Bayes

[Alan Fullmer <li...@xnote.com>]

 
I apologize if this has been asked before or not.  I just subscribed, so I
am unaware of it.
 
Anyway, I am having this issue with bayes.
 
Creatively spammers have put garbage in the body as such:
 
>>>> competition regret teaching unit boot chalk cruel tin belief wall may
narrow brown angry scissors need waste request he wide number pump now snake
chin lift bag chief ready stem ship error very poor curtain apparatus skirt
stem go end cotton surpri special fertile fiction where equal driving public
purpose process present seed dark journey thunder bottle touch attempt crush
secretary soup living boat sweet brake nerve balance value toe for burst
cook chain sudden man morning butter come peace damage stamp door wave late
box stretch news advertisement fire shake common nation prose regret horn
shelf dirty left bright note danger discovery sense glove meeting punishment
feather pot down tongue egg bed only debt money reaction be mark brick solid
drain exchange from together help cold bitter point plow crime cotton stone
sun gold pin grip kettle fowl interest relation quality respect shelf
disgust trade riceriver tree hope crime language cry taste seat while crack
needle by example competition competition tired smoke jump shelf observation
attraction but account sound wide responsible limit question test room lord
you authority statement plant 
 
The list goes on.
What I believe this to be doing is fooling? the bayes to give this:  
 
-4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
 
Am I correct to assume this?   Are these words creating false tokens for
Bayes, and thus giving it a false value?
 
Has anyone else had this issue?  And if so, what did you do to counteract
it?
 
Thanks in advance.
 
-alan fullmer
 

Re: Bayes

[Michael Barton <re...@icuii.com>]

The bayes poisoning doesn't seem like a big problem so long as I remember to 
feed fn's to sa-learn.  When I get lazy about doing this for a while, I get a 
lot more spam.
I'm certain a lot of spammers run their stuff through SA before sending it 
out.  That's why bayesian is so nifty.  It makes each instance of SA both 
unique and optimized for the particular lists that account is on.

----- Original Message ----- 
From: "Stuart Gall" <st...@otenet.gr>
To: "Alan Fullmer" <li...@xnote.com>
Cc: <sp...@incubator.apache.org>
Sent: Friday, April 16, 2004 3:26 PM
Subject: Re: Bayes


YEP.

In fact there is a bigger issue.
SA is publicly available, therefore any intelligent spammer (if that is
not an oxymoron) will down load SA and run their spam candidates
through SA before releasing them on the public.

The only general solution I can think of would be to include a random
element in the rule scores, but it is hard enough to get rid of false
positives and false negatives without a random element.

In theory a properly trained BAYES, with plenty of HAM from your own
email pool should circumvent this eventually.

The only other way is to add your own rules so that you are not using
the same rule set that the intelligent spammer is using.


On 16 Apr 2004, at 00:07, Alan Fullmer wrote:

>
> I apologize if this has been asked before or not. I just subscribed,
> so I am unaware of it.
>
> Anyway, I am having this issue with bayes.
>
> Creatively spammers have put garbage in the body as such:
>
> >>>> competition regret teaching unit boot chalk cruel tin belief wall
> may narrow brown angry scissors need waste request he wide number pump
> now snake chin lift bag chief ready stem ship error very poor curtain
> apparatus skirt stem go end cotton surpri special fertile fiction
> where equal driving public purpose process present seed dark journey
> thunder bottle touch attempt crush secretary soup living boat sweet
> brake nerve balance value toe for burst cook chain sudden man morning
> butter come peace damage stamp door wave late box stretch news
> advertisement fire shake common nation prose regret horn shelf dirty
> left bright note danger discovery sense glove meeting punishment
> feather pot down tongue egg bed only debt money reaction be mark brick
> solid drain exchange from together help cold bitter point plow crime
> cotton stone sun gold pin grip kettle fowl interest relation quality
> respect shelf disgust trade riceriver tree hope crime language cry
> taste seat while crack needle by example competition competition tired
> smoke jump shelf observation attraction but account sound wide
> responsible limit question test room lord you authority statement
> plant
>
> The list goes on.
> What I believe this to be doing is fooling? the bayes to give this:
>
> -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>
> Am I correct to assume this? Are these words creating false tokens
> for Bayes, and thus giving it a false value?
>
> Has anyone else had this issue? And if so, what did you do to
> counteract it?
>
> Thanks in advance.
>
> -alan fullmer
>
>
>
>
-------------------------------------------------------------------
Stuart Gall
Systems Administrator
-------------------------------------------------------------------
No user serviceable parts inside?  Ill be the judge of that!

Re[2]: Bayes

[Robert Menschel <Ro...@Menschel.net>]

Hello Kai,

Friday, April 16, 2004, 2:31:31 PM, you wrote:

KS> Stuart Gall wrote on Fri, 16 Apr 2004 23:26:45 +0300:

>> In theory

KS> I can just say that I have SA in use for about 1,5 years on multiple 
KS> machines now, with Bayes and auto-learning enabled all the time, and we
KS> didn't have a single case of Bayes "freaking out" because of "Bayes 
KS> poison". This discussion comes up about every week here and I don't see
KS> any proof for those "theories", it just doesn't happen.

I agree completely.  Bayes "poison" is a misnomer -- I prefer to call it
Bayes fodder.

Bayes including auto-learning has always been enabled here, and it works
wonderfully on messages with randomized real-word text.

Only change I've done is to keep the auto-learn bayes ham threshold
negative rather than positive under 2.6x (using a number of negative
rules specific to our ham).

Bob Menschel

Re: Bayes

[Kai Schaetzl <ma...@conactive.com>]

Stuart Gall wrote on Fri, 16 Apr 2004 23:26:45 +0300:

> In theory
>

I can just say that I have SA in use for about 1,5 years on multiple 
machines now, with Bayes and auto-learning enabled all the time, and we 
didn't have a single case of Bayes "freaking out" because of "Bayes 
poison". This discussion comes up about every week here and I don't see 
any proof for those "theories", it just doesn't happen.


Kai

-- 

Kai Sch�tzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org

Re: Bayes

[Stuart Gall <st...@otenet.gr>]

YEP.

In fact there is a bigger issue.
SA is publicly available, therefore any intelligent spammer (if that is 
not an oxymoron) will down load SA and run their spam candidates 
through SA before releasing them on the public.

The only general solution I can think of would be to include a random 
element in the rule scores, but it is hard enough to get rid of false 
positives and false negatives without a random element.

In theory a properly trained BAYES, with plenty of HAM from your own 
email pool should circumvent this eventually.

The only other way is to add your own rules so that you are not using 
the same rule set that the intelligent spammer is using.


On 16 Apr 2004, at 00:07, Alan Fullmer wrote:

>  
> I apologize if this has been asked before or not.  I just subscribed, 
> so I am unaware of it.
>  
> Anyway, I am having this issue with bayes.
>  
> Creatively spammers have put garbage in the body as such:
>  
> >>>> competition regret teaching unit boot chalk cruel tin belief wall 
> may narrow brown angry scissors need waste request he wide number pump 
> now snake chin lift bag chief ready stem ship error very poor curtain 
> apparatus skirt stem go end cotton surpri special fertile fiction 
> where equal driving public purpose process present seed dark journey 
> thunder bottle touch attempt crush secretary soup living boat sweet 
> brake nerve balance value toe for burst cook chain sudden man morning 
> butter come peace damage stamp door wave late box stretch news 
> advertisement fire shake common nation prose regret horn shelf dirty 
> left bright note danger discovery sense glove meeting punishment 
> feather pot down tongue egg bed only debt money reaction be mark brick 
> solid drain exchange from together help cold bitter point plow crime 
> cotton stone sun gold pin grip kettle fowl interest relation quality 
> respect shelf disgust trade riceriver tree hope crime language cry 
> taste seat while crack needle by example competition competition tired 
> smoke jump shelf observation attraction but account sound wide 
> responsible limit question test room lord you authority statement 
> plant
>   
> The list goes on.
> What I believe this to be doing is fooling? the bayes to give this: 
>   
> -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>  
> Am I correct to assume this?   Are these words creating false tokens 
> for Bayes, and thus giving it a false value?
>  
> Has anyone else had this issue?  And if so, what did you do to 
> counteract it?
>  
> Thanks in advance.
>  
> -alan fullmer
>  
>
>
>
-------------------------------------------------------------------
Stuart Gall
Systems Administrator
-------------------------------------------------------------------
No user serviceable parts inside?  Ill be the judge of that!