shouldn't "spamc -L spam" always create BAYES_99?

[Jason Haar <Ja...@trimble.com>]

Hi there

We've got a problem with a tonne of spam getting BAYES_50 or even
BAYES_00. We're re-training SA using "spamc -L spam" but it doesn't seem
to do as much as we'd like. Sometimes it doesn't change the BAYES_
score, and other times it might go from BAYES_50 to BAYES_80

I think bayes is working (there's also a tonne of mail getting BAYES_99)
but I'm guessing there's some "learning logic" I'm not aware of to
explain why me telling SA "this is spam" doesn't seem to be entirely
listened to?

So my question is: shouldn't "-L spam"/"-L ham" always make SA re-train
the bayes more explicitly? Or is that really not possible with a single
email message? (ie it's a statistics thing). Just trying to understand
the backend :-)

-- 
Cheers

Jason Haar
Corporate Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Re: shouldn't "spamc -L spam" always create BAYES_99?

[Karsten Bräckelmann <gu...@rudersport.de>]

On Sun, 2014-09-07 at 09:09 +1200, Jason Haar wrote:
> We've got a problem with a tonne of spam getting BAYES_50 or even
> BAYES_00. We're re-training SA using "spamc -L spam" but it doesn't seem
> to do as much as we'd like. Sometimes it doesn't change the BAYES_
> score, and other times it might go from BAYES_50 to BAYES_80
> 
> I think bayes is working (there's also a tonne of mail getting BAYES_99)
> but I'm guessing there's some "learning logic" I'm not aware of to
> explain why me telling SA "this is spam" doesn't seem to be entirely
> listened to?

The Bayesian classifier operates on tokens, not messages. So while
training a message as spam is like "this is spam" as you put it,
according to Bayes it's "these tokens appear in spam".

For each token (think of it as words), the number of ham and spam they
appeared in and have been learned from are counted. The higher that
ratio is, the higher the probability of a message to be the same
classification for any given token found in later mail.


> So my question is: shouldn't "-L spam"/"-L ham" always make SA re-train
> the bayes more explicitly? Or is that really not possible with a single
> email message? (ie it's a statistics thing). Just trying to understand
> the backend :-)

It's statistics. Learning (increasing the number of ham or spam a token
has been seen in) has less effect for tokens seen about equally frequent
in both ham and spam, than if there already is a bias. Similarly, tokens
with high counts need more training to change overall probability, than
tokens less common in mail. IOW, words like "and" will never be a strong
spammyness indicator.


For more details on that entire topic of Bayes and training, I suggest
the sa-learn man page / documentation. For a closer look at the tokens
used for classification see the hammy/spammytokens Template Tags in the
M::SA::Conf docs. Both available here:

  http://spamassassin.apache.org/doc/

For ad-hoc debugging after training see the spamassassin --cf option to
add_header the token details without a need to actually add them to
every mail.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}