages, are
effective against spam that has not flowed into the Probe Network.
Approximately every 10 minutes,
antispam filters are pulled down over a secure connection to the Scanners,
where the filters are immediately
put into action.
The Symantec Brightmail AntiSpam architecture represents a constant feedback
loop, starting and
ending with your site:
1. The installed Scanner executes filters based on
real-time information from the Probe Network and
the BLOC.
2. The Scanner constantly reports back to the BLOC
regarding the effectiveness of deployed filters.
If necessary, adjustments are made in real time to
improve effectiveness.
3. Using their email clients, users at your site can choose
to easily submit missed spam messages to Symantec,
increasing the breadth and reach of the Probe
Network with the click of a button.
Interesting, huh?
Steve
