Kaspersky PURE User Guide - Kaspersky Lab

A D V A N C E D A P P L I C A T I O N S E T T I N G SAnti-Spam work consists of two stages:1. Application of strict filtering criteria to a message. These criteria allow a quick determination as to whether themessage is spam. Anti-Spam assigns to the message spam or not spam status, the scan is stopped and themessage transferred to the mail client for processing (see algorithm steps 1 to 5 below).2. Inspection of messages, which have passed strict selection criteria during previous steps. Such messagescannot be unambiguously considered spam. Therefore Anti-Spam has to calculate for them the probability ofbeing spam.Anti-Spam algorithm consists of the following steps:1. Address of message sender is checked for the presence in the lists of allowed or blocked senders.If a sender's address is in the allowed list, the message receives the Not Spam status.If a sender's address is in the black list, the message receives the Spam status.2. If a message was sent using Microsoft Exchange Server and scan of such messages is disabled, the messageis considered as not spam.3. A message analysis is performed to check if it contains strings from the list of allowed phrases. If at least oneline from this list has been found, the message will be assigned the not spam status. This step is skipped bydefault.4. Anti-Spam analyzes a message to check if it contains strings from the list of blocked phrases or the list ofobscene words. Whenever words from these lists are found in a message, their weighting coefficients aresummed up. If the total of coefficients exceeds 100, such message will receive the spam status. This step isskipped by default.5. If message text contains an address included into the database of phishing or suspicious web addresses, themessage receives the Spam status.6. E-mail is analyzed using heuristic rules. If the analysis reveals in a message signs typical of spam, theprobability of its being spam increases.7. E-mail is analyzed using the GSG technology. While doing it, Anti-Spam analyzes images attached to the emailmessage. If analysis reveals in the images signs typical of spam, the probability of the message being spamincreases.8. The application analyzes e-mail attachments in .rtf format. It scans attached documents checking them for thepresence of spam signs. After the analysis is complete, Anti-Spam calculates how much the probability of themessage being spam increased. The technology is disabled by default.9. It checks for the presence of the additional features typical of spam. Each detected feature increases theprobability that the message being scanned is in fact spam.10. If Anti-Spam was trained, the message will be scanned using iBayes technology. Self-training iBayes algorithmcalculates the probability of message being spam based on the frequency of phrases typical of spam found inmessage text.Message analysis determines the probability of its being spam expressed as the spam rate value. The Spam or Probablespam status will be assigned to a message depending upon the specified threshold values of the spam rate (see section"Regulating threshold values of spam rate" on page 121). Besides, the product adds by default to the Subject field ofspam and potential spam messages the label [!! SPAM] or [?? Probable Spam] (see section "Adding a label tomessage subject" on page 122). Then each message will be processed in accordance with your rules defined for e-mailclients (see section "Configuring spam processing by mail clients" on page 124).111