* What you do in e-mail will come back to haunt you
The current message from a politician, news anchor, salesperson, advertisement or colleague is quite often less important to us than the sum of the things they’ve told us in the past. In other words, what we’ve heard in the past is very often a more reliable indicator of what to believe than what we’re hearing in the present.
That’s really the paradigm behind reputation filters used in blocking spam, filters that can often provide a better means of blocking spam than content-based filtering systems working on their own. Basically, a reputation-based anti-spam system uses an enormous database that contains information about the behavior of millions of IP addresses. E-mail coming from IP addresses that, in the past, have sent large quantities of potentially spammy e-mail are regarded as more suspect than IP addresses that have not been the source of spam.
The fundamental advantage of reputation systems is that they essentially are a data mining system, helping a spam-blocking system to evaluate a message based not only on its content, but also the past behavior of its source.
A large and growing number of anti-spam vendors use reputation analysis to block spam. Kelkea, for example, uses a network of data centers in North America to monitor millions of IP addresses – the company is planning to expand its operations into Europe and Asia. IronPort, using its SenderBase technology, monitors a significant percentage of the world’s IP traffic to determine the behavior of millions of sources of e-mail. Many other vendors offering reputation-based anti-spam services, including CipherTrust, Symantec Brightmail and MX Logic, to name but a few of the vendors offering capabilities in this area.
The real advantage of reputation-based anti-spam systems is in what you can do with the information about a source of e-mail. While it is possible to use this information to block e-mail coming from IP addresses, a more useful approach might be to simply throttle back the flow of e-mail coming from suspect sources; doing so allows e-mail to get through if it’s legitimate, while minimizing the impact if it’s not.
