You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Sebastian Arcus <s....@open-t.co.uk> on 2015/12/12 12:51:00 UTC
Strange behaviour by the AWL module
One of my servers received a spam message which SA missed, with the
following report:
Content analysis details: (3.1 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser
mail provider
(noreply[at]live.com)
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4993]
2.0 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.0 UNPARSEABLE_RELAY Informational: message has unparseable
relay lines
-0.4 AWL AWL: Adjusted score from AWL reputation of
From: address
After learning the messages as spam into bayes with sa-learn, I get the
following report:
Content analysis details: (8.8 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
4.9 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser
mail provider
(noreply[at]live.com)
0.0 HTML_MESSAGE BODY: HTML included in message
8.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
2.0 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.0 UNPARSEABLE_RELAY Informational: message has unparseable
relay lines
-6.1 AWL AWL: Adjusted score from AWL reputation of
From: address
Luckily the message is now flagged as spam because I have manually
turned up the score on my BAYES_99 and BAYES_999 awhile ago. But what
intrigues me is that now the AWL module gives it a -6.1 score. Why would
AWL now tilt things heavily towards ham, after the message has just been
learned as spam? It seems to be making things worse instead of better.
Unless I am misunderstanding what AWL is supposed to be doing?
Re: Strange behaviour by the AWL module
Posted by Benny Pedersen <me...@junc.eu>.
On December 12, 2015 8:33:28 PM Sebastian Arcus <s....@open-t.co.uk> wrote:
> I guess I must be using the default settings - as I don't think I've
> configured anything in particular for AWL
change default /16 cidr to new default /24 for ipv4, for ipv6 use /64, if
you like to track on /32 for ipv4 then each ipv4 wil, have no shared awl scores
possible also change defaul awl faktory from 0.5 to 0.25 will reduce how
much benefit from previous score
if changeing settings, delete awl db
Re: Strange behaviour by the AWL module
Posted by Sebastian Arcus <s....@open-t.co.uk>.
On 12/12/15 23:43, Benny Pedersen wrote:
> On December 12, 2015 8:33:28 PM Sebastian Arcus <s....@open-t.co.uk>
> wrote:
>
>> I guess I must be using the default settings - as I don't think I've
>> configured anything in particular for AWL
>
> change default /16 cidr to new default /24 for ipv4, for ipv6 use /64,
> if you like to track on /32 for ipv4 then each ipv4 wil, have no
> shared awl scores
>
> possible also change defaul awl faktory from 0.5 to 0.25 will reduce
> how much benefit from previous score
>
> if changeing settings, delete awl db
Thank you - for the time being I've disabled the AWL module - as I've
worked out that on my type of setup it doesn't appear to be really needed.
Re: Strange behaviour by the AWL module
Posted by Sebastian Arcus <s....@open-t.co.uk>.
On 12/12/15 13:06, Benny Pedersen wrote:
> Sebastian Arcus skrev den 2015-12-12 12:51:
>
>> Why
>> would AWL now tilt things heavily towards ham, after the message has
>> just been learned as spam?
>
> its how AWL works
>
>> It seems to be making things worse instead
>> of better. Unless I am misunderstanding what AWL is supposed to be
>> doing?
>
> what are your settings for AWL plugin ?
I guess I must be using the default settings - as I don't think I've
configured anything in particular for AWL
Re: Strange behaviour by the AWL module
Posted by Benny Pedersen <me...@junc.eu>.
Sebastian Arcus skrev den 2015-12-12 12:51:
> Why
> would AWL now tilt things heavily towards ham, after the message has
> just been learned as spam?
its how AWL works
> It seems to be making things worse instead
> of better. Unless I am misunderstanding what AWL is supposed to be
> doing?
what are your settings for AWL plugin ?
Re: Strange behaviour by the AWL module
Posted by Sebastian Arcus <s....@open-t.co.uk>.
On 12/12/15 19:57, John Hardin wrote:
> On Sat, 12 Dec 2015, Sebastian Arcus wrote:
>
>> On 12/12/15 18:21, John Hardin wrote:
>>> On Sat, 12 Dec 2015, Sebastian Arcus wrote:
>>>
>>> > One of my servers received a spam message which SA missed, with
>>> the > following report:
>>> > > -0.4 AWL AWL: Adjusted score from AWL
>>> reputation of > From: address
>>> > > After learning the messages as spam into bayes with sa-learn, I
>>> get the > following report:
>>> > > -6.1 AWL AWL: Adjusted score from AWL
>>> reputation of > From: address
>>> > > > Luckily the message is now flagged as spam because I have
>>> manually > turned up the score on my BAYES_99 and BAYES_999 awhile
>>> ago. But what > intrigues me is that now the AWL module gives it a
>>> -6.1 score. Why would > AWL now tilt things heavily towards ham,
>>> after the message has just been > learned as spam? It seems to be
>>> making things worse instead of better. > Unless I am
>>> misunderstanding what AWL is supposed to be doing?
>>>
>>> You are. The name is misleading. AWL is more a score averager than a
>>> whitelist. It's intended to allow for the occasionally spammy-looking
>>> email from a historically hammy sender (and vice versa).
>>>
>>> It has nothing to do with training, which only affect Bayes.
>>>
>>> Messages from that sender will get negative AWL scores for a while
>>> until
>>> their traffic history becomes more on the "spam" side.
>>
>> OK - that's kind of what I assumed. What I don't understand is why
>> the AWL score changes after the message has been learned into the
>> Bayes database - and by so much?
>
> It's not that you trained it into Bayes, but that SA had previously
> only seen email from that source address that was scored as ham. I'm
> assuming that's the first message you got from that source address? So
> their entire AWL history is 100% hammy based on the original FN.
>
> You scan the message again, it scores as spammy now for whatever
> reason; SA checks the AWL history for that sender address and sees
> "100% hammy" and generates a partially-ofsetting negative score.
>
> As that sender's AWL history shifts from "100% hammy" towards "99%
> spammy" (assuming you ever get mail from that address again) the
> offsetting score will head towards zero. I don't *think* AWL will
> generate positive scores for spams from a historically spammy sender
> (i.e. I think AWL is purely to offset the raw score for anomalies), so
> you should see AWL scores stop once their history is "mostly spammy".
Thank you for that explanation!
Re: Strange behaviour by the AWL module
Posted by John Hardin <jh...@impsec.org>.
On Sat, 12 Dec 2015, Sebastian Arcus wrote:
> On 12/12/15 18:21, John Hardin wrote:
>> On Sat, 12 Dec 2015, Sebastian Arcus wrote:
>>
>> > One of my servers received a spam message which SA missed, with the
>> > following report:
>> >
>> > -0.4 AWL AWL: Adjusted score from AWL reputation of
>> > From: address
>> >
>> > After learning the messages as spam into bayes with sa-learn, I get the
>> > following report:
>> >
>> > -6.1 AWL AWL: Adjusted score from AWL reputation of
>> > From: address
>> >
>> >
>> > Luckily the message is now flagged as spam because I have manually
>> > turned up the score on my BAYES_99 and BAYES_999 awhile ago. But what
>> > intrigues me is that now the AWL module gives it a -6.1 score. Why would
>> > AWL now tilt things heavily towards ham, after the message has just been
>> > learned as spam? It seems to be making things worse instead of better.
>> > Unless I am misunderstanding what AWL is supposed to be doing?
>>
>> You are. The name is misleading. AWL is more a score averager than a
>> whitelist. It's intended to allow for the occasionally spammy-looking
>> email from a historically hammy sender (and vice versa).
>>
>> It has nothing to do with training, which only affect Bayes.
>>
>> Messages from that sender will get negative AWL scores for a while until
>> their traffic history becomes more on the "spam" side.
>
> OK - that's kind of what I assumed. What I don't understand is why the AWL
> score changes after the message has been learned into the Bayes database -
> and by so much?
It's not that you trained it into Bayes, but that SA had previously only
seen email from that source address that was scored as ham. I'm assuming
that's the first message you got from that source address? So their entire
AWL history is 100% hammy based on the original FN.
You scan the message again, it scores as spammy now for whatever reason;
SA checks the AWL history for that sender address and sees "100% hammy"
and generates a partially-ofsetting negative score.
As that sender's AWL history shifts from "100% hammy" towards "99% spammy"
(assuming you ever get mail from that address again) the offsetting score
will head towards zero. I don't *think* AWL will generate positive scores
for spams from a historically spammy sender (i.e. I think AWL is purely to
offset the raw score for anomalies), so you should see AWL scores stop
once their history is "mostly spammy".
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If you are "fighting for social justice," then you are defining
yourself as someone who considers regular old everyday
*equal* justice to be something you don't want. -- GOF at TSM
-----------------------------------------------------------------------
3 days until Bill of Rights day
Re: Strange behaviour by the AWL module
Posted by Sebastian Arcus <s....@open-t.co.uk>.
On 12/12/15 18:21, John Hardin wrote:
> On Sat, 12 Dec 2015, Sebastian Arcus wrote:
>
>> One of my servers received a spam message which SA missed, with the
>> following report:
>>
>> -0.4 AWL AWL: Adjusted score from AWL reputation
>> of From: address
>>
>> After learning the messages as spam into bayes with sa-learn, I get
>> the following report:
>>
>> -6.1 AWL AWL: Adjusted score from AWL reputation
>> of From: address
>>
>>
>> Luckily the message is now flagged as spam because I have manually
>> turned up the score on my BAYES_99 and BAYES_999 awhile ago. But what
>> intrigues me is that now the AWL module gives it a -6.1 score. Why
>> would AWL now tilt things heavily towards ham, after the message has
>> just been learned as spam? It seems to be making things worse instead
>> of better. Unless I am misunderstanding what AWL is supposed to be
>> doing?
>
> You are. The name is misleading. AWL is more a score averager than a
> whitelist. It's intended to allow for the occasionally spammy-looking
> email from a historically hammy sender (and vice versa).
>
> It has nothing to do with training, which only affect Bayes.
>
> Messages from that sender will get negative AWL scores for a while
> until their traffic history becomes more on the "spam" side.
OK - that's kind of what I assumed. What I don't understand is why the
AWL score changes after the message has been learned into the Bayes
database - and by so much?
Re: Strange behaviour by the AWL module
Posted by John Hardin <jh...@impsec.org>.
On Sat, 12 Dec 2015, Sebastian Arcus wrote:
> One of my servers received a spam message which SA missed, with the following
> report:
>
> -0.4 AWL AWL: Adjusted score from AWL reputation of From:
> address
>
> After learning the messages as spam into bayes with sa-learn, I get the
> following report:
>
> -6.1 AWL AWL: Adjusted score from AWL reputation of From:
> address
>
>
> Luckily the message is now flagged as spam because I have manually turned up
> the score on my BAYES_99 and BAYES_999 awhile ago. But what intrigues me is
> that now the AWL module gives it a -6.1 score. Why would AWL now tilt things
> heavily towards ham, after the message has just been learned as spam? It
> seems to be making things worse instead of better. Unless I am
> misunderstanding what AWL is supposed to be doing?
You are. The name is misleading. AWL is more a score averager than a
whitelist. It's intended to allow for the occasionally spammy-looking
email from a historically hammy sender (and vice versa).
It has nothing to do with training, which only affect Bayes.
Messages from that sender will get negative AWL scores for a while until
their traffic history becomes more on the "spam" side.
A lot of people just turn AWL off, or use a newer replacement called
txrep.
I think there's a way to wipe the AWL history for a given sender; I don't
recall what it is off the top of my head, though.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
When fascism comes to America, it will be wrapped in
"Diversity" and demanding "Safe Spaces." -- Mona Charen
-----------------------------------------------------------------------
3 days until Bill of Rights day