Print Page | Close Window

Embedded image filter problem

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5683
Printed Date: 12 December 2017 at 3:28am


Topic: Embedded image filter problem
Posted By: Simone
Subject: Embedded image filter problem
Date Posted: 26 June 2006 at 5:17am

I cannot understand why my embedded image filter does not work at all.

SpamImageThreshold=10
SpamImageColorSensitivity=20
SpamImageMinWidth=200
SpamImageMinHeight=200
SpamImageSamplingPoints=200
MaxGridRecords=200

I have those settings on mi .INI and in near ten million email i didn't find any of this in quarantine. Is there some set i have to activate to let this filter work?

Thank you,
Simone

 

 




Replies:
Posted By: Simone
Date Posted: 26 June 2006 at 5:55am

obviously i activated the domain matrix.

Simone



Posted By: WebGuyz
Date Posted: 26 June 2006 at 9:39am

There is currently an issue with mutliple images in a single email. Roberto is working on it. Below is an entry from my log that shows it detecting some spam. I have my min width & height set to 25.

06/26/06 00:04:32:219 -- (42332) Scanning image for spam:image704.gif
06/26/06 00:04:32:235 -- (42332) Detected spam signature in embedded image
06/26/06 00:04:32:235 -- (42332) Created thread (44484) to add email to quarantine

In would be great for SFI to implement SpamAssassin and leave stuff like this to it since it easily catches all the stock and image spams. I have a filter behind SFI that uses Spamassassin exclusivley and it catches all the image spam and stock market spam SFI misses so my customers never see it, but I do, and it frustrates me since I can't feed it back into SFI.

If a company like MDaemon can write a Spamassassin DLL and get an average of 1-2 emails SA checked per second I'm sure the master programmers at SF could do even better (Just raising the bar Roberto)

 



-------------
http://www.webguyz.net


Posted By: Simone
Date Posted: 26 June 2006 at 10:14am

i tried some years ago SA but it is too processor expensive.

SF use 1/10 of processor and works 10 times faster and it is very important for me.

I can miss some spam but i can't generate a large queue of email...

By the way, i changed in 25X25 and i tried some test email but nothing happened neither the first row of you log: "Scanning image for spam" it pass without any check.

Do U know why?

Thanks,

Simone



Posted By: WebGuyz
Date Posted: 26 June 2006 at 10:35am

Simone,

 Checked my settings in .ini file and don't see anything else that would affect it working. Maybe shoot an email to support to see what we missed.

Regards SA, perl based SA is slow but most Windows spam vendors are creating a DLL and ecapsulating it for speed. I also do not SA check anything that is whitelisted and since its the last test before customers get it I usually average 10-15 SF rejects before 1 email hits the SA filter (using Alt-N's Mdaemon). SFI does a great job for 95% of the mail but that last 5% is possible using spamassin. I guess my customers are spoiled rotten because they take great delight in forwarding to me any new spams that slip thru and I only get 2-3 a month.

 



-------------
http://www.webguyz.net


Posted By: LogSat
Date Posted: 26 June 2006 at 3:44pm
Simone,

Hoping that I have the correct email address for you... I sent you a few "spam" images that should have been blocked, but instead did indeed make it thru. The same email sent to our own server were stopped. If you received them, can you please zip us SpamFilter's activity logfile and you SpamFilter.ini file for today so we can take a look and see why they're not being blocked?


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: LogSat
Date Posted: 27 June 2006 at 12:47pm
Simone,

Mistery solved. Currently the image filter requires the keyword filter to be enabled, as scanning for images requires scanning the email for certain keywords as well. In your settings, I see that you have the keyword filter disabled in the "Custom Domain Filters". If you enable the keyword filter there, the image filter should start to work.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: WebGuyz
Date Posted: 27 June 2006 at 12:57pm

Roberto,

 Any progress on detecting inline image spam when multiple images are specified? Still see a lot of this stuff and would like to reject it within SFI.

Thanks!



-------------
http://www.webguyz.net


Posted By: LogSat
Date Posted: 27 June 2006 at 1:47pm
Starting from build 3.0.1.571 we added the following option in the SpamFilter.ini file:

;To reduce false positives, emails with multiple inline images can bypass the image filter by setting this value to 1
SpamImagePassMultiImage=1

If you set it to 0 all inline images will be scanned for spam.

However I do not think (for now - unless we have major requests for this feature ) that we'll add a filter to reject all emails if they simply have multiple inline images, as the number of false positives would be potentially very large (ex. images with embedded signatures/logos/smileys and other symbols - ex. yahoo toolbar symbols) could cause the email to be blocked.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Simone
Date Posted: 27 June 2006 at 2:04pm

ok, i suppose that SURBL too depends on keywords activation....

Wich other filters depends on it?

And wich othere depends on others?

Simone



Posted By: WebGuyz
Date Posted: 27 June 2006 at 3:21pm

Originally posted by LogSat LogSat wrote:

Starting from build 3.0.1.571 we added the following option in the SpamFilter.ini file:

;To reduce false positives, emails with multiple inline images can bypass the image filter by setting this value to 1
SpamImagePassMultiImage=1

If you set it to 0 all inline images will be scanned for spam.

However I do not think (for now - unless we have major requests for this feature ) that we'll add a filter to reject all emails if they simply have multiple inline images, as the number of false positives would be potentially very large (ex. images with embedded signatures/logos/smileys and other symbols - ex. yahoo toolbar symbols) could cause the email to be blocked.

Just to make sure I understand, is the scan in the embedded images for spam looking for keywords I have defined or what?? If the image has "Big Bubbas Stock" in the text of the scanned image do I have to have "Big Bubbas Stock" defined in my keywords?

Still seeing this stuff coming thru and trying to get a handle on it.

Andy



-------------
http://www.webguyz.net


Posted By: LogSat
Date Posted: 28 June 2006 at 3:36pm
Andy,

While looking into your email, I did notice something else wrong in the way SpamFilter processed the email you forwarded. Some images were indeed skipped, causing a failure to detect the spam-image.
 
A new build will be available shortly in the registered user area with the fix.

As a side-note, no, SpamFilter will not look for your keywords in the image itself.



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP



Print Page | Close Window