 |
 Norton AntiSpam 2005 Review
June 29, 2005 - Part II
by Andrew Cooper
The program @ work
I open my Outlook Express client, and discover a new folder added to the Inbox, called the Norton AntiSpam Folder. There, all messages flagged by the program as "spam" will be relocated. Before running the scan, I set up a separate email account which has been literally flooded with spam messages and press the "Receive All" (mail) button on my OE (Outlook Express) interface.
My email client starts to retrieve mail from the server which I am sure is mostly filled with spam messages rather than normal legitimate communications. But what do I see? The Norton Antispam Task Bar icon displaying an animated picture where an envelope gets scrutinized as if by a magnifying glass, signifying that NAS is currently scanning my incoming server messages for spam. After the mail reception is completed, out of roughly 90 emails arriving at my inbox NAS has found only 7 spam messages, identifying the rest as legitimate. But by my count, more than half of those messages were spam, so where's the discrepancy?
The discrepancy was easily found. It turned out that NAS didn't recognize as spam many spam messages that bore all the hallmarks and met all the criteria for being called spam - Viagra peddling ads, mortgage deals, debt reduction offers, ads for organ enlargement, and other definite spam correspondence.
Here's the statistics:
- NAS's found spam messages:7
- Total email messages delivered: 90
- Real spam messages: 46
- Legitimate e-mails: 44
- The unpleasant ratios: NAS's effectiveness (for the initial scan): 7/46 =15.22%
- Spam ratio: 46/90= 51.11%
- Legitimate mail incorrectly identified as spam (false positives) = 0%
Not too spectacular I guess, especially in light of the fact that NAS let in obvious spam, and even one phishing instance that purported to have come from eBay's support staff.
So, I educated the program, telling it that some of the messages it recognized as legitimate were actually spam, and expected it to learn from these patterns to recognize future spam. It is easily done, and all you have to do is right-click on the spammed email you received in your inbox folder and select the command "This is Spam" from Norton's newly added context menu.
On the subsequent scans, the program fared much better. It caught 73 percent of spam with zero false positives (or very few - it was hard to sort through all the messages perceived as spam, though all of the messages I looked through were correctly identified as spam).
Conclusion:
The program requires constant training in order to better recognize spam. The more you train it, the more precisely it's able to flag spam from a given pool of emails. If you get a lot of spam messages every day, it is advisable to download the trial version of the program, which works for fifteen days from installation- a sufficient period to train and evaluate it, and judge for yourself whether you should buy the full registered version. But be prepared to receive more than 80 percent of unfiltered spam at the early stages of its use, while maintaining a fairly low false positives ratio of around 6 percent, which is just about in line with its competition. A couple things I didn't like about the program were that in idle mode it took too much memory resources out of my system, no icon was shown while the program was inactive and working in the background, and the fact that I couldn't import the program's spam training algorithms to use them on another computer.
Developer's web site: www.symantec.com/antispam
To download the program click here
Read next:
Back to Part I
|
|
