Platforms 2000/XP/2003/Vista/2008

Overview

Paranoid is a spam tester, whose algorithm grew up from bayesian approach (http://paulgraham.com/spam.html).

Using Bayes statistical analysis, in theory, is very effective for spam detection. But most of the modern spam detectors suffer from weak message parsers, that can easily be fooled by aggressive spammers, adding things like animated GIFs with noisy text, hidden text with CSS or filling email with irrelevant text — they are some of the many tricks or features meant to hide the real content from parsers.

Unfortunately for spammers, Paranoid is able to turn these tricks into the recognizable features. During the initial learning, Paranoid creates a feature space from legitimate messages, and all future deviations automatically become a new features. This doesn't mean, that totally different emails will be treated as spam, it only means that every deviation becomes a feature and it gains its own spam probability.

Paranoid analyses messages very carefully and generates the features from everything: e.g. message parts count and theirs dimension, if there's a prologue or epilogue, number of in-line pictures and theirs type and size, the color scheme of in-line GIF/PNG, the DOM scheme of HTML part, text size and visibility, how irregular text is streamed, the vowels quantity and how well they are "diluted" with consonants, and much more, including many text decoding algorithms and trivial words extraction. And all this happen only in few milliseconds, thanks to the fast routines, written in assembler.

Unlike SpamAssassin, that makes the decision, based on score — an integral index of miscellaneous spam tests, Paranoid uses the spam probability as a base unit for email ratings. In addition to the dynamic statistical algorithm, Paranoid also has the static heuristic tests, e.g. content charset, country checking, sender white/black lists. All this, including ability to automatically get rid of rare used tokens, make Paranoid live and adaptive.

Stats (more screen shots)

• Client-server architecture;
• Fast content analyzer: BASE64/QP/BINHEX/XX/UU/YEnc), HTML/DOM/CSS, image parser;
• Works with popular databases — MySQL, MS SQL Server;
• Self-cleaning algorithm — Paranoid periodically removes the obsolete information;
• Small dictionary size, ability to import/export and safely share your dictionary;
• Control Panel to manage token dictionaries per user or domain;
• TCP/IP-based protocol, similar to SMTP;
• COM-based protocol wrapper that can be used by software developers for mail server plug-ins. It can be used in any programming language supporting COM technology (ASP.NET, PHP, C#);