Sophos: Protecting the world from The Pentagon

• Tags:
• Anti-spam,
• Antivirus

Tom Espiner ZDNet.co.uk

Published: 28 Nov 2005 16:05 GMT

• 
• 
• 
• 
• 

...normally has bugs, and writers hope that any warnings by the security firms could actually help them complete their work.

Not technically malware, spam is still an important part of the work done at The Pentagon. The Sophos spam operations group of 11 people analyse and look at spam trends full-time. The unsolicited mail is taken from spam traps that work on a similar principle to the antivirus honeypots — anything that comes into them is by definition spam.

---

---

"Any mail we receive from the honeypots is not legitimate. Anything with a large attachment will also be analysed by the antivirus guys, because more often than not malware is being spammed out," says Paul Baccas, spam research analyst. The honeypots Sophos uses are all ex-legitimate IP addresses that have been reassigned through agreements with ISP.

Spam blocking
Anti-spam software automatically filters 95 percent of the spam Sophos receives. The remaining 5 percent is automatically channelled through various rules, which look at whether the spam has come from a known spam relay, whether it has a high percentage of HTML and whether there are recognised text strings.

Approximately 0.05 percent of the spam is left after automatic filtering. This is when the analysts step-in to determine its characteristics and hopefully come up with a way of blocking it. One characteristic Sophos looks for is paragraph prints. Each spam has a certain distribution of paragraph breaks that characterises that particular spam and enables Sophos to recognise it and write a rule to block it. Rules are updated all the time and gradually get a lower score depending on their prevalence.

• 
• 
• 
• 

• Share this article:
• Digg
• Slashdot
• Del.ici.ous
• Stumble
• Reddit

• Most Recent
• Most Popular
• Most Discussed