Bayes poisoning ?

[Ramprasad A Padmanabhan <ra...@netcore.co.in>]

Hi
  We are using Spamassassin + Postfix + Mailscanner on our SMTP servers.
Of late I have noticed that a lot of ham mails are getting a high BAYES
score.

I have overriden bayes with lower scores in order to avoid false
postives ( and possibly mail loss ) 

How do I de-poison the bayes database, and are there any ways to avoid
bayes poisoning ? 


Thanks
Ram




----------------------------------------------------------
Netcore Solutions Pvt. Ltd.
Website:  http://www.netcore.co.in
Spamtraps: http://cleanmail.netcore.co.in/directory.html
----------------------------------------------------------

Re: Bayes poisoning ?

[Loren Wilton <lw...@earthlink.net>]

The best thing to do is probably throw the current database away and start
over.  As you seem to have several users, you should have bayes working
again within a very few hours, or less.

You should delete the current database, reset the scores to normal (and
increase the bayes_99 score to something around 4 if you aren't using
3.0.4), and then manually train Bayes on a few hundred known ham and spam
before letting autolearning take over.

The other thing you should do is decrease bayes autolearn ham threshold to 0
or even -.1 or so.  By default it is too high, and will far too often lead
to bayes poisioning if the state of the database isn't watched carefully.
You may also want to take the bayes autolearn spam threshold up to a higher
value than it has by default; although this usually isn't required.

        Loren