Spam Flavor of the Week

At SpamButcher we've always done periodic updates to the spam filter software based on messages collected both internally and by users. Historically we've created rules based on large, long-term trends. This is based on the theory that going after spam, "flavors of the week" would result in a bloated filter, and not block junk email much more effectively.

The last year or so has seen spammers shifting tactics more frequently. Also, a relatively small number of campaigns have been responsible for a large portion of spam slipping into inboxes.

As a result, we've been targeting individual spam campaigns more than in the past. The results have been promising. It's definitely helped snag another percent or two of the email that was getting past. That might not sound like much, but going from say 97% effectiveness to 98.5% cuts in half how much junk users really receive.

Nailing individual spam campaigns can be somewhat labor intensive. After a few dozen messages are collected, a given campaign might be considered "hot" enough to go after specifically. The messages are analyzed by a real live human being for patterns. Possible filter updates are tested to see if they would block the messages in question. The rules are also tested against non-spam messages to verify they won't cause false-positives.

This kind of hand tuning is more tedious that relying on machine learning, but in the end results in filter rules that can stop spam mail a computer working alone wouldn't be able to figure out. At least that's the story we're sticking with.

What is frustrating is that sometimes the targeted campaigns go away on their own accord before the code adjustments benefit users. Often a minor update will target about a half-dozen different campaigns, but only two to four of the campaigns will still be running by the time the patch is released. Our internal metrics still suggest these minor upgrades are big wins for users.

Back