Teach your Inbox to Recognize Spam

MDaemon has many features for fighting spam that, when configured properly, can be very effective at blocking out unwanted junk email.  However, it is possible for the occasional spam message to slip through. Likewise, it is also possible for the occasional non-spam message to be mistakenly identified as spam and blocked from being delivered. This is especially true if you work in finance or the medical industry, where you are more likely to receive legitimate email messages that contain words often found in spam. This presents a challenge: How can administrators and end users improve the accuracy of the spam filter?

An effective solution to the problem is using Bayesian analysis to help MDaemon “learn” what is & is not spam.

You may be thinking, “So what is Bayesian analysis?” Bayesian analysis is based on Bayesian logic, which is a branch of logic that deals with probability inference – predicting future events based on knowledge of prior events. In the context of spam filtering, MDaemon’s Bayesian Learning feature uses Bayesian logic to make inferences about the probability that a message is spam based on the patterns contained within it and how those patterns compare with the patterns found in messages that have been fed to the Bayesian Learning engine.

Bayesian Learning helps train MDaemon’s spam filter to become more accurate over time by feeding it samples of spam and non-spam messages. This is especially useful for the medical and finance industries, where certain keywords are “spammy” to one industry but not the other. This feature also helps reduce false positives (legitimate messages mistakenly marked as spam) or false negatives (spam messages that were not marked as spam).

So how does Bayesian Learning work & how can users use it to train their inboxes to recognize spam? Keep reading to find out!

How to Use Bayesian Learning – The Short Version

Before we get into the details of how to use MDaemon’s Bayesian Learning features, let’s start with a high-level overview of how to use it. First, the administrator enables Bayesian Learning in MDaemon. Then, the administrator creates the Spam and Non-Spam public folders and grants users Lookup/Insert access rights to those folders. Ham/Spam forwarding addresses can also be enabled, so that messages sent to them as attachments can be fed to the Bayesian Learning engine accordingly. Users who receive false-negatives or false-positives can then feed those messages to the Bayesian Learning engine using various methods. By default, after 200 spam and non-spam messages have been collected, Bayesian Learning takes place & the contents of these messages are added to a database of “tokens.”

Instructions for Administrators

The administrator needs to enable Bayesian Learning in MDaemon, and configure Bayes folder access and optionally configure forwarding addresses, as outlined in the following steps.

  1.  In MDaemon, navigate to Security | Spam Filter, and click on Bayesian Classification in the left-hand navigation menu.

    MDaemon Bayesian Learning

    Bayesian Learning in MDaemon

  2. Check the first box to enable Bayesian classification.
  3. By default, the second box (Schedule Bayesian learning for midnight each night) is checked. If you have a lot of spam/non-spam messages to learn from, you may want to schedule Bayesian learning at more frequent intervals by un-checking this box and entering a value in the following blank (Schedule Bayesian learning once every __ hours).
  4. Most spam messages are relatively small, so to improve performance, you can enter a value in the “Do not learn from messages larger than” blank. 50,000 bytes is the default value.
  5. Before we discuss the checkbox to enable spam/ham forwarding addresses, we need to create public folders for spam and non-spam messages. Click on the Create button to populate these fields with the default location for these folders, or use the buttons to the right to specify a different location. By default, access permission to these folders is only granted to local users of local domains and is limited to Lookup and Insert rights. The postmaster’s default permissions are Lookup, Read, Insert, and Delete. To prevent users from placing spam in the non-spam folder and vice-versa, you could remove access to these folders for all users except the administrator (via Setup | Public Folder Manager), and create another pair of spam/non-spam folders, then grant users Lookup and Insert rights to those folders instead. This allows the administrator to review the contents of these folders for improperly placed messages before placing them in the Bayesian Spam and Non-Spam folders.
  6. You can optionally check the box “Enable spam and ham forwarding addresses.” When this box is checked, users can forward false-negatives or false-positives to spamlearn@yourdomain.com or hamlearn@yourdomain.com to feed these messages to the Bayesian Learning engine. This process is explained in greater detail later in this post.
  7. Users who have been granted Lookup & Insert access rights to the Spam and Non-Spam folders can use the thumbs-up & thumbs-down icons in WorldClient to feed spam (false-negatives) and non-spam (false-positives) to the Bayesian Learning engine. Administrators who wish to remove these icons for all users can edit the MDaemon/WorldClient/Domains.ini file and add the following:
    [Default:UserDefaults]
    DisableSpamButton=Yes
    DisableHamButton=Yes 
    Save the file and restart MDaemon (or IIS, if WorldClient is running on IIS).
  8. Administrators who wish to remove these icons for a specific user can edit the User.ini file for the user (located at MDaemon/Users/example.com/(username)/WC) as follows:
    [User]
    DisableSpamButton=Yes
    DisableHamButton=Yes

Instructions for End Users

Now that Bayesian Learning is properly configured in MDaemon, users can begin feeding the Bayesian Learning engine samples of spam and non-spam messages to train the spam filter to become more accurate. There are various ways to train the Bayesian Learning engine – using the thumbs-up & thumbs-down icons in WorldClient, using drag & drop to drag messages to the Spam and Non-spam folders (when using IMAP or Outlook Connector), or forwarding messages as attachments to the assigned spamlearn@ or hamlearn@ addresses (useful for POP users).

Using WorldClient

The easiest way to train the Bayesian Learning engine is to select “This is Spam” or “This is Not Spam” (in the WorldClient theme) or the thumbs-up and thumbs-down buttons (in the LookOut and WorldClient themes) in WorldClient. Simply click once on it to highlight it, and then select “This is Spam” or click on the thumbs-down icon. If a legitimate, non-spam message was placed in your Spam folder, you can highlight it, and then select “This is Not Spam” or click on the thumbs-up icon.

Mark as Non-Spam

Mark as Non-Spam

Using Drag & Drop (IMAP & Outlook Connector)

IMAP and Outlook Connector users who have been granted Lookup and Insert access rights to the spam and non-spam folders can use drag & drop to move the message to the appropriate spam/non-spam folder.

Forwarding as Attachments (POP3)

POP3 users can forward these messages (as an attachment from an authenticated session) to the spamlearn@ and hamlearn@ addresses. Messages sent to these addresses must be received via SMTP from a session that is authenticated using SMTP AUTH.

Considerations

As explained under step 5 above (under Administrator Instructions), when granting users access to the Bayesian Spam and Non-Spam public folders, it’s possible for users to feed samples of spam and non-spam to the wrong folders, making the Bayesian learning process less effective, thus, you may consider creating a separate pair of Spam/Non-Spam public folders and having users place messages in those folders instead for administrative review.

Conclusion

When used properly, Bayesian Learning is a powerful tool for reducing spam and ensuring legitimate messages are not blocked by the spam filter. More information can be found in the following knowledge base articles:

Bayesian Learning Information:
http://www.altn.com/Support/KnowledgeBase/KnowledgeBaseResults/?Number=227

Training the Bayesian Learning Process in MDaemon:
http://www.altn.com/Support/KnowledgeBase/KnowledgeBaseResults/?Number=378

Bayesian Learning Tips & Tricks:
http://www.altn.com/Support/KnowledgeBase/KnowledgeBaseResults/?Number=379

Leave a Comment

Your email address will not be published. All fields are required.


7 + = 15