> > why are those scores low? What gives them negative score? > > those rules have quite high score...
On 23.01.09 08:26, Dennis Hardy wrote: > Here is an example (without my rules): http://pastebin.com/m4400a74d X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_05,DCC_CHECK,DIET_1, SPF_HELO_PASS,SPF_PASS autolearn=no version=3.2.5 your BAYES is misfiring. Ths difference between BAYES_05 and BAYES_99 is 4.6 so you could have score of 5.7 if you'd have well-trained BAYES. > The ones that get through are relatively short and simple, and many are very > "clean". This example is just one that focuses on weight loss, some are > regarding tea or satellite companies or coffee makers or the like. I worry > about increasing FPs of real e-mails by training of "clean" spams as spam, > when they are short and sweet and many times look like they could be > legitimate e-mails. just train on them, and remember to train on clean mails (especially those which will start getting higher BAYES score). > Also would training bayes on this sort of e-mail help if many things are > different between each e-mail, and if the e-mail is so short and relatively > "clean"? Addresses change, company names change, sender domains are always > different, etc Iv you trained with enough of mail, it would help. However the result says similar mails were trasined as ham, which is what you should investigate and fix. on some mailboxes I keep trained ham/spam in special folders so I could whenever re-train or forget if anything was incorrect. > I've been thinking about maybe writing an SA plugin that counts the three > repeated URL patterns that are always present in all of these spams, but I > don't know where to start in trying to do that. I was hoping I could just > handle this with SA rules or something (like using another RBL or > something). more mails could give an idea what should be hit. Maybe a rule would be enough, not needed to create a plugin. But I'm sure BAYES training should be enough for this mail... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Support bacteria - they're the only culture some people have.
