Reducing false positives

[Ken Scott <ke...@geodax.com>]

Suppose a guy named Tom Jones has an email address like 
tjones@somedomain.net or
tomj@somedomain.net or even
tom.jones@somedomain.net

Spammers probably wouldn't know his full name where many senders would
(and many of those would use it also) so...

Wouldn't an appropriate ruleset be something like 

body FIND_MY_NAME_RULE  /tom\bjones/i
score FIND_MY_NAME_RULE -10.0
describe FIND_MY_NAME_RULE    simple rule looks for the user name

I'm not sure if I have the syntax exactly right..
Similar rules for only the first or last name (whichever was NOT part of
the email address) would also be useful with even larger (more negative
scores).  These would be put in local.cf
Is this a good idea and how can it be improved? Thanks in advance
Ken

Re: Reducing false positives

[Loren Wilton <lw...@earthlink.net>]

If you know the format of the name that SHOULD be in quotes, then you can
check it and give some bad points if the spammer gets it wrong.  I have
rules that do that for my case.  The problem is that it isn't something that
SA can easily get its hands on, so it would have to be a custom rule for
every user.  This could be difficult on large sites I suspect.

        Loren

Re: Reducing false positives

["Adam D. Lopresto" <ad...@pubcrawler.org>]

On Wed, 16 Jun 2004, Ken Scott wrote:

> Wouldn't an appropriate ruleset be something like
>
> body FIND_MY_NAME_RULE  /tom\bjones/i
> score FIND_MY_NAME_RULE -10.0
> describe FIND_MY_NAME_RULE    simple rule looks for the user name

The general idea sounds promising, though I think you'd probably want to test
it for a while.

Your regexp won't work, though, because \b matches the zero length boundary
between a word character and a non-word character.  But you're asserting a word
character on both sides (m and j), so it can't possibly match.  I'd suggest
instead something like

body FIND_MY_NAME_RULE  /\btom jones\b/i

Though there are a lot of variants depending on what you want to allow (for
instance, can there be a middle name?  If so, do we care what it is?)  For Tom
Albert Jones we could do something fancy like

body FIND_MY_NAME_RULE /\bT(?:om|homas) (?:A(?:\.|l(?:bert)?)? )?Jones\b/i

To accept Thomas Albert Jones, Tom A Jones, or any number of other things.

I also suspect this would depend a lot on the kind of spam you, personally,
get.  I know on one my Yahoo! account, where I foolishly filled in my real
information, I get lots of spam that has my name in it.  Not sure how they got
it, but they definitely seem to have it.  So it probably wouldn't work for
everyone, but might work well for you.  If you have a constant sig, you could
also create rules with parts of it, so that real replies to you would get a
bonus (while, unfortunately, rewarding people who don't trim their replies.
C'est la vie).
-- 
Adam Lopresto
http://cec.wustl.edu/~adam/

You said love was just a lie, but I could tell that you were lying.
		--They Might Be Giants

Re: Reducing false positives

[Matt Kettler <mk...@comcast.net>]

At 10:26 AM 6/16/04 -0400, Ken Scott wrote:
>Wouldn't an appropriate ruleset be something like
>
>body FIND_MY_NAME_RULE  /tom\bjones/i
>score FIND_MY_NAME_RULE -10.0
>describe FIND_MY_NAME_RULE    simple rule looks for the user name
>
>I'm not sure if I have the syntax exactly right..
>Similar rules for only the first or last name (whichever was NOT part of
>the email address) would also be useful with even larger (more negative
>scores).  These would be put in local.cf
>Is this a good idea and how can it be improved? Thanks in advance
>Ken

Well, the \b is a zero-width assertion, so the above rule won't match 
anything. \b is really most useful at the beginning and end of things, not 
so much in the middle except in some special cases. Use \W (non-word 
character) or \s (space, tab, etc) instead.

I'd also improve to force breaks at the start and end:
         body FIND_MY_NAME_RULE  /\btom\Wjones\b/i

Here's one Modified to match "tjones" or "tom jones" (or "tom.jones" for 
that matter)
         body FIND_MY_NAME_RULE  /\bt(om\W)?jones\b/i