Fighting malware and spam

Unattended spam filtering using machine learning: implementation, deployment and lessons

John Graham-Cumming

polymail is a commercial anti-spam library in wide use worldwide. The library supports both attended (i.e. user gives feedback on spam filtering mistakes - sometimes known as 'train on error') and unattended (i.e. blackbox with no user interaction necessary) filtering. This talk details the implementation of 'train on everything' spam filtering with SURBL integration and automatic whitelisting, the deployment of an unattended spam filter and lessons learned in over a year of deployment supporting 10,000s of clients.

Although polymail is a commercial product, this is a technical talk. Come prepared for some mathematics, lots of code, plenty of real-world data and no wild marketing claims of 99.999% accuracy!

Poll

Malware Prevalence

Agent
OnlineGames
Kryptik
Heuristic/generic
Heuristic/generic