Intelligent Message Filter (IMF) is a content filter designed specifically for Exchange. It is based on patented machine-learning technology from Microsoft Research known as Microsoft SmartScreen%26reg; technology. SmartScreen is currently used by MSN, Microsoft Hotmail%26reg;, Microsoft Office Outlook%26reg; 2003, and Exchange. IMF was designed to distinguish between characteristics of legitimate e-mail messages and spam, based on millions of messages. IMF can make an accurate assessment of the probability that an incoming e-mail message is either a legitimate message or spam. Unlike many other filtering technologies, IMF uses characteristics from a statistically sound sample of e-mail messages. In addition to spam, the inclusion of legitimate messages in this sample reduces the likelihood of mistakes. Because IMF recognizes characteristics of both legitimate and UCE messages, the accuracy of IMF is increased.
Intelligent Message Filter is installed on Exchange servers that accept inbound SMTP messages from the Internet. When an external user sends e-mail messages to an Exchange server with IMF installed, the IMF evaluates the textual content of the messages and assigns each message a rating based on the probability that the message is spam. This rating ranges from 1 to 9 and is stored as a message property known as the spam confidence level (SCL) rating. This rating is persisted with the message when the message is sent to other Exchange servers.
After Intelligent Message Filter has assigned an SCL to the message, it is evaluated against two thresholds configured by the administrator as follows:
1. Gateway blocking configuration: Block messages with an SCL rating greater than or equal to. If the SCL of a message is greater than or equal to the value set here, one of the following actions can be performed on the message :
a. Archive
b. Delete
c. No action
d. Reject
2. Store junk e-mail configuration: Move messages with an SCL rating greater than. If the message is greater than the value set here, the message will be delivered to the junk e-mail folder of the user’s inbox, unless the user has the sender on their safe senders list.
2）Custom Weighting Feature in IMF V2
IMF version 2 includes a completely new feature called the Custom Weighting Feature (CWF), which allows you to customize IMF even further. With CWF you can filter e-mail messages based on specific phrases within the body of the messages, the subject line or both. As is the case with some of the other Exchange 2003 SP2 features such as MAPI access per user and the database size limit changes, customization to the CWF cannot be done via the user interface. Instead you need to make changes directly in an associated .xml file (MSExchange.UceContentFilter.xml). The .xml file is read by IMF version 2 upon initialization, and then reloaded every time it’s modified. The MSExchange.UceContentFilter.xml file you create should be saved under the following path:
Value | Description |
Type=”BODY” | Search for value specified in text in the BODY field of the message |
Type=”SUBJECT” | Search for value specified in text in the SUBJECT field of the message |
Type=”BOTH” | Search for value specified in text in the BODY and SUBJECT field of the message |
Change | The Change value is used to define what effect a matched word or phrase will have on the SCL score of a message. The Change can be any integer value. Should the word or phrase be matched, the change integer value will be added to the original SCL value. Should the value exceed the supported SCL value, it will be normalized to a 0 to 9 range. In addition to the Change can also use the MIN or MAX keywords. Any time a phrase with the MIN keyword is matched, the message is given an SCL of 0 regardless of any other weights. Any time a phrase with the MAX keyword is matched, the message is given an SCL of 9 regardless of any other weights. Any time there is both MIN and MAX matches for one message, the message is given an SCL of 0. |
Text | The word or phrase is specified here (supports Unicode phrases up to 1,000 characters) |
When you have created the registry key shown in figure above you need to restart the SMTP service in order to make the IMF update feature become effective.
The IMF updates will be available every first and third Wednesday of the month through Windows Update, Automatic Updates, WSUS and SMS technologies, and as you can see in following figure below the first IMF update is already available for approval via Windows Update, Automatic Updates as well as WSUS.
4）IMF integrate with Outlook
After a message makes it past server-based anti-spam defenses, the Outlook 2003 client can act on messages that have an SCL value greater than or equal to the store junk e-mail configuration setting in Intelligent Message Filter. Messages that exceed this server setting are sent to the junk e-mail folder in the Outlook 2003 inbox.
Outlook 2003 and Outlook Web Access for Exchange Server 2003 also allow users to create a list of safe senders from whom users always want to accept e-mail messages, as well as a list of blocked senders from whom users always want to reject e-mail messages. At the mailbox store, regardless of the SCL rating assigned to the message, Exchange delivers all messages from safe senders to the user"s inbox and all messages from blocked senders to the user"s junk e-mail folder. However, if the e-mail message has been blocked by the gateway threshold, it is not delivered to the user"s inbox because the message is never delivered to the mailbox store.
1） 配置SCL基准阀值和后续动作
