Lots of spam gets through because of BAYES_00 -2.60

[Gareth]

Personally I find that it is very difficult to make bayes particularly
effective in a corporate enviroment because of the variety of mails people
receive. Therefore I find the low scoring bayes rules give a far to big a
negative score.  I tend to overise the low and high scores with the
following :-

score BAYES_00 -0.5
score BAYES_05 -0.1
score BAYES_20 -0.01
score BAYES_40 -0.01
score BAYES_99  5.0
  -----Original Message-----
  From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Chris W.
Parker
  Sent: 11 September 2007 18:43
  To: MailScanner discussion
  Subject: Lots of spam gets through because of BAYES_00 -2.60


  Hello,

  I've got (at least) one user who has a strange spam problem. They receive
a lot spam all day long but it's usually the same three to four types. It's
either about a "JC Penney order confirmation #nnnnnn" (false), a "for
dummies" book ads, or "airline flight reservation confirmation" (false of
course).

  In almost all emails she receives there is BAYES_00 -2.60 in the spam
score. I guess this means that the bayes database is really confident
they're not spam. But too bad it's wrong! So this usually ends up putting
the email below the threshold for possible spam (4.5).

  What action should I take to remedy this? Is there a way to train the
bayes database for these messages? Or feed the bayes database some strings
(like the ones above) so that it scores them more accurately?

  Another option I though of is to make my own SA rules to offset the
incorrect bayes score but I don't really like that option because it
requires me to maintain a list of fixes for the bayes test "mistakes".



  Thanks!
  Chris Parker
  Aardvark Tactical, Inc.
  IT Manager
  1002 W Tenth St. Azusa, CA 91702
  phone: 800.997.3773 x131 fax: 626.334.6860
  cparker at swatgear.com


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070911/935de3ec/attachment.html