Training the bayesian engine and sa-learn {Scanned by HJMS}

[Chris Lyon]

On Wed, 3 Sep 2003 15:57:24 -0500, Furnish, Trever G <TGFurnish at HERFF-
JONES.COM> wrote:

>> From: Chris Lyon [mailto:cslyon at NETSVCS.COM]
>> Sent: Wednesday, September 03, 2003 3:46 PM
>>
>> The issue that I am having is that I have a bunch of users 500+ that
>> forward spam or non-spam to e-mail accounts that needed to be manualy
>> processed. (Management choice unfortunately)
>
>I would think having 500 users do anything is overkill. :-)
>
Believe me, I wish that I didn't have that overkill, headache, pain in the
A!@ problem. The issue is I don't want to do the work and as we put more
MailScanners in, then the workload gets greater.

>> So, what if the user forwards a mail to an account to get that sender
>> whitelisted?
>
>As I said, sa-learn doesn't impact whitelists or blacklists at all.  If you
>want to do that you'll have to script up something else.  Again though,
>almost certainly not a safe idea.
>
So, sa-learn won't do the whitelist or blacklist but I can get write a perl
script to get that done. So, grep the sender and put that into the
whitelist file. Seems an easy way to do it and if it creates problems for
the users, they created it so I won't feel so bad until I am made to fix
it. That is another issue.




>> -----Original Message-----
>> From: Chris Lyon [mailto:cslyon at NETSVCS.COM]
>> Sent: Wednesday, September 03, 2003 3:46 PM
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: Re: Training the bayesian engine and sa-learn
>> {Scanned by HJMS}
>>
>>
>> On Wed, 3 Sep 2003 15:03:35 -0500, Furnish, Trever G <TGFurnish at HERFF-
>> JONES.COM> wrote:
>>
>> >You're close - but sa-learn doesn't update whitelists or
>> blacklists - it
>> >just trains the Bayesian filtering engine, which identifies
>> patterns in
>> spam
>> >and uses them to recognize future spam.  SpamAssassin passes
>> messages to
>> the
>> >Bayesian engine and gets a score for each message, just as
>> it does for its
>> >other rules.  This score just becomes part of the cumulative
>> score for the
>> >message.
>> >
>> >There's a FAQ entry on how to set up a script to
>> automatically run sa-learn
>> >- sounds like you already found that.  If you have trouble
>> getting it to
>> >work, ask for help again.
>> >
>>
>> So it is just based on the content of the message. So, if
>> something doesn't
>> look right in the message, give it to sa-learn and it will
>> learn from that
>> e-mail.
>>
>> >Besides the bayesian filtering, you can also whitelist and blacklist
>> senders
>> >but I would hesitate to recommend automating that process -
>> I can imagine
>> >users blindly forwarding spam from the sobig virus to an
>> address that would
>> >automatically blacklist the sender, which would be a bad
>> thing since sobig
>> >is likely to come "from" someone who regularly emails you.
>> >
>> The issue that I am having is that I have a bunch of users 500+ that
>> forward spam or non-spam to e-mail accounts that needed to be manualy
>> processed. (Management choice unfortunately)
>>
>> So, what if the user forwards a mail to an account to get that sender
>> whitelisted?
>>
>>
>>
>> >HTH,
>> >Trever
>> >
>> >> -----Original Message-----
>> >> From: Chris Lyon [mailto:cslyon at NETSVCS.COM]
>> >> Sent: Wednesday, September 03, 2003 2:34 PM
>> >> To: MAILSCANNER at JISCMAIL.AC.UK
>> >> Subject: Training the bayesian engine and sa-learn
>> {Scanned by HJMS}
>> >>
>> >>
>> >> So, I have been reading the FAQ and also the past posts but
>> >> have a little
>> >> confusion that I need to resolve. Just to give a little back
>> >> ground, I have
>> >> a lot of users who all have issues with e-mail that is being
>> >> marked as spam
>> >> or not being marked as spam. So, I think the answer to this
>> >> is to have them
>> >> forward the messages to an unattended mailbox that will
>> >> autowhitelist or
>> >> autoblacklist the sender.  Is that what sa-learn is all about?
>> >>
>> >>
>> >> So, if I create a spam and non-spam account on server and use
>> >> the sa-learn
>> >> to check the messages that my users forward to these
>> >> accounts, if something
>> >> was marked as spam and is not, further messages will not be
>> >> marked again?
>> >> Conversely, if I have a message that is spam but not marked,
>> >> I can forward
>> >> that to spam and it will be marked as spam the next message
>> >> that comes in
>> >> from that sender?
>> >>
>> >>
>> >> How does it work, based on content I would assume or does it
>> >> work by the
>> >> domain? Also, what happens with stuff being forwarded from
>> >> different mail
>> >> clients like outlook?
>> >>
>> >>
>> >> Can anybody shed some light on this one?
>> >>
>>