New technology that incorporates user feedback to identify unwanted commercial e-mail, or spam, will be offered in an update to Exchange Server 2003. Expected in the first half of 2004, the Exchange Intelligent Message Filter will identify spam based on characteristics of past e-mails that users have defined as spam. However, only customers who have purchased Software Assurance will receive the update.

Definitions Collected from Hotmail Users

The Intelligent Message Filter (IMF) uses Microsoft technology known as SmartScreen. Based on machine-learning technology developed by Microsoft Research, SmartScreen was beta-tested by 500,000 Hotmail users over the summer, and it has since been incorporated into Hotmail (which is also the back end for MSN's e-mail system) and Outlook 2003. However, the technology did not get the SmartScreen name until the Nov. 2003 Comdex trade show, when it was featured in the keynote speech given by Chief Software Architect Bill Gates.

IMF applies SmartScreen to Microsoft's e-mail server, Exchange. IMF is intended to be installed on a gateway server—that is, the mail server that sits at the perimeter of a company's e-mail network and refers incoming e-mail messages to other mail servers throughout the organization. This allows IMF to intercept spam as early as possible so that the spam doesn't waste valuable bandwidth or storage on other servers or users' desktops. Many companies, however, use a different type of e-mail server—such as Sendmail—as their gateway server. In these cases, Microsoft suggests that they add an Exchange 2003 Server configured as a "bridgehead" server between the gateway server and the other Exchange servers in the organization.

Once in place, IMF will use the characteristics submitted by the Hotmail testers to assign a rating, or spam confidence level, to each incoming e-mail—the higher the spam confidence level, the more likely the message is spam. Administrators can then set two thresholds, one at the gateway, and one at the user's mailbox on Exchange. If a message has a rating higher than the gateway threshold, the IMF will take a specified action, such as deleting it or forwarding it to an administrator for inspection. If a message makes it past the gateway threshold but has a rating higher than the inbox threshold, it will be delivered directly to recipients' junk mail folders, rather than their inboxes.

Administrators will be able to download periodic updates to the spam definitions, but these definitions will be based on ongoing responses from approximately 200,000 users participating in a Hotmail Feedback Loop program, rather than the organization's users. Administrators will not be able to access or control the spam definitions used by IMF—for instance, if the IMF continually intercepts a certain type of message that a company wants employees to receive, the company can only address this problem by lowering the gateway threshold or by adding those wanted senders to a list of safe senders (known in Exchange 2003 as a global accept list).

Availability and Resources

IMF will be released some time in 2004 and will be available at no extra charge to Exchange 2003 Standard or Enterprise customers who have purchased the Software Assurance (SA) upgrade plan on Exchange, including Client Access Licenses (CALs). Customers who fail to renew SA will continue to have the right to use IMF, but will not be able to download the updated spam definitions. Customers without SA will not be able to get IMF.

Microsoft's overview of IMF is at www.microsoft.com/exchange/techinfo/security/imfoverview.asp.

For background on other spam-filtering capabilities in Exchange 2003, see the July 2003 Research Report, "Exchange Server 2003, Outlook 2003 Enhance Mobility, Scalability, Security."

For background on spam-prevention features in Outlook 2003, see "Outlook Leads Office Suite Improvements" on page 15 of the Sept. 2003 Update.

For background on Microsoft's general anti-spam efforts, see "Antispam Alliance, Team Formed" on page 31 of the June 2003 Update.