Marcel wrote:
At 08:16 20-3-2004, you wrote:
I'm getting more and more spam that seems to be able to avoid the Bayes
rules. Typically they contain hundreds of nonsense words at the end. I've
gone from a false negative of less than one per 10,000 to where I get
10-15 each night. Has anyone else noticed this? Any suggestions?
I have Bayesian filtering disabled currently, and added a simple custom rule that catches most of these nonsense lines.
body RANDOMLINE_LOWERCASE /([a-z]{4,}\s{1,2}){30,}/
describe RANDOMLINE_LOWERCASE Long line of random words with no interpunction or capitals
I give it a fairly high score as well, something like 2.50, helps to push a lot of my spam over my threshold (5.0) and I haven't seen any false positives because of it.
I'd second Marcel's suggestion, although I still recommend bayes for a combined, layered approach. Add-on rules (i.e. the rules_du_jour set) are excellent at detecting any fixed patterns, and when new spam techniques come out, I find them highly effective. I use messages trapped by those rules to further train bayes, and I find that there are usually a few one will detect that the other won't. Together, bayes and regular rules combine to make spamassassin uniquely powerful.
- Bob
