We have been seeing these for several weeks now, and SA's bayes
implementation handles it quite well. This from the Matt Kettler on the SA
list:
==========
How well bayes poison works depends a lot on your "bayes" implementation.
Some
"bayes" implementations are fairly susceptible to this. (I put "bayes" in
quotes because not all bayes implementations are really Bayesian at all.
Actually, most are not, including SA.)
In particular, the choice of combining algorithm seems to matter a lot. The
use
of chi-squared combining, instead of true Bayesian combining, seems to make
SA's
bayes rather resistant to this.
(note: the use of chi-squared is not exclusive to SA.. many "bayes"
implementations do this, but not all.)
Another area of influence is the choice of tokens. Words vs chars, hapaxes,
etc
all change how a bayes implementation reacts to poisoning attempts.
So spammers keep using bayes poison because it works in some cases. It also
doesn't really hurt them much, and sometimes even helps them, against more
resistant implementations.
==========
Bill
----- Original Message -----
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Wednesday, April 19, 2006 1:52 PM
Subject: [Declude.JunkMail] Madlibs as Bayesian algorithm frustrators
So... I had reason to dip into my spam folder today and found a message
that is using some kind of tool to generate madlibs, presumably to pad
the spam so that it seems like a normal message and perhaps to poison
antispam systems that use Bayesian analysis.
Assuming that your spam filter doesn't catch this message, check out
this paragraph for it's sheer wackiness:
If the self-loathing rattlesnake has a change of heart about the slyly
frightened fruit cake, then a buzzard returns home. When the umbrella is
unstable, a briar patch of the canyon accurately sells a pickup truck
for an
inferiority complex to a diskette near a bowling ball. A particle
accelerator about a mastadon earns frequent flier miles, and a fruit
cake
reaches an understanding with the carpet tack.
Andrew 8)
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
