You can recognize physical junk mail in your mailbox and quickly sort the coupons from your mortgage statement with very little effort. Bright colors, the return address, and content make it easy to do. In the same way, spam emails tend to be similar to each other in their offerings, format, and overall arrangement. Email filters were designed to do the same scanning and sorting for your inbox, leaving you out of the process. For those inundated with spam, this becomes a necessary practice to manage email in a practical way. Some people get 200-1000 or more spam emails each and every day; and sometimes more as the list of spam email addresses "gets around the net".



Until 2002, most spam filters were Heuristic, or rule-based. Heuristic simply means a common sense rule or set of rules used to solve a problem. Heuristic filters look for patterns in the content of an email and match them against a database of known spam characteristics. These characteristics can be in the form of certain words, phrases, punctuation, and altered dates. What makes them different from most content based filters is that heuristic filters assign scores for each match and then tally the results to give the email a total score. If the score falls above a certain level, the filter assumes it is spam and takes action based on the rule that applies. Laws have been put in place to help combat spam, but you must first be willing to prosecute the sender. The most well known law is the Spam-can law that was recently adopted.

The problem with heuristic filters is that they are, at best, an educated guess. They are used when a specific algorithm cannot be applied to formulate an answer, a common problem in the field of artificial intelligence. You use common sense when sorting your mail, but a computer program cannot. So you arm the filter with those commonsense rules and hope for the best. It will not always be right. As you apply more rules, you increase the potential for false-positives (identifying legitimate mail as spam). If you keep the rules simple, the spammers can easily defeat the filter because it does not have enough information.

Also, the rules do not change as quickly as spam does because the rules are static. What may have been an appropriate rule yesterday will not suffice today. Spam that contains the phrase "mortgage refinance" will be flagged, but not "m0rtgage ref1nance" The spammers simply replaced the "o" and "i" with "0" and "1" knowing that the human eye will still be able to read the message. Many little chamges such as this are being incorporated by spammers every day.The filter makers responded by creating more rules to look for those types of obstructions. This has led to almost a tag team type of atmosphere where the spammers are always trying to stay one step ahead of the software.

Additionally, spammers will also test their new spam against popular heuristic filters to see if they have succeeded in getting around the rules. They may simply purchase the software themselves or use a number of websites to test their spam. These websites were developed to assist "legitimate" marketers craft their newsletters and messages in such a way as to avoid being flagged as spam. Obviously, there is no way to tell who may be legitimate when they are using this service, and it stands to reason that many of them will be spammers. They know that once they are successful it will take time for the software makers to respond.

Heuristic filters are typically easy to install and maintain. They should, however, be used in conjunction with other anti-spam techniques if too much junk mail is getting through. If potential false-positives are not an option that you are willing to accept, you will need to keep the rules simple and employ other blocking techniques, like blacklisting. Bayesian filters are similar to heuristic filters, but can learn the difference between legitimate email and spam based on your individual requirements. If basic spam protection with little fuss is what you are looking for, heuristic filters are the way to go. These filter are tried and proven through time.