RE: spam getting through because of bayes confidence - SpamAssassin

This is a discussion on RE: spam getting through because of bayes confidence - SpamAssassin ; Kathryn Kleinschafer wrote: > Hi all, > > I have some spam coming into the system that seems to be only going > to a couple of domains. > The bayes confidence is 0-1% for the spam so it is ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: RE: spam getting through because of bayes confidence

  1. RE: spam getting through because of bayes confidence

    Kathryn Kleinschafer wrote:
    > Hi all,
    >
    > I have some spam coming into the system that seems to be only going
    > to a couple of domains.
    > The bayes confidence is 0-1% for the spam so it is getting a -2.6. It
    > is hitting on the following rules
    > -2.60 BAYES_00 Bayesian spam probability is 0 to 1%
    > -0.19 CRM114_CHECK
    > 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
    > 0.00 DIGEST_MULTIPLE Message hits more than one network digest

    check
    > 0.50 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
    > 0.50 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
    > 1.96 RCVD_IN_BL_SPAMCOP_NET Received via a relay in bl.spamcop.net
    > 2.08 SUBJ_ALL_CAPS Subject is all capitals
    >
    >
    > The subject line is always REMINDER NOTIFICATION
    >
    > In order to get it recognised as spam am I best to have a custom rule
    > for the subject line?
    > If so can someone tell me what the rule might look like (i have never
    > written custom rules)


    BAYES_00 means that the bayes engine thinks the message is definitely
    not spam. If this rule is hitting on spam messages, you have a problem.
    Unless this is just a really hammy looking spam, you may want to
    consider retraining your bayes database. And regardless, you should
    always manually retrain bayes with any messages that you catch being
    misclassified.

    --
    Bowie


  2. Re: spam getting through because of bayes confidence

    > BAYES_00 means that the bayes engine thinks the message is definitely
    > not spam. If this rule is hitting on spam messages, you have a problem.
    > Unless this is just a really hammy looking spam, you may want to
    > consider retraining your bayes database. And regardless, you should
    > always manually retrain bayes with any messages that you catch being
    > misclassified.


    Generally, you should always train *all* messages that were not trained
    already. Even mail that was classified correctly. This makes the
    database definitely more stable than only training a few misclassified
    messages.

    The only mail you should omit is mail that was already auto-learned
    correctly, bounces, backscatter and generally most of the auto-generated
    stuff (DSN's, statistic reports, cron reports...)

    Tschau
    Alex


  3. Re: spam getting through because of bayes confidence

    Alex Woick wrote:
    >> BAYES_00 means that the bayes engine thinks the message is definitely
    >> not spam. If this rule is hitting on spam messages, you have a problem.
    >> Unless this is just a really hammy looking spam, you may want to
    >> consider retraining your bayes database. And regardless, you should
    >> always manually retrain bayes with any messages that you catch being
    >> misclassified.

    >
    > Generally, you should always train *all* messages that were not
    > trained already. Even mail that was classified correctly. This makes
    > the database definitely more stable than only training a few
    > misclassified messages.


    well, training on error is easier to implement: you can get users to
    report errors. it's harder to get them confirm the filter decision.

    >
    > The only mail you should omit is mail that was already auto-learned
    > correctly, bounces, backscatter and generally most of the
    > auto-generated stuff (DSN's, statistic reports, cron reports...)
    >
    > Tschau
    > Alex



+ Reply to Thread