Attacking Spam One Campaign at a Time

It's not practical to attack each separate identifiable campaign launched by spammers. Sometimes the campaigns only consist of a few similar emails; then vanish as quickly as they appeared. Other times the messages are so randomized, that while they appear similar to a human, no way to educate a machine regarding the patterns is apparent. Even then, selected data can still be added to the program in an effort to catch similar messages in the future.

If it's evident that a spam campaign has been spanning several months, or even years, it makes a lot of sense to spend time targeting it. Examples would include, "Nigerian scam spam" and stock promotion spam. While the campaigns aren't always directly tied to each other, they are very similar. Common patterns appearing across dozens of emails can be compiled and added to spam stoppers. Even if every message isn't caught, the updated filters can still benefit users.

More recent examples have included image-based spam. The entire message content is embedded within an attached image, with little other data. This gives any filtering system fairly little content to process. However, the lack of content and the presence of an image can be a strong indicator in itself.

More problematic is ASCII-image based spam. The sender assembles various text characters into an image of a word - communicating the intended message to the recipient. One possible approach is to evaluate the presence of large amounts of text, but the lack of correctly spelled words.

In the long run, this approach could be circumvented by using entire words to compose the image. Some senders also use very small fonts to effectively get a high image resolution. Font and other HTML tags can sometimes be used as hints to spam blockers, indicating if a message might be spam.

Back to Articles