The Intelligent Message Filter as an Additional Filtering Layer

Alexander Zammit

Software Development Consultant. Involved in the development of various Enterprise software solutions. Today focused on Blockchain and DLT technologies.

What are the benefits of having multiple products doing the same job?

Having filters doing the "same" job is useful if these base their classification process on different technologies and/or information. A filter analyzing the SMTP Protocol command data is very different from a filter analyzing the email body content. Here both the filtering technology and the information analyzed are different.

Filters applying different technologies to the same information may also be complementary and appropriate for layering. Consider a signature based filter and a self-learning filter. It is true that spammers try all kind of tricks to give their emails a legitimate look. Nevertheless a large proportion of spam exhibits common patterns where signature based filters are very effective. Self-learning filters employ a very different process. This enables them to be more adaptable to the individual characteristics of organizations.

IMF is based on the SmartScreen technology. This is proprietary and little information is available on its internals. The spam delivered to hotmail mailboxes is used to construct its filtering intelligence. Thus we can say that IMF primarily operates on the email content information. This makes it an excellent candidate for layering in combination with filters operating on SMTP protocol command data.

Layering IMF with other content based filters introduces some overlap. Since there is little information on the IMF internals, classifying the extent in technology overlap is not possible. Thus here the effectiveness of the filtering combination is best determined through testing.

Can IMF coexist with other anti-spam solutions?

The short answer here should be yes. IMF does not break other filters and I am unaware of other filters breaking IMF. If you run into one such filter, you should certainly question its quality.

Of course basic coexistence is of little value in itself. As already discussed we need a set of complimentary filters. Filters should be complimentary in terms of technology, but ideally also in terms of administration and end-user experience.

How complex is it to manage the different filtering products? Will the end-user experience be consistent?

The basic IMF configuration is certainly not complex. Indeed its lack of configurability is often considered to be one of its biggest limitations. Nevertheless products like IMF Tune overcame this aspect transforming IMF into a feature rich product.

Here we should look beyond the basic IMF configuration. Other more important manageability factors include reporting, archiving and Junk Email repositories. Lack of consistency in these areas can be a true hurdle to adopting multiple filtering layers from different vendors.

Exchange 2003 laid the foundation for consistent spam filtering. It standardized the Junk E-mail functionality and provided client side Safe Senders/Recipient lists. This takes us a long way in achieving a consistent end-user experience. With a standard Junk Email repository users may remain happily unaware of the day-to-day battle taking place at the servers.

Anti-spam filters claiming to be Exchange integrated should today be supporting the Junk Email folder. As for other filters lacking Exchange integration, hope is not lost. Indeed with a little help these may also be transformed into first class Exchange citizens. I covered this subject in Integrating any Anti-Spam Filter into Exchange.

This covers the end-user experience fairly well. As for the administrative side, there is certainly less consistency. The IMF configuration is available from the Exchange System Manager and the performance monitor provides its monitoring interface. Other products have their own interfaces and reporting tools.

Indeed some more consistency in this area would be welcomed. But achieving consistency from competing parties is clearly not that simple. You will probably have to accept a little more administrative overhead. Nevertheless I am sure the results obtained from the hardened spam filtering setup will completely out weigh this aspect.