when bayes gets poisened

[Ronan McGlue <r....@qub.ac.uk>]

what to do when bayes shows signs of poisoning???
those germal political mails are being flagged at Bayes_00 scores even 
though they are still hitting 20+ points.

this one only got 10ish

7.3 points, 5.0 required;
	0.0 NO_REAL_NAME           From: does not include a real name
	0.2 INVALID_DATE           Invalid Date: header (not RFC 2822)
	2.7 FORGED_YAHOO_RCVD      'From' yahoo.com does not match 'Received' 
headers
	-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
	[score: 0.0000]
	0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
	[cf: 100]
	1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
	2.2 DCC_CHECK              Listed in DCC 
(http://rhyolite.com/anti-spam/dcc/)
	3.1 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
	[217.41.22.166 listed in sbl-xbl.spamhaus.org]
	0.1 DIGEST_MULTIPLE        Message hits more than one network digest check
	---- End of SpamAssassin results




-- 
========

Regards

Ronan McGlue
Info. Services
QUB

Re: when bayes gets poisened

[Matt Kettler <mk...@evi-inc.com>]

Matt Kettler wrote:
> At 06:36 AM 5/16/2005, Ronan McGlue wrote:
> 
>> what to do when bayes shows signs of poisoning???
>> those germal political mails are being flagged at Bayes_00 scores even
>> though they are still hitting 20+ points.
> 
> 
> First, that's not really a sign of poisoning. Poisoning involves a
> deliberate attempt to evade your bayes.
> 
> In this case, I doubt you've received much German email that was spam,
> and even if you have probably none of it resembled these messages.
> 
> What to do?
> 
> Train.
> 
> Most of the tokens in these messages are likely to be low-count for the
> average person that doesn't speak german, so it shouldn't take long
> before some sa-learn training will start raising their bayes scores.


Follow-up:

I came in this morning and hand trained 4 of these messages.

They now seem to be getting bayes scores over 80.

Re: when bayes gets poisened

[Matt Kettler <mk...@comcast.net>]

At 06:36 AM 5/16/2005, Ronan McGlue wrote:
>what to do when bayes shows signs of poisoning???
>those germal political mails are being flagged at Bayes_00 scores even 
>though they are still hitting 20+ points.

First, that's not really a sign of poisoning. Poisoning involves a 
deliberate attempt to evade your bayes.

In this case, I doubt you've received much German email that was spam, and 
even if you have probably none of it resembled these messages.

What to do?

Train.

Most of the tokens in these messages are likely to be low-count for the 
average person that doesn't speak german, so it shouldn't take long before 
some sa-learn training will start raising their bayes scores. 

Re: when bayes gets poisened

[Loren Wilton <lw...@earthlink.net>]

> what to do when bayes shows signs of poisoning???
> those germal political mails are being flagged at Bayes_00 scores even
> though they are still hitting 20+ points.

Zap it and start over.  Probably be working again in a few hours if you have
reasonable mail flow.  A personal site might take a couple days to get the
required 200/200 messages.

        Loren