Lots of spam gets through because of BAYES_00 -2.60

[Gareth]

Its the percentage certantity that it is spam. So BAYES_00 is 0% certain
that its spam.
The problem is that in corporate enviroments you dont generally
automatically learn known spam. The only learning that we do is on spam
which gets through (<0.1% for us) and which gets learn from the autolearn
feature.
The problem is that the default autolearn configuration only learns spam
with a score ov over 20 so there will be some types of spam which never get
learnt and therefore continue to get a low bayes score.
Thats why I advise using as many rules as possible even if only a few spam
get through. More rules means more spam with a score of over 20 so the more
effective bayes gets.

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Chris W.
> Parker
> Sent: 11 September 2007 19:25
> To: MailScanner discussion
> Subject: RE: Lots of spam gets through because of BAYES_00 -2.60
>
>
> I think that's probably a pretty good assessment of a corporate
> environment.
>
> What are the numbers at the end of the score? Is that the percentage of
> certainty that bayes has for the email that it is NOT spam?
>
>
> Thanks,
> Chris.
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Gareth
> Sent: Tuesday, September 11, 2007 10:51 AM
> To: MailScanner discussion
> Subject: RE: Lots of spam gets through because of BAYES_00 -2.60
>
> Personally I find that it is very difficult to make bayes particularly
> effective in a corporate enviroment because of the variety of mails
> people receive. Therefore I find the low scoring bayes rules give a far
> to big a negative score.  I tend to overise the low and high scores with
> the following :-
>
> score BAYES_00 -0.5
> score BAYES_05 -0.1
> score BAYES_20 -0.01
> score BAYES_40 -0.01
> score BAYES_99  5.0
>
> 	-----Original Message-----
> 	From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info]On Behalf Of Chris W.
> Parker
> 	Sent: 11 September 2007 18:43
> 	To: MailScanner discussion
> 	Subject: Lots of spam gets through because of BAYES_00 -2.60
>
>
> 	Hello,
>
> 	I've got (at least) one user who has a strange spam problem.
> They receive a lot spam all day long but it's usually the same three to
> four types. It's either about a "JC Penney order confirmation #nnnnnn"
> (false), a "for dummies" book ads, or "airline flight reservation
> confirmation" (false of course).
>
> 	In almost all emails she receives there is BAYES_00 -2.60 in the
> spam score. I guess this means that the bayes database is really
> confident they're not spam. But too bad it's wrong! So this usually ends
> up putting the email below the threshold for possible spam (4.5).
>
> 	What action should I take to remedy this? Is there a way to
> train the bayes database for these messages? Or feed the bayes database
> some strings (like the ones above) so that it scores them more
> accurately?
>
> 	Another option I though of is to make my own SA rules to offset
> the incorrect bayes score but I don't really like that option because it
> requires me to maintain a list of fixes for the bayes test "mistakes".
>
>
>
> 	Thanks!
>
> 	Chris Parker
> 	Aardvark Tactical, Inc.
> 	IT Manager
> 	1002 W Tenth St. Azusa, CA 91702
> 	phone: 800.997.3773 x131 fax: 626.334.6860
> 	cparker at swatgear.com
>
> 	 <http://www.swatgear.com/sig_logo_rsml.gif>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
>