place upper limit on autolearning score?

[Heinz Ulrich Stille <hu...@design-d.de>]

Hi!

Just some thoughts on the poisoning of bayes...

Would'nt it be useful to set a maximum score for bayes autolearning? I
don't think really high scoring spam contributes many useful tokens,
and what the bayes db needs to know are words that distinguish spam and
nonspam in the border area.

OTOH it could be possible to construct a spam that hits most of the static
rules and fill it with "regular" words (instead of sprinkling them into
normal spam), just to get them into the db and make it useless.
This should work even better with site-wide SA setups: Send the poison to a
nonexistent address, so that it bounces; with some luck it will still run
through the filter and get learned, and nobody will see it. This might even
work in the reverse - take something really low scoring, perhaps from the
linux kernel mailing list, and insert as many "spam" words as possible
while remaining under the default nonspam autolearn score.

Just some days ago there was some news about using double-MTA setups for
a DOS by generating bounces, but the same flaw probably will lay open
their spam filter...

MfG, Ulrich

-- 
Heinz Ulrich Stille / Tel.: +49-541-9400463 / Fax: +49-541-9400450
design_d gmbh / Lortzingstr. 2 / 49074 Osnabrück / www.design-d.de

Re: place upper limit on autolearning score?

[Alan Baxter <at...@baxtersys.com>]

On Sat, 17 Apr 2004 15:02:34 +0200, Heinz Ulrich Stille
<hu...@design-d.de> wrote:

>The upshoot is (for me at
>least): don't use auto-learning: It can't get at the interesting cases
>(near the spam threshold: those you'll have to inspect anyway and will
>learn manually), and it might slip something under your radar.

This part makes sense to me.  I only manually train bayes by feeding it
spam that scored less than BAYES_99 and ham that are false positives.

Alan
-- 
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html

Re: place upper limit on autolearning score?

[Michael Barton <re...@icuii.com>]

> It's not that some of the tokens might not be useful, but that those
> tokens that are useful are those that also appear in low scoring spam -
> we don't need bayes to tag those cases that get condemned by enough of
> the rules, just the "borderline" cases. To get those tokens it might be
> useful to autolearn those spam that are definitely spam, but below a
> certain threshold.
> Or I might just disable autolearning, as I manually check and learn the
> really borderline cases anyway...

This isn't really what I've found...
The auto-learning seems to keep things going pretty well.

Content analysis details:   (7.6 points, 5.0 required)

 0.2 NO_REAL_NAME           From: does not include a real name
 0.6 LOW_INTEREST           BODY: Lower Interest Rates
 0.4 BAD_CREDIT             BODY: Eliminate Bad Credit
 5.4 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.0 BIG_WORD               BODY: Probably trying to break Bayesian with big 
random word.

That was the last spam coming into my mailbox.. it would have gotten through 
had it not been for bayes.
I guess you'd call it "borderline".
But even with mostly autolearned bayesian, it gets picked up, because almost 
all spam, even the "borderline" spam, uses the same subset of the english 
language.

Re: place upper limit on autolearning score?

[Heinz Ulrich Stille <hu...@design-d.de>]

On Friday 16 April 2004 15:07, Keith C. Ivey wrote:
> Heinz Ulrich Stille <hu...@design-d.de> wrote:
> Do you have any evidence that high-scoring spam doesn't
> contribute useful spam tokens?  The claim doesn't seem logical

It's not that some of the tokens might not be useful, but that those
tokens that are useful are those that also appear in low scoring spam -
we don't need bayes to tag those cases that get condemned by enough of
the rules, just the "borderline" cases. To get those tokens it might be
useful to autolearn those spam that are definitely spam, but below a
certain threshold.
Or I might just disable autolearning, as I manually check and learn the
really borderline cases anyway...

> If they're regular words, then they appear in nonspam, so
> they'll never be considered spammy.  You can stuff any number
> of neutral words into a message, and it won't affect Bayes --
> Bayes only cares about the spammiest and hammiest tokens in the
> message.

That's not my point - If someone puts a word that bayes so far knew to
be definitely not spam into a spam that gets enough points by other
rules to be auto-learned, this will shift that word from non-spam
to neutral. On the whole the spectrum of bayes output will move from
"non-spam through spam" to "neutral to spam" at best, making it useless.
I'd like to keep words at their maximum possible selectivity.

> To have an effect, the spammers would have to use not regular
> words, but hammy words, and your set of hammy words is specific
> to you.  The spammers have no way of knowing what words are

OK, so it works only on single words and there is a large field. But
what is volume to a spammer? Just send everything...

> hammy for you, and even if they hit one accidentally, making a
> word or two less hammy and more neutral isn't going to have a
> great effect.

So it might not be practical on a per-user basis. I've got one bayes
db for our whole site (not that large, at it is), and I really wouldn't
want to try to educate my users about the real world...

> Even if this technique made sense, I don't understand why you
> think having a maximum autolearn limit would help.

Well, it might prevent re-sending everything from, say, the SA list
with enough properties that match rules to get all those words auto-
learned as spam, so that all other content of this list gets discarded
as well. Or it might not. It was just a thought...

> unlearning.  No one should set up a system like that, and I
> doubt many people are.  I'd imagine most people who bounce

It's just that I don't want to check /all/ spam - I never got a false
positive over about 8, and most spam I see is above 10. OK, the easiest
way probably would be to be to disable autolearning, but as it is there...

> messages to nonexistent addresses aren't bothering to send them
> to SpamAssassin first.

And what about those dual-MTA systems usable for DOS? Misconfiguration
might be all too easy.

> > reverse - take something really low scoring, perhaps from the
> > linux kernel mailing list, and insert as many "spam" words as
[...]
> It would require a lot of messages to have an effect, and even
> then the effect would only be at most to make some spammy

only making bayes useless.

> tokens neutral.  And sending low-scoring messages isn't so easy
> for the spammers, since many rules are not based on content but
> on things like sending IP addresses.

I'm seeing enough spam lately that hits nothing except bayes.

> > Just some days ago there was some news about using double-MTA
> > setups for a DOS by generating bounces, but the same flaw
> > probably will lay open their spam filter...
>
> DOS attacks are a concern.  Of course, if spammers disable a
> mail system, then their spam isn't getting to the recipients,
> so it seems a bit counterproductive.

That's beside the point: If the system is not set up to filter available
users before the second MTA, the spam filter might be accessible to
bounces even if those are not used in a DOS. If it's not used for that,
nobody might notice. Apart from all that spam getting through, of course.

All this might just be idle thought, of course. The upshoot is (for me at
least): don't use auto-learning: It can't get at the interesting cases
(near the spam threshold: those you'll have to inspect anyway and will
learn manually), and it might slip something under your radar.

MfG, Ulrich

-- 
Heinz Ulrich Stille / Tel.: +49-541-9400463 / Fax: +49-541-9400450
design_d gmbh / Lortzingstr. 2 / 49074 Osnabrück / www.design-d.de

Re: place upper limit on autolearning score?

["Keith C. Ivey" <kc...@cpcug.org>]

Heinz Ulrich Stille <hu...@design-d.de> wrote:

> Would'nt it be useful to set a maximum score for bayes
> autolearning? I don't think really high scoring spam contributes
> many useful tokens, and what the bayes db needs to know are
> words that distinguish spam and nonspam in the border area.

Do you have any evidence that high-scoring spam doesn't 
contribute useful spam tokens?  The claim doesn't seem logical 
to me.

> OTOH it could be possible to construct a spam that hits most of
> the static rules and fill it with "regular" words (instead of
> sprinkling them into normal spam), just to get them into the db
> and make it useless.

If they're regular words, then they appear in nonspam, so 
they'll never be considered spammy.  You can stuff any number 
of neutral words into a message, and it won't affect Bayes -- 
Bayes only cares about the spammiest and hammiest tokens in the 
message.

To have an effect, the spammers would have to use not regular 
words, but hammy words, and your set of hammy words is specific 
to you.  The spammers have no way of knowing what words are 
hammy for you, and even if they hit one accidentally, making a 
word or two less hammy and more neutral isn't going to have a 
great effect.

Even if this technique made sense, I don't understand why you 
think having a maximum autolearn limit would help.

> This should work even better with site-wide
> SA setups: Send the poison to a nonexistent address, so that it
> bounces; with some luck it will still run through the filter and
> get learned, and nobody will see it.

It's a bad idea to autolearn mail that you have no way of 
unlearning.  No one should set up a system like that, and I 
doubt many people are.  I'd imagine most people who bounce 
messages to nonexistent addresses aren't bothering to send them 
to SpamAssassin first.

> This might even work in the
> reverse - take something really low scoring, perhaps from the
> linux kernel mailing list, and insert as many "spam" words as
> possible while remaining under the default nonspam autolearn
> score.

It would require a lot of messages to have an effect, and even 
then the effect would only be at most to make some spammy 
tokens neutral.  And sending low-scoring messages isn't so easy 
for the spammers, since many rules are not based on content but 
on things like sending IP addresses.

> Just some days ago there was some news about using double-MTA
> setups for a DOS by generating bounces, but the same flaw
> probably will lay open their spam filter...

DOS attacks are a concern.  Of course, if spammers disable a 
mail system, then their spam isn't getting to the recipients, 
so it seems a bit counterproductive.

-- 
Keith C. Ivey <kc...@cpcug.org>
Washington, DC