You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kevin Peuhkurinen <ke...@hepcoe.com> on 2004/03/25 19:13:25 UTC
Rules to count number of occurances
Sorry if this is a bit of a newbie question, but how do I go about
writing a rule that will either count the number of times a particular
word occurs in a message body, or trigger if the occurances are more
than x number of times?
Thanks!
Re: Rules to count number of occurances
Posted by Al Danks <ad...@calvin.edu>.
> This may work....watch the line wraps, this should be one line:
> /\b(?:best|most|(?:be[st]t|bigg|larg|fast|quick)(?:er|est))\b.{0,60}\b
(?:best|most|(?:be[st]t|bigg|larg|fast|quick)(?:er|est))\b.{0,60}\b(?:best|most|
(?:be[st]t|bigg|larg|fast|quick)(?:er|est))\b/i
>
> I think this should do it....
>
Matt,
I tried it. It didn't break SA so that's good. It didn't trip on the following
message though:
This is simulating a spammer email. We have the largest selection of products
available anywhere in the world! Rolex, Spandex, and Sizex. We provide the
quickest delivery.
Why order anywhere else? There is no one better than us.
I also tried "no one faster than us" thinking there might have been a problem
with the "better" part of the rule.
Al
Re: Rules to count number of occurances
Posted by Matt Yackley <sa...@yackley.org>.
Al Danks said:
> Kelson Vibber <kelson <at> speed.net> writes:
>
>>
>> At 12:07 PM 3/25/2004, Al Danks wrote:
>> >body CTS_ESTS /\bbest\b.{0,20}\bbest\b.{0,20}\bbest\b/i
>> >...
>> >We have the best prices! We have the best delivery! We provide the best
>> >service!
>> >...
>> >The rule didn't trip.
>>
>> There's 21 chars between the first and second "best" and 26 between the
>> second and third.
>>
>
> User counting error. I changed the {0,20} to {0,60} and the rule tripped
> with
> the message in both formats.
>
> My maillog says cleam message (0.0/10.0) for spam:507 in 0.0 seconds. I'm
> not
> sure that tells us much about the processing time. A bigger x and a bigger
> message could be a different story.
>
> Now that I know how to do this rule I need to expand the \bbest\b to
> something
> like \bbest|biggest|largest|fastest|quickest|most\b and do another one for
> the -
> ers: better, bigger, larger, faster, quicker, etc. If we get those rules
> put
> together it would be interesting to see how they score against corpus.
> They
> might be useful in meta combination with some other rule(s).
>
> Thanks for pointing out the error.
>
> Al
>
Hi Al,
This may work....watch the line wraps, this should be one line:
/\b(?:best|most|(?:be[st]t|bigg|larg|fast|quick)(?:er|est))\b.{0,60}\b(?:best|most|(?:be[st]t|bigg|larg|fast|quick)(?:er|est))\b.{0,60}\b(?:best|most|(?:be[st]t|bigg|larg|fast|quick)(?:er|est))\b/i
I think this should do it....
-matt
Re: Rules to count number of occurances
Posted by Al Danks <ad...@calvin.edu>.
Kelson Vibber <kelson <at> speed.net> writes:
>
> At 12:07 PM 3/25/2004, Al Danks wrote:
> >body CTS_ESTS /\bbest\b.{0,20}\bbest\b.{0,20}\bbest\b/i
> >...
> >We have the best prices! We have the best delivery! We provide the best
> >service!
> >...
> >The rule didn't trip.
>
> There's 21 chars between the first and second "best" and 26 between the
> second and third.
>
User counting error. I changed the {0,20} to {0,60} and the rule tripped with
the message in both formats.
My maillog says cleam message (0.0/10.0) for spam:507 in 0.0 seconds. I'm not
sure that tells us much about the processing time. A bigger x and a bigger
message could be a different story.
Now that I know how to do this rule I need to expand the \bbest\b to something
like \bbest|biggest|largest|fastest|quickest|most\b and do another one for the -
ers: better, bigger, larger, faster, quicker, etc. If we get those rules put
together it would be interesting to see how they score against corpus. They
might be useful in meta combination with some other rule(s).
Thanks for pointing out the error.
Al
Re: Rules to count number of occurances
Posted by Kelson Vibber <ke...@speed.net>.
At 12:07 PM 3/25/2004, Al Danks wrote:
>body CTS_ESTS /\bbest\b.{0,20}\bbest\b.{0,20}\bbest\b/i
>...
>We have the best prices! We have the best delivery! We provide the best
>service!
>...
>The rule didn't trip.
There's 21 chars between the first and second "best" and 26 between the
second and third.
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Rules to count number of occurances
Posted by Al Danks <ad...@calvin.edu>.
Kelson Vibber <kelson <at> speed.net> writes:
> Perhaps something like:
>
> /test.{0,x}test.{0,x}test/
>
> Refined with appropriate use of \b and similar elements to avoid matching
> on, say, "testify"
Kelson,
I tried this:
body CTS_ESTS /\bbest\b.{0,20}\bbest\b.{0,20}\bbest\b/i
describe CTS_ESTS Too many ests
score CTS_ESTS 0.01
I sent the following two messages:
We have the best prices!
We have the best delivery!
We provide the best service!
We are simply the best - ever.
and
We have the best prices! We have the best delivery! We provide the best service!
We are simply the best - ever.
The rule didn't trip.
Al
Re: Rules to count number of occurances
Posted by Kelson Vibber <ke...@speed.net>.
At 11:49 AM 3/25/2004, Kevin Peuhkurinen wrote:
>I was thinking of something along the same lines, but wouldn't this be
>rather computantionally expensive if you were to use numbers in the range
>of 1024 or so?
>
>Kelson Vibber wrote:
>> /test.{0,x}test.{0,x}test/
True. I was thinking in terms of double-digit values for x.
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Rules to count number of occurances
Posted by Kevin Peuhkurinen <ke...@hepcoe.com>.
I was thinking of something along the same lines, but wouldn't this be
rather computantionally expensive if you were to use numbers in the
range of 1024 or so?
Kelson Vibber wrote:
> At 10:46 AM 3/25/2004, Al Danks wrote:
>
>> I'm wondering if one could look for "test", then look for "test"
>> again with x
>> characters, and "test" again within x more characters?
>
>
> Perhaps something like:
>
> /test.{0,x}test.{0,x}test/
>
> Refined with appropriate use of \b and similar elements to avoid
> matching on, say, "testify"
>
> Kelson Vibber
> SpeedGate Communications <www.speed.net>
>
>
Re: Rules to count number of occurances
Posted by Kelson Vibber <ke...@speed.net>.
At 10:46 AM 3/25/2004, Al Danks wrote:
>I'm wondering if one could look for "test", then look for "test" again with x
>characters, and "test" again within x more characters?
Perhaps something like:
/test.{0,x}test.{0,x}test/
Refined with appropriate use of \b and similar elements to avoid matching
on, say, "testify"
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Rules to count number of occurances
Posted by Al Danks <ad...@calvin.edu>.
Matt Kettler <mkettler <at> evi-inc.com> writes:
> Sorry, that can't be done with a simple rule at this time, you'd need to
> implement an eval test in the code itself.
>
Matt,
Could that be done with a rule that looked for a text occurence within x
characters of the first text occurance?
I'm wondering if one could look for "test", then look for "test" again with x
characters, and "test" again within x more characters?
I don't know how to write the rule, but I think I've seen rules that look for
text within x characters of other text.
Al
Re: Rules to count number of occurances
Posted by Matt Kettler <mk...@evi-inc.com>.
At 01:13 PM 3/25/2004, Kevin Peuhkurinen wrote:
>Sorry if this is a bit of a newbie question, but how do I go about writing
>a rule that will either count the number of times a particular word occurs
>in a message body, or trigger if the occurances are more than x number of
>times?
Sorry, that can't be done with a simple rule at this time, you'd need to
implement an eval test in the code itself.
Someone at one point made a patch to add the necessary code, but I've not
seen it floating around recently.