1． IMF技术简介
Intelligent Message Filter (IMF) is a content filter designed specifically for Exchange. It is based on patented machine-learning technology from Microsoft Research known as Microsoft SmartScreen%26reg; technology. SmartScreen is currently used by MSN, Microsoft Hotmail%26reg;, Microsoft Office Outlook%26reg; 2003, and Exchange. IMF was designed to distinguish between characteristics of legitimate e-mail messages and spam, based on millions of messages. IMF can make an accurate assessment of the probability that an incoming e-mail message is either a legitimate message or spam. Unlike many other filtering technologies, IMF uses characteristics from a statistically sound sample of e-mail messages. In addition to spam, the inclusion of legitimate messages in this sample reduces the likelihood of mistakes. Because IMF recognizes characteristics of both legitimate and UCE messages, the accuracy of IMF is increased.
Intelligent Message Filter is installed on Exchange servers that accept inbound SMTP messages from the Internet. When an external user sends e-mail messages to an Exchange server with IMF installed, the IMF evaluates the textual content of the messages and assigns each message a rating based on the probability that the message is spam. This rating ranges from 1 to 9 and is stored as a message property known as the spam confidence level (SCL) rating. This rating is persisted with the message when the message is sent to other Exchange servers.
After Intelligent Message Filter has assigned an SCL to the message, it is evaluated against two thresholds configured by the administrator as follows:
1. Gateway blocking configuration: Block messages with an SCL rating greater than or equal to. If the SCL of a message is greater than or equal to the value set here, one of the following actions can be performed on the message :
a. Archive
b. Delete
c. No action
d. Reject
2. Store junk e-mail configuration: Move messages with an SCL rating greater than. If the message is greater than the value set here, the message will be delivered to the junk e-mail folder of the user’s inbox, unless the user has the sender on their safe senders list.
2）Custom Weighting Feature in IMF V2
IMF version 2 includes a completely new feature called the Custom Weighting Feature (CWF), which allows you to customize IMF even further. With CWF you can filter e-mail messages based on specific phrases within the body of the messages, the subject line or both. As is the case with some of the other Exchange 2003 SP2 features such as MAPI access per user and the database size limit changes, customization to the CWF cannot be done via the user interface. Instead you need to make changes directly in an associated .xml file (MSExchange.UceContentFilter.xml). The .xml file is read by IMF version 2 upon initialization, and then reloaded every time it’s modified. The MSExchange.UceContentFilter.xml file you create should be saved under the following path:
Drive_letter:\Program Files\Exchsrvr\bin\MSCFV2
Value | Description |
Type=”BODY” | Search for value specified in text in the BODY field of the message |
Type=”SUBJECT” | Search for value specified in text in the SUBJECT field of the message |
Type=”BOTH” | Search for value specified in text in the BODY and SUBJECT field of the message |
Change | The Change value is used to define what effect a matched word or phrase will have on the SCL score of a message. The Change can be any integer value. Should the word or phrase be matched, the change integer value will be added to the original SCL value. Should the value exceed the supported SCL value, it will be normalized to a 0 to 9 range. In addition to the Change can also use the MIN or MAX keywords. Any time a phrase with the MIN keyword is matched, the message is given an SCL of 0 regardless of any other weights. Any time a phrase with the MAX keyword is matched, the message is given an SCL of 9 regardless of any other weights. Any time there is both MIN and MAX matches for one message, the message is given an SCL of 0. |
Text | The word or phrase is specified here (supports Unicode phrases up to 1,000 characters) |
If Event ID 7514 (Description: An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004005) is logged in the Application log after you enabled the custom word list feature in Intelligent Message Filter version 2 on a server that is running Exchange Server 2003 Service Pack 2, chances are it’s because you saved the MSExchange.UceContentFilter.xml file in ANSI format, you should instead save it in Unicode format, for detailed steps on how you resolve this issue, see MS KB article 907970.
When you have created the registry key shown in figure above you need to restart the SMTP service in order to make the IMF update feature become effective.
The IMF updates will be available every first and third Wednesday of the month through Windows Update, Automatic Updates, WSUS and SMS technologies, and as you can see in following figure below the first IMF update is already available for approval via Windows Update, Automatic Updates as well as WSUS.
4）IMF integrate with Outlook
After a message makes it past server-based anti-spam defenses, the Outlook 2003 client can act on messages that have an SCL value greater than or equal to the store junk e-mail configuration setting in Intelligent Message Filter. Messages that exceed this server setting are sent to the junk e-mail folder in the Outlook 2003 inbox.
Outlook 2003 and Outlook Web Access for Exchange Server 2003 also allow users to create a list of safe senders from whom users always want to accept e-mail messages, as well as a list of blocked senders from whom users always want to reject e-mail messages. At the mailbox store, regardless of the SCL rating assigned to the message, Exchange delivers all messages from safe senders to the user's inbox and all messages from blocked senders to the user's junk e-mail folder. However, if the e-mail message has been blocked by the gateway threshold, it is not delivered to the user's inbox because the message is never delivered to the mailbox store.
1） 配置SCL基准阀值和后续动作
可以将该存档目录移动到一个空闲空间大的硬盘上，要移动该目录，请编辑如下注册表：
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter
在此键下新增加一个STRING型的键，叫"ArchiveDir"，其值为目录的全路径，如"E:\Archive"
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter
增加一个DWord的键叫"ArchiveSCL"值为"1".
http://www.gotdotnet.com/workspaces/workspace.aspx?id=e8728572-3a4e-425a-9b26-a3fda0d06fee
执行其中的EXE文件,系统提示输入PICKUP目录和UCE归档目录位置
接着系统出现程序界面
IMF归档管理器允许你查看邮件的实际的SCL值,以便管理员可以依据本单位实际情况,确定合适的IMF阻拦策略.
http://www.microsoft.com/mscorp/safety/default.mspx
http://support.microsoft.com/default.aspx?scid=kb;en-us;823866
http://www.microsoft.com/technet/prodtechnol/exchange/guides/IMFDeploy/dbb65d96-b763-46a3-9942-41d5a23c2676.mspx
http://www.microsoft.com/exchange/evaluation/fbridge
http://www.microsoft.com/downloads/details.aspx?FamilyID=c1b08f7b-8caf-4147-b074-8c9c8f277071%26amp;DisplayLang=en
http://www.microsoft.com/exchange/downloads/2003/sp2/overview.mspx
http://www.microsoft.com/mscorp/safety/technologies/antiphishing/default.mspx
http://www.microsoft.com/mscorp/safety/technologies/senderid/default.mspx
http://go.microsoft.com/fwlink/?LinkId=3052%26amp;kbid=842851
http://www.microsoft.com/office/editions/prodinfo/junkmail.mspx
更多内容请看垃圾邮件专题、邮件服务器专题、反垃圾邮件方法专题，或进入讨论组讨论。
相关专题
- 用Foxmail Server搭建邮件服务器 (1761次浏览)
- 用MDaemon搭建邮件服务器 (1635次浏览)
- 邮件服务器IMail教程 (1578次浏览)
- 创建企业级Internet邮件服务器 (813次浏览)
- 打造自己的个性化邮件服务器 (412次浏览)
- 发送邮件不求人 SMTP也可DIY (331次浏览)
- 雷鸟Thunderbird 邮件客户端软件新力量 (176次浏览)
- 秘籍：把邮箱DIY为网络U盘 (142次浏览)
- 发送邮件直接访问服务器IP (137次浏览)
- 领略Web邮箱伴侣的风采 (128次浏览)
