Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Embedded image filter problem
  FAQ FAQ  Forum Search   Register Register  Login Login

Embedded image filter problem

 Post Reply Post Reply
Author
Simone View Drop Down
Groupie
Groupie


Joined: 06 July 2005
Status: Offline
Points: 42
Post Options Post Options   Thanks (0) Thanks(0)   Quote Simone Quote  Post ReplyReply Direct Link To This Post Topic: Embedded image filter problem
    Posted: 26 June 2006 at 5:17am

I cannot understand why my embedded image filter does not work at all.

SpamImageThreshold=10
SpamImageColorSensitivity=20
SpamImageMinWidth=200
SpamImageMinHeight=200
SpamImageSamplingPoints=200
MaxGridRecords=200

I have those settings on mi .INI and in near ten million email i didn't find any of this in quarantine. Is there some set i have to activate to let this filter work?

Thank you,
Simone

 

 

Back to Top
Simone View Drop Down
Groupie
Groupie


Joined: 06 July 2005
Status: Offline
Points: 42
Post Options Post Options   Thanks (0) Thanks(0)   Quote Simone Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2006 at 5:55am

obviously i activated the domain matrix.

Simone

Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2006 at 9:39am

There is currently an issue with mutliple images in a single email. Roberto is working on it. Below is an entry from my log that shows it detecting some spam. I have my min width & height set to 25.

06/26/06 00:04:32:219 -- (42332) Scanning image for spam:image704.gif
06/26/06 00:04:32:235 -- (42332) Detected spam signature in embedded image
06/26/06 00:04:32:235 -- (42332) Created thread (44484) to add email to quarantine

In would be great for SFI to implement SpamAssassin and leave stuff like this to it since it easily catches all the stock and image spams. I have a filter behind SFI that uses Spamassassin exclusivley and it catches all the image spam and stock market spam SFI misses so my customers never see it, but I do, and it frustrates me since I can't feed it back into SFI.

If a company like MDaemon can write a Spamassassin DLL and get an average of 1-2 emails SA checked per second I'm sure the master programmers at SF could do even better (Just raising the bar Roberto)

 



Edited by WebGuyz
http://www.webguyz.net
Back to Top
Simone View Drop Down
Groupie
Groupie


Joined: 06 July 2005
Status: Offline
Points: 42
Post Options Post Options   Thanks (0) Thanks(0)   Quote Simone Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2006 at 10:14am

i tried some years ago SA but it is too processor expensive.

SF use 1/10 of processor and works 10 times faster and it is very important for me.

I can miss some spam but i can't generate a large queue of email...

By the way, i changed in 25X25 and i tried some test email but nothing happened neither the first row of you log: "Scanning image for spam" it pass without any check.

Do U know why?

Thanks,

Simone

Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2006 at 10:35am

Simone,

 Checked my settings in .ini file and don't see anything else that would affect it working. Maybe shoot an email to support to see what we missed.

Regards SA, perl based SA is slow but most Windows spam vendors are creating a DLL and ecapsulating it for speed. I also do not SA check anything that is whitelisted and since its the last test before customers get it I usually average 10-15 SF rejects before 1 email hits the SA filter (using Alt-N's Mdaemon). SFI does a great job for 95% of the mail but that last 5% is possible using spamassin. I guess my customers are spoiled rotten because they take great delight in forwarding to me any new spams that slip thru and I only get 2-3 a month.

 

http://www.webguyz.net
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2006 at 3:44pm
Simone,

Hoping that I have the correct email address for you... I sent you a few "spam" images that should have been blocked, but instead did indeed make it thru. The same email sent to our own server were stopped. If you received them, can you please zip us SpamFilter's activity logfile and you SpamFilter.ini file for today so we can take a look and see why they're not being blocked?
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 27 June 2006 at 12:47pm
Simone,

Mistery solved. Currently the image filter requires the keyword filter to be enabled, as scanning for images requires scanning the email for certain keywords as well. In your settings, I see that you have the keyword filter disabled in the "Custom Domain Filters". If you enable the keyword filter there, the image filter should start to work.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 27 June 2006 at 12:57pm

Roberto,

 Any progress on detecting inline image spam when multiple images are specified? Still see a lot of this stuff and would like to reject it within SFI.

Thanks!

http://www.webguyz.net
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 27 June 2006 at 1:47pm
Starting from build 3.0.1.571 we added the following option in the SpamFilter.ini file:

;To reduce false positives, emails with multiple inline images can bypass the image filter by setting this value to 1
SpamImagePassMultiImage=1

If you set it to 0 all inline images will be scanned for spam.

However I do not think (for now - unless we have major requests for this feature ) that we'll add a filter to reject all emails if they simply have multiple inline images, as the number of false positives would be potentially very large (ex. images with embedded signatures/logos/smileys and other symbols - ex. yahoo toolbar symbols) could cause the email to be blocked.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Simone View Drop Down
Groupie
Groupie


Joined: 06 July 2005
Status: Offline
Points: 42
Post Options Post Options   Thanks (0) Thanks(0)   Quote Simone Quote  Post ReplyReply Direct Link To This Post Posted: 27 June 2006 at 2:04pm

ok, i suppose that SURBL too depends on keywords activation....

Wich other filters depends on it?

And wich othere depends on others?

Simone

Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 27 June 2006 at 3:21pm

Originally posted by LogSat LogSat wrote:

Starting from build 3.0.1.571 we added the following option in the SpamFilter.ini file:

;To reduce false positives, emails with multiple inline images can bypass the image filter by setting this value to 1
SpamImagePassMultiImage=1

If you set it to 0 all inline images will be scanned for spam.

However I do not think (for now - unless we have major requests for this feature ) that we'll add a filter to reject all emails if they simply have multiple inline images, as the number of false positives would be potentially very large (ex. images with embedded signatures/logos/smileys and other symbols - ex. yahoo toolbar symbols) could cause the email to be blocked.

Just to make sure I understand, is the scan in the embedded images for spam looking for keywords I have defined or what?? If the image has "Big Bubbas Stock" in the text of the scanned image do I have to have "Big Bubbas Stock" defined in my keywords?

Still seeing this stuff coming thru and trying to get a handle on it.

Andy



Edited by WebGuyz
http://www.webguyz.net
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2006 at 3:36pm
Andy,

While looking into your email, I did notice something else wrong in the way SpamFilter processed the email you forwarded. Some images were indeed skipped, causing a failure to detect the spam-image.
 
A new build will be available shortly in the registered user area with the fix.

As a side-note, no, SpamFilter will not look for your keywords in the image itself.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.093 seconds.