On Sun, Mar 24, 2002 at 04:44:59PM -0800, Matthew Cline wrote: > I got the idea of creating rules that would be triggered depending upon what > other rules had already been triggered, so that you could combine different > tests for greater accuracy. For instance, the rule US_DOLLARS is described > as a "Nigerian scam key phrase", but it's separate from the NIGERIAN_SCAM > rules; the different rules simply add up if both of them are present. But if > there a rule like: > > meta NIGERIAN_META (NIGERIAN_SCAM || NIGERIAN_SCAM_2) && US_DOLLARS >
This is a pretty good idea. I think it should be fairly easy for the GA, too. > Another meta-rules idea is to have meta-rules about the number of ordinary > positive-scored rules that have been triggered by a mail. Out of my > collection of 310 spam messages, only 10 of them triggered less than 4 rules > (both positive and negative rules, I haven't taken the time to sort them > out). We could subtract a small amount from the score if only 2, 3 or 4 > positive-scored rules were triggered, to try to reduce false positives; > sysadmins could manually increase the amount subtracted to generate less > false positives. Also, since a spam that triggered only 5 or 6 rules with > less than 1.0 scores could sneak in under the threshold, we could slightly > increase the scores of messages with that many rules triggered. This isn't such a great idea; the scores are already set so that rules that occur frequently with others score slightly less, while rules that are often only alone, but common spam signs are scored higher. Essentially, this isn't needed. > > Finally, a more risky idea: score multipliers. For instance, since rules > like SECTION_301 and BILL_1618 almost never appear outside of spam, we could > multiply the whole score by 1.1 if they are present. I'm not so sure if this > is a good idea. It isn't. Total score isn't a very important factor, while positive/negative identification is. Instead of multiplying, we'd be better off increasing the scores of those rules; but the GA already does this. -- Duncan Findlay _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
