Following my discussion with Vircom about the problems the e-mail security firm is finding with image-based spam (as reported
in last week's newsletter), I spoke with IronPort about the issue.
 Related linksFor webinars or research on messaging, or to join the Osterman Research market research survey panel, go here. Osterman Research helps organizations understand the markets for messaging and directory related offerings. To e-mail Michael,
click here.
IronPort is finding that about 12% of all spam is currently image-based, but that only a small handful of spammers are currently
using it. However, because of the inability of many spam filters to adequately detect and stop this type of spam, the capture
rate is much lower than for conventional spam. The result is that upwards of 50% of the spam received by end users is image-based
spam.
Conventional anti-spam systems using heuristics are quite poor at stopping image spam. Signature-based approaches are also
inadequate because randomization techniques easily bypass these signatures. Randomization can take the form of inserting random
pixels in a GIF image, which are imperceptible to viewers but that can easily break traditional binary signatures, or by changing
palette or border colors. While randomization capabilities for image-based spam are not yet built into spam tool kits available
on the Web, it's probably only a matter of time before this is the case.
IronPort's approach is to use what it calls Context Adaptive Scanning - basically, profiling image spam to look for patterns
across the message, the reputation of the sender, whether or not a dynamic IP address is used, how the message is constructed
and other information. IronPort's approach also looks for color patterns within an image that can identify the presence of
text within an image, since the vast majority of valid images sent through e-mail rarely contain a substantial quantity of
text. Using these techniques, IronPort is currently able to stop about 98% of image-based with a very low false positive ratio.
How much of a problem is image-based spam for your organization? Are you finding an increase in this type of spam and are
you having difficulty detecting and stopping it? Please let me know.
|
