Mass-Checks on Custom rules

[John <jo...@linuxseclabs.com>]

Hi,
I have been searching around with no luck. I have been playing with
mass-checks on my corpus using some the SARE rules sets and wanted to do a
sanity check against someone else's mass checks. The particular rules sets
are
70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
70_sare_evilnum0.cf
70_sare_genlsubj0.cf
70_sare_header0.cf
70_sare_html0.cf
70_sare_html1.cf
70_sare_obfu0.cf
70_sare_obfu1.cf
70_sare_random.cf
70_sare_specific.cf
70_sare_spoof.cf

I see that 70_sare_bayes_poison_nxm.cf has some checks with the file. Is
there a place where such data is stored for these rules or is it just pot
luck if someone happened to do a mass-check on particular set?

Any help is appreciated,
John

Re: Mass-Checks on Custom rules

[John <jo...@linuxseclabs.com>]

Bob,

On Tue, 17 May 2005, Robert Menschel wrote:

> Hello John,
>
> Tuesday, May 17, 2005, 2:02:16 PM, you wrote:
>
> J> Hi,
> J> I have been searching around with no luck. I have been playing with
> J> mass-checks on my corpus using some the SARE rules sets and wanted to do a
> J> sanity check against someone else's mass checks. The particular rules sets
> J> are ...
>
> J> I see that 70_sare_bayes_poison_nxm.cf has some checks with the file. Is
> J> there a place where such data is stored for these rules or is it just pot
> J> luck if someone happened to do a mass-check on particular set?
>
> Unfortunately, mostly pot luck.  A year ago we tried to update
> mass-checks as we published rule sets, but never quite got the habit
> developed.  I don't think any of the published mass-checks have been
> updated in 9 months or more.
>
> However, in the rule sets I maintain,
> 70_sare_genlsubj0.cf
> 70_sare_header0.cf
> 70_sare_html0.cf
> 70_sare_html1.cf
> 70_sare_obfu0.cf
> 70_sare_obfu1.cf
> 70_sare_specific.cf
> you'll find the mass-check results of each rule documented in a
> #counts line immediately following each rule.
>
Thanks for this info. It is a help.

John

Re: Mass-Checks on Custom rules

[Robert Menschel <Ro...@Menschel.net>]

Hello John,

Tuesday, May 17, 2005, 2:02:16 PM, you wrote:

J> Hi,
J> I have been searching around with no luck. I have been playing with
J> mass-checks on my corpus using some the SARE rules sets and wanted to do a
J> sanity check against someone else's mass checks. The particular rules sets
J> are ...

J> I see that 70_sare_bayes_poison_nxm.cf has some checks with the file. Is
J> there a place where such data is stored for these rules or is it just pot
J> luck if someone happened to do a mass-check on particular set?

Unfortunately, mostly pot luck.  A year ago we tried to update
mass-checks as we published rule sets, but never quite got the habit
developed.  I don't think any of the published mass-checks have been
updated in 9 months or more.

However, in the rule sets I maintain,
70_sare_genlsubj0.cf
70_sare_header0.cf
70_sare_html0.cf
70_sare_html1.cf
70_sare_obfu0.cf
70_sare_obfu1.cf
70_sare_specific.cf
you'll find the mass-check results of each rule documented in a
#counts line immediately following each rule.

Bob Menschel