False Negatives

False negatives are spam messages that are not rejected, quarantined, or tagged by the UVSC E-Mail Firewall or the Avinti iSolation Server. We do everything we can to eliminate spam, but sometimes spam messages make it through. This page is designed to help you understand some of the reasons why messages are mis-classified and what you can do to ensure it doesn't happen again.

Why spam sometimes gets through

Spammers are smart. They are constantly changing their tactics to thwart spam detection and get messages into our in-boxes. While we and the manufacturer of the UVSC E-Mail Firewall do all we can to stop spam, we can only react to the new techniques employed by spammers. Once a new technique is found, we devise ways to detect and eliminate it. Unfortunately, by the time we find the new technique, it has already been used, which means somebody - probably a lot of people, have already received the spam message.

One of the most powerful ways of detecting spam is called Bayesian Analysis. This technique uses a database of e-mail message characteristics, including words and word combinations used in messages. It assigns a statistical likelihood value to each characteristic. When a new message is received, it is compared to the database and assigned a statistical probability that it is or isn't spam. Unfortunately, one technique employed by some spammers is to mess with the statistical probabilities stored in the database. This is called Bayes Poisoning. When a database is poisoned, it can assign a positive score instead of a negative score for a spam message. Thus, the message is allowed, even though it is obviously spam. The only way to mitigate Bayes Poisoning is to keep the database up to date by classifying messages as spam or not-spam. Properly classified messages overcome the effects of Bayes Poisoning and help ensure that future poisoning attempts will fail.

How to ensure spam doesn't get through again

The most effective way to preventing spam in the future is to teach the system about the spam message. This is done by forwarding the message (as an attachment) to mailadm@uvsc.edu. This special e-mail address is used by the e-mail administrator to gather spam and feed it into the system to teach it what not to accept. Please remember to forward the message as an attachment so that all parts of the original message are intact - we need the header information from the message to be sure we teach the system correctly.

To simplify the process of forwarding messages to MAILADM for users of GroupWise, follow the steps in the document http://www.uvsc.edu/email/spamvirus/pdf/Spam-Folder-How-To.pdf.