RE: spam getting through because of bayes confidence - SpamAssassin
This is a discussion on RE: spam getting through because of bayes confidence - SpamAssassin ; Kathryn Kleinschafer wrote:
> Hi all,
>
> I have some spam coming into the system that seems to be only going
> to a couple of domains.
> The bayes confidence is 0-1% for the spam so it is ...
-
RE: spam getting through because of bayes confidence
Kathryn Kleinschafer wrote:
> Hi all,
>
> I have some spam coming into the system that seems to be only going
> to a couple of domains.
> The bayes confidence is 0-1% for the spam so it is getting a -2.6. It
> is hitting on the following rules
> -2.60 BAYES_00 Bayesian spam probability is 0 to 1%
> -0.19 CRM114_CHECK
> 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
> 0.00 DIGEST_MULTIPLE Message hits more than one network digest
check
> 0.50 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
> 0.50 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
> 1.96 RCVD_IN_BL_SPAMCOP_NET Received via a relay in bl.spamcop.net
> 2.08 SUBJ_ALL_CAPS Subject is all capitals
>
>
> The subject line is always REMINDER NOTIFICATION
>
> In order to get it recognised as spam am I best to have a custom rule
> for the subject line?
> If so can someone tell me what the rule might look like (i have never
> written custom rules)
BAYES_00 means that the bayes engine thinks the message is definitely
not spam. If this rule is hitting on spam messages, you have a problem.
Unless this is just a really hammy looking spam, you may want to
consider retraining your bayes database. And regardless, you should
always manually retrain bayes with any messages that you catch being
misclassified.
--
Bowie
-
Re: spam getting through because of bayes confidence
> BAYES_00 means that the bayes engine thinks the message is definitely
> not spam. If this rule is hitting on spam messages, you have a problem.
> Unless this is just a really hammy looking spam, you may want to
> consider retraining your bayes database. And regardless, you should
> always manually retrain bayes with any messages that you catch being
> misclassified.
Generally, you should always train *all* messages that were not trained
already. Even mail that was classified correctly. This makes the
database definitely more stable than only training a few misclassified
messages.
The only mail you should omit is mail that was already auto-learned
correctly, bounces, backscatter and generally most of the auto-generated
stuff (DSN's, statistic reports, cron reports...)
Tschau
Alex
-
Re: spam getting through because of bayes confidence
Alex Woick wrote:
>> BAYES_00 means that the bayes engine thinks the message is definitely
>> not spam. If this rule is hitting on spam messages, you have a problem.
>> Unless this is just a really hammy looking spam, you may want to
>> consider retraining your bayes database. And regardless, you should
>> always manually retrain bayes with any messages that you catch being
>> misclassified.
>
> Generally, you should always train *all* messages that were not
> trained already. Even mail that was classified correctly. This makes
> the database definitely more stable than only training a few
> misclassified messages.
well, training on error is easier to implement: you can get users to
report errors. it's harder to get them confirm the filter decision.
>
> The only mail you should omit is mail that was already auto-learned
> correctly, bounces, backscatter and generally most of the
> auto-generated stuff (DSN's, statistic reports, cron reports...)
>
> Tschau
> Alex
