Matt Kettler a écrit : >> I am thinking about this case: Joe the spammer bombs you with mail that >> is not detected as spam. he gets a negative awl. > That statement implies that there's a "score" for the user in the AWL. > > The AWL score varies with what the current messages pre-awl score. The > AWL can think a sender has a +50 average, ie: strong spam, and if a > message comes in that scores +100, the AWL will set itself to -25. > However, if the same message was 0 before the AWL ran, it would give it +25. > > Or were you talking about having a negative average because all the > messages sent as a bomb had negative scores? >
yes. not really a big deal. I took care of the miscreant, but I was trying to see if I could be less "aggressive" (and have an automated way to deal with this, so awl seemed a good place). >> so the questions are: >> >> - if user passes all the message to sa-learn, will that nuke the >> negative awl value? >> > sa-learn doesn't touch the AWL. At all. >> - is it enough to pass few messages? (in short, does "manual" training >> have more "weight" than automatic awl learning?) >> > There's no such thing as manual training of the AWL. Actually, there's > no such thing as "training" for it either. > > The AWL averages scores. nothing more, nothing less. The message score > is added when the message is scanned. The AWL has no concept of spam or > not, just what the historical average is. > I understand, but this may be thought of as a form of learning. not bayesian, but definitely an automatic learning method that learns the (partial) "reputation" of (ip, sender) pairs. > You can force fake messages with +100 scores in using spamassassin > --add-addr-to-blacklist, but that's not really "training" it's just > shoving the average around. >
