You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Gregorics Tamás <ta...@mmcomputer.hu> on 2007/06/18 08:22:28 UTC

Bayes giving false positives

Hi!

I have a problem with bayes' scoring. It gave BAYES_99=3.5 to a mail 
which is not a spam. Unfortunately with this addition it reached my 
required score so it got classified as spam.

How can i fix this behavior? Only auto learning is enabled with the 
default threshold, no one could possibly feed it false data.

Thanks

Re: Bayes giving false positives

Posted by Kris Deugau <kd...@vianet.ca>.
Gregorics Tamás wrote:
> I have a problem with bayes' scoring. It gave BAYES_99=3.5 to a mail 
> which is not a spam. Unfortunately with this addition it reached my 
> required score so it got classified as spam.
> 
> How can i fix this behavior?

Tweak the autolearn thresholds a little.

> Only auto learning is enabled with the 
> default threshold,

This statement ...

> no one could possibly feed it false data.

... is in direct conflict with this one, IME.  The default thresholds 
*can* allow incorrect autolearning of very hammy spam, or spammy ham.

I'm not sure what the defaults are now, but I've run with 12 and -0.1 
for quite a while with very little trouble - previously, the default 
autolearn-as-ham threshold of 0.1 actually got a few very low-scoring 
spams learned as ham.  (around about SA2.55, IIRC)  And I *have* seen 
nominally legitimate email scoring in the 12-15 range on occasion.  :(

-kgd

Re: Bayes giving false positives

Posted by Theo Van Dinter <fe...@apache.org>.
On Mon, Jun 18, 2007 at 08:22:28AM +0200, Gregorics Tamás wrote:
> I have a problem with bayes' scoring. It gave BAYES_99=3.5 to a mail 
> which is not a spam. Unfortunately with this addition it reached my 
> required score so it got classified as spam.
> 
> How can i fix this behavior? Only auto learning is enabled with the 
> default threshold, no one could possibly feed it false data.

sa-learn --ham

auto-learn does a good job, but "learn on error" is always recommended.

-- 
Randomly Selected Tagline:
lp1 on fire
 (One of the more obfuscated kernel messages)