----- "Matt Kettler" <[EMAIL PROTECTED]> wrote: --[ UxBoD ]-- wrote: > Hi, > > I just had this message get through :- > > <snip> > and it only scored 5.6. These are the rules it hit :- > > 1.23 ADVANCE_FEE_2 > 0.00 BAYES_50 > 0.72 SARE_URGBIZ Contains urgent matter > -0.00 SPF_PASS > 2.08 SUBJ_ALL_CAPS > 1.58 URG_BIZ > Looks like you might want to do some bayes training on that message. All the capitalized text should be an easy target. > I have my SA SPAM score to trigger on 6 and above. Do you think that is to > high ? or anyone know of a ruleset to raise the score on these ? >
Too high? no. Too high to expect there to be no missed spam, yes. Raising your threshold reduces false positives (nonspam tagged as spam), but it also increases your false negatives (spam that's missed). Lowering your score threshold has the opposite effect. When picking a threshold, you're making a trade-off.. Pick one based on what's important to you. Some folks run as high as 8.0, and others as low as 2.0. Both numbers are pretty extreme, but you get the idea. For reference, in the set3 mass-checks, going from 5.0 to 6.0 more halved the FPs (down to 45% of what they were at 5.0), but also increased FNs by 78%. The default 5.0 score is already pretty biased towards favoring FPs over FN's. The score assigner tries to tune the scores so at 5.0 there's roughly 100 times more FNs than FPs, while keeping both as low as possible. In practice it's more like 50 times more, but that's what it's trying for.. to quote STATISTICS-set3.txt from SA 3.2.4: # SUMMARY for threshold 5.0: # Correctly non-spam: 67508 99.94% # Correctly spam: 117303 98.51% # False positives: 42 0.06% # False negatives: 1780 1.49% > Hi Matt, Many thanks, that was a very helpful description. Regards, -- --[ UxBoD ]-- // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import" // Fingerprint: F57A 0CBD DD19 79E9 1FCC A612 CB36 D89D 2C5A 3A84 // Keyserver: www.keyserver.net Key-ID: 0x2C5A3A84 // Phone: +44 845 869 2749 SIP Phone: [EMAIL PROTECTED] > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
