Rule for words with multiple punctuation characters?

[John Wilcock <jo...@tradoc.fr>]

I've been getting a fair bit of spam with multiple punctuation
characters within a single word, getting through SA 2.64 (with most of
the SARE rulesets) with relatively low scores. No FNs so far thanks to
other rules, particularly the antidrug set, but some have been very
close to the limit and I've been trying to come up with a rule specific
to this type of obfuscation.

| Experience the reliable service and check out the l-o_w price on Xalatan,
| Aten_`olol, Zyban,  and V^al''ium. Find out m^or_e here o_n~line with us.
| 
| That's all I want.I just don't want to waste time in the do_^ct`'or's
| waiting room,or even I don't kn^,ow how much time I would have to sit like
| this.--Nancy G. in CA


My current best attempt is 

| body	   local_OBFU_MULTIPUNCT	/[a-z]([\~'"`_\,]{1,4}[a-z]{1,6}){2}/i
| describe local_OBFU_MULTIPUNCT	Two or more punctuation characters within a word
| score	   local_OBFU_MULTIPUNCT	0.1
| # score low during testing

but this is getting false positives, particularly on various mailing
lists where things like perl module names and code are discussed. 

Any suggestions?

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

Re: Rule for words with multiple punctuation characters?

[John Wilcock <jo...@tradoc.fr>]

On Wed, 6 Oct 2004 09:42:48 -0700, Loren Wilton wrote:
> Haven't seen these myself, but if they are drug spams, make sure you have
> the obfu drug rules installed and maybe up the score on some of them.
> Should have gotten about 4 hits in that first sentence.

Yes, the drug rules are catching them, but only just (scores as low as
6.2 with a threshold at 5.0). I'm just trying to be pre-emptive in case
they come up with a new variant that gets round the drug rules. 

Anyway, I've noticed that the FPs from my rule were mostly coming from
words with two underscores (e.g. discussions of SA rule names!).
Removing the underscore from the punctuation I was looking for seems to
have done the trick. 

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

Re: Rule for words with multiple punctuation characters?

[Loren Wilton <lw...@earthlink.net>]

Haven't seen these myself, but if they are drug spams, make sure you have
the obfu drug rules installed and maybe up the score on some of them.
Should have gotten about 4 hits in that first sentence.

        Loren