Proofpoint upgrades filters to catch image spam

Messaging security vendor Proofpoint on Monday announced an upgrade to its antispam technology that is designed to offer better protection against image-based spam.

The upgraded Proofpoint Spam Detection Module combines machine-learning algorithms and image analysis techniques to trap image spam, or unwanted messages with text embedded in an image file that evade most spam filters because they can’t recognize the words inside the image. The company estimates that image-based spam accounts for about 24% of all unwanted messages.

The new module, which works with Proofpoint’s MLX core antispam technology, uses a number of techniques to block image spam from entering an organization’s e-mail stream. These include automated image extraction threshold analysis that looks for high-frequency variations across images, designed to stop spammers from evading filters by slightly modifying the images in which spam text is embedded; “fuzzy matching” for obfuscated images; and the ability to detect animated GIF files embedded in messages that hide spam payload, according to company officials.

These new techniques work with the existing features in Proofpoint’s MLX technology to analyze inbound e-mail and catch spam and threats before they enter a network, the company says. MLX, which runs as software or on a dedicated appliance at the customer’s gateway, is automatically updated with new rules and techniques as Proofpoint develops them.

In addition to the new spam detection module, Proofpoint has tweaked the performance of its MLX engine so that spam analysis can be done 40% more quickly than before, officials say.

Proofpoint’s upgraded Spam Detection Module costs $2 to $20 per user per year, depending on the number of users.