RE: AWL aging? - SpamAssassin

This is a discussion on RE: AWL aging? - SpamAssassin ; Greg Never found awl much good in a multi-user setup. Seems very variable - works For some, not for others. I get wayoo many false negatives with it as the spammers use the same 'from' quite a few times, so ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: RE: AWL aging?

  1. RE: AWL aging?

    Greg
    Never found awl much good in a multi-user setup. Seems very variable - works For some, not for others.

    I get wayoo many false negatives with it as the spammers use the same 'from' quite a few times, so the address makes it io the awl db.


    Ymmv as they say.
    --
    martin

    -----Original Message-----
    From: Greg Troxel
    Sent: Friday, May 30, 2008 9:22 PM
    To: users@spamassassin.apache.org
    Subject: AWL aging?

    I have recently understood AWL better, and am wondering if there should
    be some minimum number of entries before AWL is applied. I often get
    spam that doesn't score that high due to being a fresh relay. If I
    rescore it with '|spamassassin -t' after a few days, often it's on
    blacklists and scores a lot higher, but is pulled down by AWL.

    So, I wonder if a rule that said 'AWL is only applied if there are >=5
    scores in the average' would avoid giving credit for spam that arrived
    when it wasn't classified as high as it should be now.


    ************************************************** ********************
    Confidentiality : This e-mail and any attachments are intended for the
    addressee only and may be confidential. If they come to you in error
    you must take no action based on them, nor must you copy or show them
    to anyone. Please advise the sender by replying to this e-mail
    immediately and then delete the original from your computer.
    Opinion : Any opinions expressed in this e-mail are entirely those of
    the author and unless specifically stated to the contrary, are not
    necessarily those of the author's employer.
    Security Warning : Internet e-mail is not necessarily a secure
    communications medium and can be subject to data corruption. We advise
    that you consider this fact when e-mailing us.
    Viruses : We have taken steps to ensure that this e-mail and any
    attachments are free from known viruses but in keeping with good
    computing practice, you should ensure that they are virus free.

    Red Lion 49 Ltd T/A Solid State Logic
    Registered as a limited company in England and Wales
    (Company No:5362730)
    Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
    United Kingdom
    ************************************************** ********************


  2. Re: AWL aging?

    martinh@solidstatelogic.com ("Martin.Hepworth") writes:

    > Greg
    > Never found awl much good in a multi-user setup. Seems very variable - works For some, not for others.
    >
    > I get wayoo many false negatives with it as the spammers use the
    > same 'from' quite a few times, so the address makes it io the awl
    > db.


    The AWL seems to be a rather frequent source of email.

    There is only one wee little problem with AWL. The problem is the
    score chosen for AWL. The score is computed in AWL.pm as

    $delta = ($meanscore - $awlpoints) * $pms->{main}->{conf}->{auto_whitelist_factor};

    This default score means that scores will be pushed toward the mean
    of previous email messages from the same sender. I think this is
    backwards. The goal is to use the information from previously
    processed email messages to tell if the current message is spam or
    ham. The goal should not be to make the current message be like
    messages received in the past.

    So, I think the AWL score should be computed as a percentage of the
    previous score:

    $delta = ($meanscore) * $pms->{main}->{conf}->{auto_whitelist_factor};

    With this change AWL acts like a whitelist rather than a random number
    generator. Known hammy senders will get negative awl scores. The
    (very few) known spammy senders will get a positive awl score. Most
    spam is used with random email addresses, so AWL rarely hits on spam.

    Anyway, both behaviors could be accommodated by adding a 0/1 flag like
    auto_whitelist_regress. Then the delta score could be computed as:

    $delta = ($meanscore - $pms->{main}->{conf}->{auto_whitelist_regress}*$awlpoints) * $pms->{main}->{conf}->{auto_whitelist_factor};

    Setting auto_whitelist_regress to 1 would get the current (wrong)
    behavior, and setting auto_whitelist_regress to 0 would get the
    behavior I think is correct.
    -jeff



    > Ymmv as they say.
    > --
    > martin
    >
    > -----Original Message-----
    > From: Greg Troxel
    > Sent: Friday, May 30, 2008 9:22 PM
    > To: users@spamassassin.apache.org
    > Subject: AWL aging?
    >
    > I have recently understood AWL better, and am wondering if there should
    > be some minimum number of entries before AWL is applied. I often get
    > spam that doesn't score that high due to being a fresh relay. If I
    > rescore it with '|spamassassin -t' after a few days, often it's on
    > blacklists and scores a lot higher, but is pulled down by AWL.
    >
    > So, I wonder if a rule that said 'AWL is only applied if there are >=5
    > scores in the average' would avoid giving credit for spam that arrived
    > when it wasn't classified as high as it should be now.


+ Reply to Thread