Lots of spam gets through because of BAYES_00 -2.60

[Chris W. Parker]

I think that's probably a pretty good assessment of a corporate
environment.

What are the numbers at the end of the score? Is that the percentage of
certainty that bayes has for the email that it is NOT spam?


Thanks,
Chris.

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Gareth
Sent: Tuesday, September 11, 2007 10:51 AM
To: MailScanner discussion
Subject: RE: Lots of spam gets through because of BAYES_00 -2.60

Personally I find that it is very difficult to make bayes particularly
effective in a corporate enviroment because of the variety of mails
people receive. Therefore I find the low scoring bayes rules give a far
to big a negative score.  I tend to overise the low and high scores with
the following :-
 
score BAYES_00 -0.5
score BAYES_05 -0.1
score BAYES_20 -0.01
score BAYES_40 -0.01
score BAYES_99  5.0

	-----Original Message-----
	From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Chris W.
Parker
	Sent: 11 September 2007 18:43
	To: MailScanner discussion
	Subject: Lots of spam gets through because of BAYES_00 -2.60
	
	
	Hello,
	 
	I've got (at least) one user who has a strange spam problem.
They receive a lot spam all day long but it's usually the same three to
four types. It's either about a "JC Penney order confirmation #nnnnnn"
(false), a "for dummies" book ads, or "airline flight reservation
confirmation" (false of course).
	 
	In almost all emails she receives there is BAYES_00 -2.60 in the
spam score. I guess this means that the bayes database is really
confident they're not spam. But too bad it's wrong! So this usually ends
up putting the email below the threshold for possible spam (4.5).
	 
	What action should I take to remedy this? Is there a way to
train the bayes database for these messages? Or feed the bayes database
some strings (like the ones above) so that it scores them more
accurately?
	 
	Another option I though of is to make my own SA rules to offset
the incorrect bayes score but I don't really like that option because it
requires me to maintain a list of fixes for the bayes test "mistakes".
	 
	 
	 
	Thanks!

	Chris Parker
	Aardvark Tactical, Inc.
	IT Manager
	1002 W Tenth St. Azusa, CA 91702
	phone: 800.997.3773 x131 fax: 626.334.6860
	cparker at swatgear.com

	 <http://www.swatgear.com/sig_logo_rsml.gif>