This description: On Thu, 2017-07-13 at 15:07 +0100, Martin Gregorie wrote: > I'm continuing to get good results from a multi-level approach: > > I use two or more subrules with low scores (0.01 or so) that are > combined by an AND relation in a meta-rule that triggers a suitably > spammy score when all subrules get hits. > > The subrules are typically automatically assembled lists of words or > phrases - automatically assembled because that makes maintenance > vastly > easier. The list contents are typically words and phrases found in > spam, e.g. one list might be selling phrases such as "get you rocks > off > with" that are unlikely to appear in personal or legit commercial mail > and another might be names or slang terms for less common > pharmaceuticals.
and what David Jones has been describing in this thread of identifying specific combinations of rules (his based on reputation vs. content) both remind me of the description of Marc Perkel's "evolution filter", which from memory identified sets of rules which are very indicative of ham/spam. Both David and Martin are reporting good success, as did Marc - maybe worth looking into implementing in spamassassin? Does masscheck automate meta rule creation? (ie. not just generate scores) Not the full "evolution filter" idea which would have to run on the endpoint, but that would benefit everyone via rule updates. -- Jesse Norell Kentec Communications, Inc. 970-522-8107 - www.kci.net
