cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3870
Views
0
Helpful
2
Replies

Ironport filtering of "inappropriate" content

bnklein
Level 1
Level 1

I have been asked to review Ironport's ability to filter "inappropriate" content in email messages. 

I am familiar with Ironport's basic source based filtering capabilities based on a sender's reputation as well as its internal dictionaries and "secret sauce" such as that provided in Outbreak Filters.  Users also have the ability to create their own dictionaries along with message and content filters to perform their own content filtering.  However, I am not familiar with any category based filtering capability that would be the only way I could possibly define "inappropriate".  Examples I guess could be taken from the web filtering world such as pornography, adult subjects, violence, drugs, etc.

Users could create their own dictionaries and populate them with specific words those describing parts of the body, certain activities or vulgar language.  However I have found from experience with another email filter that a dictionary alone cannot solve the problem since it is the use of these words in context that is the issue (maybe with the exception of vulgar words).

Email filtering is like web filtering in that much of filtering is reputation based, but that is also where they are different.  The source of an email can be spoofed or its reputation hijacked simply by taking over a client using an authorized account on google.com, yahoo.com or outlook.com.  The reputation or categorization of a web site is more easily fixed.

Do any of you know how to document, enable, enhance or augment Ironport's abilities in the area of screening for "inappropriate" content.

Message was edited by: Ben Klein Interesting - The forum application filtered the word that began with the letter "p" followed by 3 letters and ography that descriptive of an undesirable category of message content, but not vulgar in itself.  This is a perfect example of the problem of filtering in this area.

2 Replies 2

Stephan Bayer
Cisco Employee
Cisco Employee

Hi Ben,

Automatic filtering takes place by the Ironport Antispam filter.

For a custom filter to match any words, the following article should be helpful:

How do I use content dictionaries with filters?

Knowledge Base Answer ID: 64

http://tools.cisco.com/squish/A018E

Hope this helps,

Stephan

Ben,

You're asking for some filtering that blocks things based on the categories you might find on the WSA right? Block all stuff coming from Porn/Adult/whatever...?

There aren't any "category" based filters in the ESA... might make an interesting feature request...

I've had a project on my desk for a while that sort of applies... The dictionairies that the ESA uses a can be regexes and I've got some "language" and "porn" filters from a defunct email product that have stuff like this:

    "bad word" and "teen badwording" and "otherbadword" within 5 "badword"

Doable but complex and time consuming... and you have to know regex better than I do...

For now we are using the profanity and sexual content dictionairies, set a few words to 0, and require 3 to hit to stop it...

If its a hit, we put it in the spam quarentine so the user can find it...   It catches enough to be useful.

Ken

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: