AirLive ES-6000 - Manual (Page 106)

105
6.2.6 Auto-Whitelist
Definition :
„ Auto-Whitelist Factor
‹ Obtained by dividing the Total Score (the amount of spam emails sent) by Count (the amount of
emails sent). It directly affects the Mean Score and also is the major factor that decides whether
an email is to be identified as spam.
„ Source IP
‹ The subnet belonging to the sender(s) of email
„ Count
‹ The total amount of emails sent from a specific subnet.
„ Total Score
‹ The total amount of spam emails sent from a specific subnet
„ Mean Score
‹ The value derived from the division of Total Score by Count
„ Details
‹ Displays all the email senders and their related statistics.
1. The Auto-Whitelist mechanism can evaluate whether an email is spam by assigning each email a
score based upon the current email’s spam score and the mean score history of the sender’s subnet. Higher
scores represent emails that are more likely to be spam.
2. Considering a sender may have sent an email from a different IP within the same subnet, thus they
are identified using both their address and the most significant two octets of their IP address by which
effectively helps avoid IP or email forgery.
3. The mean score of a sender is calculated by the sender’s subnet’s total score divided by the total
number of emails previously sent from the subnet. It is in direct ratio to Auto-Whitelist Factor, that is to say,
provided the factor is set with a high value then the mean score will be increased proportionately as well.
4. Under such a mechanism, a sender who had never previously sent spam but sends an email with a
high spam score could have the score reduced. For example, if a sender sent an email that scored 10, and
the factor was set to 0.4, then the mean score (-5 for instance) will push the score down to 4 (operation:
((-5)Ч0.4)+(10Ч0.6)) on the email sent.
5. On the contrary, even if an email is rated with a low score, it still has a possibility of being rated as
spam if the user’s subnet had previously sent emails with high spam ratings. For example, if a sender sent an
email that scored 2, and the factor was set to 0.4, then the mean score (20 for instance) will push the score up
to 9.2 (operation: (20Ч0.4)+(2Ч0.6)) on the email sent.