You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc Kool <M....@vioro.nl> on 2004/04/14 08:34:12 UTC
header_abuse.cf
To SARE, the author of header_abuse.cf
there is a logical mismatch in the rules
header RM_fl_ConsWord6s From =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
describe
RM_fl_ConsWord6s To contains word consisting of consecutive consonants
score RM_fl_ConsWord6s 1.666 # 460s/1h of 97268 corpus (79437s/17831h) 01/24/04
header RM_fl_ConsWord9 From =~ /\b[bcghjklmnpqrstvwxz]{9,20}\b/
describe
RM_fl_ConsWord9 From contains word consisting of consecutive consonants
score RM_fl_ConsWord9 1.666 # type=spamp - 137s/0h of 97268 corpus (79437s/17831h) 01/24/04
The rules overlap: 9 consonant in From matches both rules.
I assume that the RM_fl_ConsWord6s is for a 'To' instead of 'From'.
-Marc
Re[2]: header_abuse.cf
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Marc,
Wednesday, April 14, 2004, 10:28:18 PM, you wrote:
MK> Hi Bob,
MK> Thanks for the explanantion (I overlooked the "s" part).
MK> The description that includes "To" put me in the wrong way.
I can understand. :-) I fixed that in my personal copy somewhere along
the way, apparently after it was submitted to SARE for eventual
distribution in a rule set. Someone will need to fix that description...
Bob Menschel
>> MK> header RM_fl_ConsWord6s From =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
>> MK> describe RM_fl_ConsWord6s To contains word consisting of consecutive consonants
>> MK> score RM_fl_ConsWord6s 1.666 # 460s/1h of 97268 corpus (79437s/17831h) 01/24/04
Re: header_abuse.cf
Posted by Marc Kool <M....@vioro.nl>.
Hi Bob,
Thanks for the explanantion (I overlooked the "s" part).
The description that includes "To" put me in the wrong way.
Marc
Robert Menschel wrote:
> Hello Marc,
>
> Tuesday, April 13, 2004, 11:34:12 PM, you wrote:
>
> MK> To SARE, the author of header_abuse.cf
>
> I'm not actively maintaining header_abuse.cf, but I'm the original author
> of these rules.
>
> MK> there is a logical mismatch in the rules
> "is", or "seems to be"?
>
> MK> header RM_fl_ConsWord6s From =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
> MK> describe RM_fl_ConsWord6s To contains word consisting of consecutive consonants
> MK> score RM_fl_ConsWord6s 1.666 # 460s/1h of 97268 corpus (79437s/17831h) 01/24/04
>
> MK> header RM_fl_ConsWord9 From =~ /\b[bcghjklmnpqrstvwxz]{9,20}\b/
> MK> describe RM_fl_ConsWord9 From contains word consisting of consecutive consonants
> MK> score RM_fl_ConsWord9 1.666 # type=spamp - 137s/0h of 97268 corpus (79437s/17831h) 01/24/04
>
> MK> The rules overlap: 9 consonant in From matches both rules.
> MK> I assume that the RM_fl_ConsWord6s is for a 'To' instead of 'From'.
>
> Yes, the rules overlap. No, they don't overlap completely.
>
> 1) The letter "s" was removed from ConsWord6s, to avoid ham hits. Even
> with that, the rule hit one ham in my corpus.
>
> 2) Yes, many of the 137 spam that hit ConsWord9 also hit ConsWord6s (if
> they didn't contain an "s").
>
> 3) Note the scores: 1/3 of a normal 5.0 required hits threshold. These
> scores were chosen so any email that hit ConsWord6s would score only that
> 1/3, and would need a lot of help to be flagged as spam. Those which
> stretched long enough to also hit ConsWord9 score 3.332 combined, needing
> only a little bit more help to get flagged as spam.
>
> 4) My "to" rules are
>
> header RM_tl_ConsWord6s ToCc =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
> describe RM_tl_ConsWord6s To or Cc contains word consisting of consecutive consonants
> score RM_tl_ConsWord6s 1.000
> #stype RM_tl_ConsWord6s max:1
> #counts RM_tl_ConsWord6s 80s/0h of 125163 corpus (104972s/20191h) 03/28/04
> #max RM_tl_ConsWord6s 81s/0h of 97268 corpus (79437s/17831h) 01/24/04
>
> header RM_tl_ConsWord7 ToCc =~ /\b[bcghjklmnpqrstvwxz]{7,20}\b/
> describe RM_tl_ConsWord7 To or Cc contains word consisting of consecutive consonants
> score RM_tl_ConsWord7 1.000
> #stype RM_tl_ConsWord7 max:1
> #counts RM_tl_ConsWord7 32s/0h of 125163 corpus (104972s/20191h) 03/28/04
>
> I also use
>
> header RM_swt_ConsWord6 Subject =~ /\b[bcghjklmnpqrstvwxz]{6,20}\b/
> describe RM_swt_ConsWord6 subject contains word consisting of consecutive consonants
> score RM_swt_ConsWord6 1.666 # 863s/0h of 97268 corpus (79437s/17831h) 01/24/04
>
> header RM_sl_RandomCons6a Subject =~ /\b[bcdghjklmnpqrstvwxz]{6}\b/i
> describe RM_sl_RandomCons6a Subject contains random-text spamsign
> score RM_sl_RandomCons6a 1.666 # 661s/0h of 97268 corpus (79437s/17831h) 01/24/04
>
> header RM_sl_RandomCons7a Subject =~ /\b[bcdfghjklmnpqrstvwxz]{7}\b/i
> describe RM_sl_RandomCons7a Subject contains random-text spamsign
> score RM_sl_RandomCons7a 1.666 # 628s/2h of 97268 corpus (79437s/17831h) 01/24/04
> # ham: JDBGMGR hoax and response
>
> There's much more overlap between these than between the From rules.
>
> Bob Menschel
>
>
>
>
>
>
--
Met vriendelijke groeten,
Marc Kool
Vioro Consultancy
Re: header_abuse.cf
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Marc,
Tuesday, April 13, 2004, 11:34:12 PM, you wrote:
MK> To SARE, the author of header_abuse.cf
I'm not actively maintaining header_abuse.cf, but I'm the original author
of these rules.
MK> there is a logical mismatch in the rules
"is", or "seems to be"?
MK> header RM_fl_ConsWord6s From =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
MK> describe RM_fl_ConsWord6s To contains word consisting of consecutive consonants
MK> score RM_fl_ConsWord6s 1.666 # 460s/1h of 97268 corpus (79437s/17831h) 01/24/04
MK> header RM_fl_ConsWord9 From =~ /\b[bcghjklmnpqrstvwxz]{9,20}\b/
MK> describe RM_fl_ConsWord9 From contains word consisting of consecutive consonants
MK> score RM_fl_ConsWord9 1.666 # type=spamp - 137s/0h of 97268 corpus (79437s/17831h) 01/24/04
MK> The rules overlap: 9 consonant in From matches both rules.
MK> I assume that the RM_fl_ConsWord6s is for a 'To' instead of 'From'.
Yes, the rules overlap. No, they don't overlap completely.
1) The letter "s" was removed from ConsWord6s, to avoid ham hits. Even
with that, the rule hit one ham in my corpus.
2) Yes, many of the 137 spam that hit ConsWord9 also hit ConsWord6s (if
they didn't contain an "s").
3) Note the scores: 1/3 of a normal 5.0 required hits threshold. These
scores were chosen so any email that hit ConsWord6s would score only that
1/3, and would need a lot of help to be flagged as spam. Those which
stretched long enough to also hit ConsWord9 score 3.332 combined, needing
only a little bit more help to get flagged as spam.
4) My "to" rules are
header RM_tl_ConsWord6s ToCc =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
describe RM_tl_ConsWord6s To or Cc contains word consisting of consecutive consonants
score RM_tl_ConsWord6s 1.000
#stype RM_tl_ConsWord6s max:1
#counts RM_tl_ConsWord6s 80s/0h of 125163 corpus (104972s/20191h) 03/28/04
#max RM_tl_ConsWord6s 81s/0h of 97268 corpus (79437s/17831h) 01/24/04
header RM_tl_ConsWord7 ToCc =~ /\b[bcghjklmnpqrstvwxz]{7,20}\b/
describe RM_tl_ConsWord7 To or Cc contains word consisting of consecutive consonants
score RM_tl_ConsWord7 1.000
#stype RM_tl_ConsWord7 max:1
#counts RM_tl_ConsWord7 32s/0h of 125163 corpus (104972s/20191h) 03/28/04
I also use
header RM_swt_ConsWord6 Subject =~ /\b[bcghjklmnpqrstvwxz]{6,20}\b/
describe RM_swt_ConsWord6 subject contains word consisting of consecutive consonants
score RM_swt_ConsWord6 1.666 # 863s/0h of 97268 corpus (79437s/17831h) 01/24/04
header RM_sl_RandomCons6a Subject =~ /\b[bcdghjklmnpqrstvwxz]{6}\b/i
describe RM_sl_RandomCons6a Subject contains random-text spamsign
score RM_sl_RandomCons6a 1.666 # 661s/0h of 97268 corpus (79437s/17831h) 01/24/04
header RM_sl_RandomCons7a Subject =~ /\b[bcdfghjklmnpqrstvwxz]{7}\b/i
describe RM_sl_RandomCons7a Subject contains random-text spamsign
score RM_sl_RandomCons7a 1.666 # 628s/2h of 97268 corpus (79437s/17831h) 01/24/04
# ham: JDBGMGR hoax and response
There's much more overlap between these than between the From rules.
Bob Menschel