Tools: content scan

Principle: Look for known bad content

Virus scanners

• Signature list comparisons (hash or bruteforce)

• Ever-growing lists (100,000s of signatures)

Spam filters

• Signature based

• Rule based (spamassassin, dspam)

• Statistical methods (Bayes, Chi-Square, Geometric, and Markovian Discrimination)

Processor, memory intensive