使用Exchange IMF引擎过滤垃圾邮件

Intelligent Message Filter (IMF) is a content filter designed specifically for Exchange. It is based on patented machine-learning technology from Microsoft Research known as Microsoft SmartScreen® technology. SmartScreen is currently used by MSN, Microsoft Hotmail®, Microsoft Office Outlook® 2003, and Exchange. IMF was designed to distinguish between characteristics of legitimate e-mail messages and spam, based on millions of messages. IMF can make an accurate assessment of the probability that an incoming e-mail message is either a legitimate message or spam. Unlike many other filtering technologies, IMF uses characteristics from a statistically sound sample of e-mail messages. In addition to spam, the inclusion of legitimate messages in this sample reduces the likelihood of mistakes. Because IMF recognizes characteristics of both legitimate and UCE messages, the accuracy of IMF is increased.

Intelligent Message Filter is installed on Exchange servers that accept inbound SMTP messages from the Internet. When an external user sends e-mail messages to an Exchange server with IMF installed, the IMF evaluates the textual content of the messages and assigns each message a rating based on the probability that the message is spam. This rating ranges from 1 to 9 and is stored as a message property known as the spam confidence level (SCL) rating. This rating is persisted with the message when the message is sent to other Exchange servers.

After Intelligent Message Filter has assigned an SCL to the message, it is evaluated against two thresholds configured by the administrator as follows:

1.       Gateway blocking configuration: Block messages with an SCL rating greater than or equal to. If the SCL of a message is greater than or equal to the value set here, one of the following actions can be performed on the message :

a.       Archive

b.       Delete

c.       No action

d.       Reject

2.       Store junk e-mail configuration: Move messages with an SCL rating greater than. If the message is greater than the value set here, the message will be delivered to the junk e-mail folder of the user’s inbox, unless the user has the sender on their safe senders list.

2）Custom Weighting Feature in IMF V2

IMF version 2 includes a completely new feature called the Custom Weighting Feature (CWF), which allows you to customize IMF even further. With CWF you can filter e-mail messages based on specific phrases within the body of the messages, the subject line or both. As is the case with some of the other Exchange 2003 SP2 features such as MAPI access per user and the database size limit changes, customization to the CWF cannot be done via the user interface. Instead you need to make changes directly in an associated .xml file (MSExchange.UceContentFilter.xml). The .xml file is read by IMF version 2 upon initialization, and then reloaded every time it’s modified. The MSExchange.UceContentFilter.xml file you create should be saved under the following path: 

Before you can make use of the CWF you need to register the MSExchange.UceContentFilter.dll file, you do this by opening a command prompt then issue the following command:

regsvr32 Drive_letter:\Program Files\Exchsrvr\bin\MSCFV2\MSExchange.UceContentFilter.dll

When the MSExchange.UceContentFilter.dll file has been registered you can start to add words or phrases to the MSExchange.UceContentFilter.xml, normally Notepad would be sufficient for this task (just make sure you save the file as a .xml in the Unicode format!)

Below is an example of specific phrases and values you can use in the MSExchange.UceContentFilter.xml file.

<?xml version="1.0" encoding="UTF-16"?>
<CustomWeightEntries xmlns="http://schemas.microsoft.com/2005/CustomWeight">
     <CustomWeightEntry Type="BODY" Change="1" Text="Tortured with health problems?"/>
     <CustomWeightEntry Type="BODY" Change="-2" Text=" Cigar Sampler and Bonus Gifts for Xmas"/>
     <CustomWeightEntry Type="BODY" Change=”4" Text="Special offer"/>
     <CustomWeightEntry Type="BODY" Change="-7" Text="Gratis piller"/>
     <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="Free Pills"/>
     <CustomWeightEntry Type="BOTH" Change="MAX" Text="Cheap Viagra"/>
</CustomWeightEntries>

In Table below I have listed each CWF value which can be used in the MSExchange.UceContentFilter.xml file.

Value	Description
Type=”BODY”	Search for value specified in text in the BODY field of the message
Type=”SUBJECT”	Search for value specified in text in the SUBJECT field of the message
Type=”BOTH”	Search for value specified in text in the BODY and SUBJECT field of the message
Change	The Change value is used to define what effect a matched word or phrase will have on the SCL score of a message. The Change can be any integer value. Should the word or phrase be matched, the change integer value will be added to the original SCL value. Should the value exceed the supported SCL value, it will be normalized to a 0 to 9 range. In addition to the Change can also use the MIN or MAX keywords. Any time a phrase with the MIN keyword is matched, the message is given an SCL of 0 regardless of any other weights. Any time a phrase with the MAX keyword is matched, the message is given an SCL of 9 regardless of any other weights. Any time there is both MIN and MAX matches for one message, the message is given an SCL of 0.
Text	The word or phrase is specified here (supports Unicode phrases up to 1,000 characters)

Table: Custom Weighting Feature Values

Note:
If Event ID 7514 (Description: An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004005) is logged in the Application log after you enabled the custom word list feature in Intelligent Message Filter version 2 on a server that is running Exchange Server 2003 Service Pack 2, chances are it’s because you saved the MSExchange.UceContentFilter.xml file in ANSI format, you should instead save it in Unicode format, for detailed steps on how you resolve this issue, see MS KB article 907970.

3）IMF automatically upgrade feature

In order to automatically receive IMF updates via Windows Update (or WSUS), you must enable the IMF update feature by creating a registry key. You create a DWORD registry key named ContentFilterState under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange

Like with many other registry key, you need to enable it by entering 1 in the Data value field as shown in figure below.

When you have created the registry key shown in figure above you need to restart the SMTP service in order to make the IMF update feature become effective.

The IMF updates will be available every first and third Wednesday of the month through Windows Update, Automatic Updates, WSUS and SMS technologies, and as you can see in following figure below the first IMF update is already available for approval via Windows Update, Automatic Updates as well as WSUS.

4）IMF integrate with Outlook

After a message makes it past server-based anti-spam defenses, the Outlook 2003 client can act on messages that have an SCL value greater than or equal to the store junk e-mail configuration setting in Intelligent Message Filter. Messages that exceed this server setting are sent to the junk e-mail folder in the Outlook 2003 inbox.

Outlook 2003 and Outlook Web Access for Exchange Server 2003 also allow users to create a list of safe senders from whom users always want to accept e-mail messages, as well as a list of blocked senders from whom users always want to reject e-mail messages. At the mailbox store, regardless of the SCL rating assigned to the message, Exchange delivers all messages from safe senders to the user's inbox and all messages from blocked senders to the user's junk e-mail folder. However, if the e-mail message has been blocked by the gateway threshold, it is not delivered to the user's inbox because the message is never delivered to the mailbox store.

If a user is running an earlier version of Outlook, the safe senders and blocked senders lists are not available. Any message marked as spam is delivered directly to the user's inbox. Users with earlier versions of Outlook can use Outlook Web Access to define safe and blocked sender lists.

2． IMF配置和微调步骤

1） 配置SCL基准阀值和后续动作

建议从SCL7开始，并设置后续动作为归档（Archive）。

 

2） 配置客户端Junk mail文件夹基准阀值

 

 

3） 调整服务器端归档邮件保存文件夹路径

 

归档文件夹默认在"program files\exchsrv\mailroot\vsi <#>\UceArchive" 目录中。其中的"#"是IMF配置的SMTP虚拟服务器节点编号，默认为1。

可以将该存档目录移动到一个空闲空间大的硬盘上，要移动该目录，请编辑如下注册表：
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter
在此键下新增加一个STRING型的键，叫"ArchiveDir"，其值为目录的全路径，如"E:\Archive"

 

4） 配置注册表进行微调

 

配置IMF在保存邮件时一同保存邮件的SCL等级,要使IMF自动保存SCL,请修改如下注册表:
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter
增加一个DWord的键叫"ArchiveSCL"值为"1".

 

5） 在SMTP虚拟服务器上启用IMF

 

6） 配置自定义脏话字典

 

按照要求更改MSExchange.UceContentFilter.xml文件，并根据业务情况定期调整关键字。

 

3．IMF归档邮件察看和处理步骤

IMF归档管理器提供图形界面帮助管理员管理被IMF阻拦的归档邮件.该程序以C#编写,可在以下地址下载:
http://www.gotdotnet.com/workspaces/workspace.aspx?id=e8728572-3a4e-425a-9b26-a3fda0d06fee

执行其中的EXE文件,系统提示输入PICKUP目录和UCE归档目录位置

接着系统出现程序界面

IMF归档管理器允许你查看邮件的实际的SCL值,以便管理员可以依据本单位实际情况,确定合适的IMF阻拦策略.

4．IMF日常维护和排错建议

1）  根据实际情况调整SCL阀值

2）  定期更新IMF的过滤引擎和定义文件

3）  定期删除UCE目录下归档的垃圾邮件

 

5．参考资料

 

Microsoft Safety
http://www.microsoft.com/mscorp/safety/default.mspx

How to configure connection filtering to use Real-time Block Lists (RBLs) and how to configure recipient filtering in Exchange 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;823866

Introduction to the Microsoft Exchange Intelligent Message Filter Deployment Guide
http://www.microsoft.com/technet/prodtechnol/exchange/guides/IMFDeploy/dbb65d96-b763-46a3-9942-41d5a23c2676.mspx

FrontBridge, a Microsoft subsidiary
http://www.microsoft.com/exchange/evaluation/fbridge

http://www.frontbridge.com

Exchange Intelligent Message Filter
http://www.microsoft.com/downloads/details.aspx?FamilyID=c1b08f7b-8caf-4147-b074-8c9c8f277071&DisplayLang=en

Exchange Server 2003 SP2 Overview
http://www.microsoft.com/exchange/downloads/2003/sp2/overview.mspx  

Anti-Phishing Technologies
http://www.microsoft.com/mscorp/safety/technologies/antiphishing/default.mspx

Sender ID
http://www.microsoft.com/mscorp/safety/technologies/senderid/default.mspx

SMTP tar pit feature for Microsoft Windows Server 2003
http://go.microsoft.com/fwlink/?LinkId=3052&kbid=842851

Help Prevent Junk E-Mail Message with Outlook 2003
http://www.microsoft.com/office/editions/prodinfo/junkmail.mspx