You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2005/05/20 06:49:16 UTC
[Bug 4349] New: Add Count or Multiply scoring facility
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
Summary: Add Count or Multiply scoring facility
Product: Spamassassin
Version: unspecified
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: Bob@Menschel.net
Apologies if this idea which has floated several times dupes another bug report,
but I couldn't find one. Feel it's important to get this into the Futures queue.
It would be useful to be able to score some limited set of rules by how many
times they hit. Examples include obfuscation-detecting rules.
It would be good to provide some method of incorporating this into a rule,
perhaps in the score line, something like
score RULE_NAME 0.2*n
or
score RULE_NAME 1.5**n
where the formula could be any valid perl formula, and the count of hits would
replace "n" whereever used in the formula.
Just one idea -- many other options might work as well or better.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From matt@nightrealms.com 2005-07-02 02:12 -------
Created an attachment (id=2972)
--> (http://bugzilla.spamassassin.org/attachment.cgi?id=2972&action=view)
Proof of concept for a counting rule
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From matt@nightrealms.com 2005-06-03 23:42 -------
meta rules can do numerical comparisons and math, we could make rule types
specifically for counting, then store occurence count in
$perMsgStatus->{'tests_already_hit'} instead of true/false. Something like this:
count_body __COUNT_FOOBAR /foobar/i
meta FOOBAR00 ((__COUNT_FOOBAR > 1) && (__COUNT_FOOBAR < 10))
meta FOOBAR10 ((__COUNT_FOOBAR >= 10) && (__COUNT_FOOBAR < 20))
meta FOOBAR20 (__COUN_FOOBAR >= 20)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From matt@nightrealms.com 2005-06-04 01:40 -------
> Matthew, you've got the right idea, except that as currently implemented, each
> element in a meta expression is binary, yes/no, 1/0.
I'm pretty sure that values other than 1/0 can be stored in
$self->{'tests_already_hit'}->{'$token'}, which is what the meta tests refer to,
so it would simply require that do_count_tests() (or whatever) store the
number of occurences, instead of true/false.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
------- Additional Comments From jgmyers@proofpoint.com 2005-11-18 00:30 -------
What the flag does is allow a pattern rule to be evaluated more than once.
I don't like the "count" name as it doesn't imply removal of the only-once
restriction. Without the flag, the rule is counted, it's just only counted once.
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From felicity@kluge.net 2005-05-19 22:00 -------
Subject: Re: New: Add Count or Multiply scoring facility
On Thu, May 19, 2005 at 09:49:16PM -0700, bugzilla-daemon@bugzilla.spamassassin.org wrote:
> It would be useful to be able to score some limited set of rules by how many
> times they hit. Examples include obfuscation-detecting rules.
>
> It would be good to provide some method of incorporating this into a rule,
> perhaps in the score line, something like
>
> score RULE_NAME 0.2*n
> or
> score RULE_NAME 1.5**n
> where the formula could be any valid perl formula, and the count of hits would
> replace "n" whereever used in the formula.
IMO, this is better dealt with by a custom plugin, but a short list of
things that come to mind immediately if this were made "standard":
- we'd have to detect which rules are set to do this before the run, and
specifically skip the "stop checking if it's hit once" check. this will
decrease performance, possibly significantly, even for general use.
- instead of just flagging that a rule hit, we'd have to have a counter
for how many times a rule hit and list that out somehow.
- validating the score expression may suck
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
jgmyers@proofpoint.com changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |dev@spamassassin.apache.org
AssignedTo|dev@spamassassin.apache.org |jgmyers@proofpoint.com
Target Milestone|Future |3.2.0
------- Additional Comments From jgmyers@proofpoint.com 2005-11-16 00:51 -------
Committed revision 344480.
Added the "multiple" tflag, which when put on a subtest allows the referencing
meta test to see how many times the subtest hit. A test's score is only added
once regardless of how many times it hits.
The "multiple" tflag does not (yet?) do anything for meta, eval, or header tests.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are on the CC list for the bug, or are watching someone who is.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From matt@nightrealms.com 2005-07-02 02:21 -------
This is a proof-of-concept of how to do a counting rule. A new rule type has
been added, "count_body", which will count the number of times the regexp
matches in the body of the email; the score will be set to the number of matches
times the value given to the rule by the "score" directive. The number of times
matches can also be accessed by meta rules, for use in comparisons and formulas;
examples of these rules are in rules/70_testing.cf
got_pattern_hit(), handle_hit() and got_hit() were modified to accept a "count"
parameter, which defaults to 1 in got_hit() if it isn't defined. The count,
rather than just plain 1, is stored in $self->{tests_already_hit}->{$rule}, so
that it can be used by the meta rules. It's a bit hackish to overload
"tests_already_hit" like this, but it works perfectly well.
The meta test code could be tweaked so that the result of the meta test was used
as the "count" for the meta rule, so that something like
meta SQUARE_SCORE (__TEST * __TEST)
Could be used to have the score of a test increase with the square of the number
of times it was counted.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
------- Additional Comments From jgmyers@proofpoint.com 2005-11-16 19:08 -------
Committed revision 345076.
Meta and eval rules now expose their value to meta rules.
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From Bob@Menschel.net 2005-06-03 23:57 -------
Matthew, you've got the right idea, except that as currently implemented, each
element in a meta expression is binary, yes/no, 1/0. so
> meta FOOBAR00 ((__COUNT_FOOBAR > 1) && (__COUNT_FOOBAR < 10))
would always be false, since __COUNT_FOOBAR is always either 1 (true) or 0
(false). The trick to making this work is to find some way to incorporate a
non-binary into your logic, thereby allowing you to do arithmetic.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
------- Additional Comments From jm@jmason.org 2005-11-16 01:50 -------
cool, thanks guys -- nice implementation
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
------- Additional Comments From jgmyers@proofpoint.com 2005-12-22 22:33 -------
Committed revision 358638.
have tflags multiple rules count multiple hits per line
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
------- Additional Comments From Bob@Menschel.net 2005-06-04 00:36 -------
Theo, since my attention has been drawn back to this,
> we'd have to detect which rules are set to do this before the run
yes, perhaps with "tflags rule_name count" indicating this rule requires counting.
However, the syntax of "score rule_name value * factor" or "... ** exponent"
might be sufficient. The trick is to evaluate these in advance of testing for
match(es), rather than after.
> this will decrease performance, possibly significantly, even for general use
When used, yes, these can be expensive. How expensive would it be, for general
use (minimal use of these rules, or no hits for these rules), if we used logic
like:
1) run the test. If it matches, track /where/ it matches (index into the range).
The efficiency question here for the general case is whether storing that index
adds significant cost to the process.
2) is it an arithmetic rule? If not, set the binary and exit.
3) If it is, count the hit and rerun the test from this index point. Increment
for each count and exit when no more matches.
It'd obviously be most expensive when there are many hits, so maybe a method of
limiting the loop should apply, maybe something like:
score rule_name 0.2*n
tflags rule_name limit:5
That changes the logic to:
1) run the test. If it matches, track /where/ it matches (index into the range).
2) is it an arithmetic rule? If not, set the binary and exit. If yes, increment
the counter.
3) Is there a limit? (Perhaps a limit should be required?) If so, has the
counter reached the limit? If so, exit.
4) Limit not reached; loop to step 1 using the current index as a new starting
point.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4349
Bob@Menschel.net changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|Undefined |Future
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
jgmyers@proofpoint.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From jgmyers@proofpoint.com 2005-11-16 20:00 -------
Committed revision 345091.
header rules now support tflags multiple. This completes the set.
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
[Bug 4349] Add Count or Multiply scoring facility
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4349
------- Additional Comments From spamassassin@dostech.ca 2005-11-18 00:19 -------
Just a question about the tflags "multiple" name.
Would "count" not make more sense? I assume "multiple" is for multiple matches,
but multiple could mean more than one, but not all of them. "count" would, for
myself anyway, be more intuitive.
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.