Time based rules

[RPICKERING <ra...@crowndigital.com>]

I was just thinking that most (95%) of our legitimate email comes in
during office hours (8am - 7pm GMT) and a lot of spam comes in overnight
(probably when the spammers in the rest of the world wake up and start
doing business). So I was wondering if there was any way SpamAssassin
could evaluate the time an email was received and give it a score
accordingly? Not that it's too important. SA gets 99% of our spam as it
is; there's just the odd one that slips through every so often.

Ralph Pickering

Crown Business Communications Ltd
email:              pickeringr@crownbc.com
website:            www.crownbc.com 

Re: Time based rules

[Matt Kettler <mk...@evi-inc.com>]

At 11:58 AM 10/14/2004, Martin Hepworth wrote:
>Last time I looked at spam rate it dipped Mon-Tues then picked up again 
>and tended to be US eastern time

Interesting, my graphs over the past 3 weeks tend to peak on Weds, roll off 
steadily hitting a low on Sunday, then ramp back up Monday and Tuesday 
towards the peak. However, the total variance between days is only 25% less 
spam on the lowest day relative to the highest day. I guess spammers tend 
to take long weekends. :)

YSMV (Your Spammers May Vary)

By comparison total mail volume follows a similar trend with Weds being a 
peak and slow roll-offs in either direction, but Saturday and Sunday are 
deeply dropped off relative to M-F (50% drop off for sat/sun). Not really 
surprising there.

Re: Time based rules

[Martin Hepworth <ma...@solid-state-logic.com>]

Matt Kettler wrote:
> At 05:16 AM 10/14/2004, RPICKERING wrote:
> 
>> I was just thinking that most (95%) of our legitimate email comes in
>> during office hours (8am - 7pm GMT) and a lot of spam comes in overnight
>> (probably when the spammers in the rest of the world wake up and start
>> doing business). So I was wondering if there was any way SpamAssassin
>> could evaluate the time an email was received and give it a score
>> accordingly? Not that it's too important. SA gets 99% of our spam as it
>> is; there's just the odd one that slips through every so often.
> 
> 
> It *could* yes.. however, this would require writing a plugin, and not 
> just a rule.
> 
> I've seen this exact same suggestion made many times on the list. MANY 
> times.
> 
> Let's face it, it might be handy for you, but for those of us who 
> subscribe to global mailing lists, like this one, it's more-or-less 
> useless. What's off-hours for me in the eastern US are on-hours for 
> Justin in Ireland. Dan Q seems to be out on the west coast of the US.
> 
> As far as I can tell, time-based filtering is really geographic 
> filtering. At that point, you might as well better off using blackholes.us.
> 
> Looking at my MRTG graphs, spam-rate is pretty much a constant here. The 
> "spam caught" graph increases at a nearly perfectly linear rate, 
> resetting at midnight and creates a nice, very triangular, very regular 
> sawtooth pattern in the weekly graph. Thus, at least here at my site, 
> there's no rate of change for spam.
> 
> Ham rate on the other hand does seem to increase during "extended 
> business hours" of my local timezone. But not dramaticaly. It seems to 
> go up about 50% between 8am and 7pm EST. However, I'd venture to guess 
> the ham rate increase is almost entirely due to geography.
> 

Also not v useful here as our email gateway feeds the UK, New York, LA 
and Tokyo users.

Some people find it useful however..

Last time I looked at spam rate it dipped Mon-Tues then picked up again 
and tended to be US eastern time


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

Re: Time based rules

[Fred <sp...@freddyt.com>]

Matt Kettler wrote:
> Looking at my MRTG graphs, spam-rate is pretty much a constant here.

Same here, it's about 1,200-1,400 per hour for us.  This stays constant 24
hours a day for us.  In the past 48 hours, the lowest point was 11pm on Oct.
13th with only 800 spam, and the high point of 10pm on Oct. 12th with 1,600
spam.  This is odd because the low point and the high point are nearly the
same times just different days.

> Ham rate on the other hand does seem to increase during "extended
> business hours" of my local timezone. But not dramaticaly. It seems
> to go up about 50% between 8am and 7pm EST. However, I'd venture to
> guess the ham rate increase is almost entirely due to geography.

Our ham rate looks more like your spam graphs.  From 4am to 12pm it rises to
it's peak and then from 1pm to 3am it slowly goes back down to the low
point.

A different point is user_unknowns, as an ISP with many revolving customers,
we see nearly 1 spam get blocked for each message blocked due to
user_unknown.   Last 48 hours shows:
spam-reject 58,437
user_unknown 52,263

And they never clean their lists, this data has been consistant like this
since we started keeping track of it.

Re: Time based rules

[Matt Kettler <mk...@evi-inc.com>]

At 05:16 AM 10/14/2004, RPICKERING wrote:
>I was just thinking that most (95%) of our legitimate email comes in
>during office hours (8am - 7pm GMT) and a lot of spam comes in overnight
>(probably when the spammers in the rest of the world wake up and start
>doing business). So I was wondering if there was any way SpamAssassin
>could evaluate the time an email was received and give it a score
>accordingly? Not that it's too important. SA gets 99% of our spam as it
>is; there's just the odd one that slips through every so often.

It *could* yes.. however, this would require writing a plugin, and not just 
a rule.

I've seen this exact same suggestion made many times on the list. MANY times.

Let's face it, it might be handy for you, but for those of us who subscribe 
to global mailing lists, like this one, it's more-or-less useless. What's 
off-hours for me in the eastern US are on-hours for Justin in Ireland. Dan 
Q seems to be out on the west coast of the US.

As far as I can tell, time-based filtering is really geographic filtering. 
At that point, you might as well better off using blackholes.us.

Looking at my MRTG graphs, spam-rate is pretty much a constant here. The 
"spam caught" graph increases at a nearly perfectly linear rate, resetting 
at midnight and creates a nice, very triangular, very regular sawtooth 
pattern in the weekly graph. Thus, at least here at my site, there's no 
rate of change for spam.

Ham rate on the other hand does seem to increase during "extended business 
hours" of my local timezone. But not dramaticaly. It seems to go up about 
50% between 8am and 7pm EST. However, I'd venture to guess the ham rate 
increase is almost entirely due to geography.