Why Does Filtering Work?

One of the most important aspects of my, "job" is keeping SpamButcher's filter in top shape. Despite the advantages of using fuzzy logic, the performance of the filter does degrade over time, and needs to be updated as spammers shift their tactics.

Still, even when a new campaign using the latest tricks attacks, SpamButcher's effectiveness rarely drops below 96%. That is to say, 96% of spam at any time is fairly easy to catch. I would imagine competing products may catch less, but still the large majority of spam seems easy to block.

So, why aren't all spammers adopting the tricks being used by the more aggressive 4%? If 80% of spam was as randomized as the trickier 4%, efforts to block spammers would be much, much less effective and a larger portion of spam would be delivered.

For one, the most effective tricks used by spammers tend to render messages virtually unreadable. It may be that the decrease in deliverability is offset by sending messages that users can in fact read and understand, even if it means the majority of the messages are intercepted.

Another factor is that many users live without significant message filtering. Their ISP may block some of the most obvious spam, but let most questionable messages slip by. On the other hand, I've seen "conservative" email filtering systems blocking mail at a rate of about 10% in an apparently random method. Either way, these users get most of the unwanted email sent to them. It's unclear what percentage of all users they make up, but it is likely substantial.

The existence of these users let spammers continue to send out "typical" spam which is blocked for users who using spam fighters. If all users adopted filtering systems, two things would likely happen. The amount of spam would likely decrease as deliverability went down. Also, the spam that was sent would more likely employ techniques to sneak past filters. In a way, the users who haven't deployed spam blockers are doing those with spam blockers a favor. They are in effect, "taking one for the team" by keeping spammers focused on them.

Back