On Fri, 7 Nov 2003, Robert Menschel wrote:
> Or better: what if we specified in the rule a maximum score to accumulate
> to? Maybe something like:
>
> accumbody T_SAMPLE /(?:word1|word2|word3|word4|word5)/i,max=2.5
> describe T_SAMPLE Message has medical words frequently used in spam
> score T_SAMPLE 0.5
>
> Each time any of the five words was used, it'd score 0.5, to a maximum
> score of 2.5. No matter how long the message was, this rule could not by
> itself cause an FP, and would work in conjunction only with other rules
> to flag something as spam.
A slight modification of the above idea, rather than 'max=2.5' have
'maxhits=5'. IE that particular rule fires no more than 5 times and then
the matching engine can drop it and move on to the next rule.
The final score would be 'nhits' * score. That way the matching engine
does not need to worry about any score calculations, just tallying up
number of matches.
There should also be a default implicit 'maxhits' value to keep the
matching process moving along and not slow things down too much. ;)
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
