How to use the ISS filtering service to remove unwanted messages with Webmail

Transcription

1 INFORMATION SYSTEMS SERVICES How to use the ISS filtering service to remove unwanted messages with Webmail AUTHOR: ISS Version: 1.1 Date: October 2005 HOW 25 25p UNIVERSITY OF LEEDS 1

2 Contents Introduction 1 ISS filter system 1 Spam tagging format 2 General advice on using the filtering service 2 Using the filtering service with WebMail 3 Frequently asked questions and potential problems 6 Feedback If you notice any mistakes in this document please contact the Information Officer. should be sent to the address info-officer@leeds.ac.uk Copyright This document is copyright University of Leeds. Permission to use material in this document should be obtained from the Information Officer ( should be sent to the address info-officer@leeds.ac.uk) Print Record This document was printed on 6-Dec-06.

3 Introduction This document introduces a spam filtering service to users. It first describes the format of the service, then gives advice on using the service in general. A detailed guide to using the service with WebMail follows. Finally, a number of potential problems are discussed. Before starting the formal part of this document, it is useful to give users a warning and an assurance. spam filtering is a complex subject. The system used for spam filtering is necessarily complex too but we do not wish to put people off unduly. However, even it runs on a complex computer system, and it is only a computer system after all. It will identify spam correctly most of the time. But it will sometimes identify messages wrongly. The advice for users is therefore to use the service conservatively. We shall show you how later in the document. The assurance here is that even though the system is complex, users do not need to know all about it in order to use it effectively. Fortunately, you only need to know about 10% of the filtering service to make use of 90% of its functionality. Let s start with a relaxed journey on learning filtering. ISS filter system The ISS filtering system consists of two servers running the filtering software PerlMX. It covers all messages addressed to someone@leeds.ac.uk and those messages relayed through the core servers. It does two jobs, scanning for viruses and spam message tagging. If a message is found with a known virus, the message is quarantined and a notification message sent to the recipient. (We shall not be discussing the virus filter any further in this document.) For any other messages the system puts them into a complex filtering process to grade the messages with probabilities of being spam. The result of the grading is then written as a tag to the message header. The message is then passed on to the recipient. The filtering system does not remove any messages even if they are identified as spam. However, you can decide to automatically delete or move messages identified by the filtering system. 1

4 Spam tagging format An message usually consists of a message header part, a message body part and attachments if any. The spam tag is written as a header for the message. It consists of a label or name of the header and information about the message content. Here is an example of the tag: X-Perlmx-Spam: Gauge=XXXXXXXXXIIIIIII, Probability=97%, Report="BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML, EXCUSE_15, FOR_JUST_SOME_AMT, FREQ_SPAM_PHRASE, FRONTPAGE, NO_REAL_NAME, PLING, RCVD_IN_BL_SPAMCOP_NET, SPAM_PHRASES_020, WE_HONOR_ALL" The label for the header is X-Perlmx-Spam followed by :. The first part of the tag is called Gauge and its value is XXXXXXXXXIIIIIII represented in roman numerals X s and I s. Each X stands for 10% value and each I stands for 1%. In the example above XXXXXXXXXIIIIIII = 97%. The Gauge tag is very useful to the filtering rules in a user s program such as Outlook. The second part of the tag is the Probability and the value in this example is 97%. The same value is represented in the Gauge. It is this % value that is used by WebMail to filter spam. The remainder of the tag lists specific reports that have been triggered by suspicious words or phrases in the . These are not used by the WebMail system. General advice on using the filtering service The tags produced by the filtering server enable users to put very powerful personalised anti-spam measures in their programs. However, just like any other powerful tool, it may also do damage to your if not used properly. Before we describe the details for using them in programs, here are a number of general guidelines to help users to use the tags effectively. 1. Be very conservative take action only on those messages identified with above 90% probability of being spam. 2. Choose cautious actions move the spam messages identified to a junk mail folder instead of deleting them outright so that you can review what s been caught and spot any falsely identified messages. 3. Refine your rules and actions when you have more experience and confidence in using them. 2

5 Using the filtering service with WebMail Note: this document assumes that you have an IMAP account and are familiar with using WebMail. If you are not familiar with WebMail see TUT 92 Introductory exercises using the webmail program IMP ( 1. Logon to WebMail with your usual username and password. 2. Click on the Options button on the toolbar at the top of the screen. 3. Click on SPAM Filters under the Mail Management options 4. Click on the text Click here to change your SPAM filters 3

6 5. A screen explaining the filtering system is displayed. Enter your password at the bottom of this screen and click the Continue button 6. The SPAM filtering screen is now displayed. In the first box enter the percentage value equal to and above which will be discarded. For example if you enter 95, with a probability of being spam of 95% or above will be deleted before you see it. Note: there is a small chance that genuine s may be classified as spam. For this reason you should always set this figure to a very high probability. If you set this value to 100 no s will be deleted. In the second box enter the percentage value equal to and above which will be moved out of your inbox and into another folder. This allows you to scan potential spam s quickly and stops them filling up your inbox. Set this value to a high level at first, and if you still receive a lot of spam in your inbox gradually reduce it. In the third box enter the folder you would like spam to be moved to. If you do not already have a suitable folder leave this box set to New Folder. If you selected New Folder in the previous box, enter a name for your new folder in the final box, otherwise leave this box blank. Your completed screen should look similar to the one shown overleaf. This is set up to delete with a probability of 95% or more and move with a probability of 70% or more into a new folder called SPAM. 4

7 7. Click on the Save Options button to save your new filtering rules. 8. Click on the Return to INBOX button to return to your . The new rules will be now applied to all new mail you receive. Check your spam folder If you set up the spam filtering rules to automatically move suspicious mail into a different folder, you must remember to check this folder on a regular basis. It is important to delete any s which are definitely spam to save space (otherwise they will use up your quota). If you are still getting a large amount of spam in your inbox, go back to the spam filtering setup and decrease the percentages above which s will be moved or deleted. If you find genuine s are being transferred into your spam folder, increase these percentages. 5

8 Frequently asked questions and potential problems Do I have to use the filtering? No. If you don t have a problem with spam, you do not have to take any action. Will the ISS filtering server drop my messages? No. The ISS filtering server will merely tag messages. In the case where a virus was found in your message, you will receive a notification with the original sender s address so you can inform the sender. Does the ISS filtering server tag outgoing messages? If your outgoing messages are relayed by ISS core mail servers, the answer is yes. Does the tagging affect the contents of the messages? No. Does the filtering service affect the performance of transmission? Only slightly in normal situations. Typically, it takes about 1.3 seconds to scan an average message. I have lost a message, where is it? Please check your junk folder to see if the lost message is there. If you think 90% probability is too low and many normal messages are being hit, you can modify your rule to only act on those messages identified with a 95% probability of being spam messages. You may also add more exceptions. 6