Technology

Technology is a priority at Vade Retro. 60% of the team is dedicated to the research and development of the Vade Retro filtering core and to the integrative solutions.

Vade Retro filtering consists of several thousands of rules of different nature, each being applied to a message in order to deliver an elementary score.

Vade Retro Technology assets:

Processing is immediately efficient, no learning in needed
No connection to a server is required to analyse emails
Fast filtering proccessing (more than 200 emails per second)
Doesn't need a lot of system resources
Space-saving and universal development

Heuristic rules

Heuristic rules are empirical, non predictable rules derived from advanced analysis of all parts of a RFC-822 message: header fields, with a special mention for the subject text, plain text part if any, HTML part if any, attachment names and contents where applicable.
Heuristic rules are established by human experts searching for unexpected common features of various messages (especially when partly or entirely generated by robots), which will of necessity be shared by future spam, no matter the topic.
Deriving heuristic rules requires perfect command of all protocols involved in e-mail over the Internet, as well as deep knowledge of spamming nuts and bolts in general.
Human search for new heuristic rules is computer aided, with dedicated tools that have come of age along with the filter itself. New hypotheses are swiftly checked against new spam as well as against established spam and ham corpora. Though less frequent, negative score rules are of paramount importance in limiting "false positive" risk.

Predictive Heuristic Filter Thanks to the Predictive Heuristic Filter, Vade Retro technology is able to anticipate some unwanted emails and viruses before they spread. This new feature was designed to ensure protection against a new attack whereas other software publishers need time to update their antispam or antivirus engine.

Other features

Counter-reaction
Counter-reaction filtering is one of the most advanced and effective parts of the Vade Retro engine. It basically consists of detecting the nuts and bolts used by spammers to outsmart the anti-spam filters of the first generation.
Below is a joint list of first generation anti-spam techniques, spamming counter-techniques and Vade Retro counter-counter-techniques:

Anti-spam: blacklists of websites pointed to by links in messages
Spammers: redundant encoding of links
Vade Retro: redundant URL encoding detection

Anti-spam: message footprint -based filtering
Spammers: random string insertion to make no two message contents identical
Vade Retro: random string detection

Anti-spam: word association statistical (Bayesian) analysis
Spammers: adding neutral words, either readable or low-contrast / small print
Vade Retro: detection of unrelated word sequences, unreadable or barely readable text, excessive use of small print

Anti-spam: keyword -based filtering
Spammers: spelling changes within human readability and/or English phonetics
Vade Retro: detection of typical alterations to sensitive words and HTML tags. Vade Retro engine is able to detect hundreds of alterations for "viagra", from V1AGR4 to VVIAAGGRRIA to VIGRA , none of which being memory -stored as such

HTML patterns
Whenever there is an HTML part within a submitted RFC-822 message (which nowadays occurs more often than not), Vade Retro computes an exclusive HTML code footprint (HTML pattern), then compares it to a list of known patterns, demonstrably typical of generated spam. This technique, combined to statistics on the image sizes within, provide for a particularly effective filtering of spam mainly or exclusively made of online images.

Detection of forged SMTP timestamps and other header entries
Detection of forged Received: and other message header entries emerged in time as a major technique for detecting spam.

Anti-scam
Cyber-scam comes in various flavours, most often as carefully worded financial propositions, aimed at luring the addressee into supposedly overseas high-earners.
Vade Retro runs a dedicated scam detection module, as e-mail scam has little likeness to everyday, advertising spam.

A main engine with applications around it Diverse contexts of integration lead Vade Retro Technology to develop a unique and universal core which is not dependant on a specific solution. This way of working enables to update all solutions in a same time. Moreover it offers a high using leeway during specific implementations of the technology (Internet service providers, Webmails, routers, manufacturers, etc.).