>Graphing spam and ham amounts, with the help of spamstats >(http://www.gryzor.com/tools), I notice the legitimate >emails mostly arrive from about 9am, until maybe 7pm, on >working days. > I have written about this and others too. The correct procedure is to submit some proposed code to the developers (of course, I can't because I couldn't write perl code if you told me I could win $1M doing so).
HOWEVER! Your graph is excellent and points out a flaw with your (and my) suggestion. The graph clearly shows when peak Ham flows. It does not tell you when Spam flows! We're looking at the problem backward. :) You see, Spam flows continuously on average, while Ham flows in big bursts. One could use some frequency analysis to try to come up with better rules than a timestamp-only rule which would only be riddled with tons of false-positives and false-negatives. A time-stamp rule (by definition, since all mails have timestamps) would be an almost worthless in terms of separating mails. How about (some ideas) When Ham/Spam ratio is low (i.e., less Ham after hours), score everything higher When Ham frequency drops drastically (end of day), score everything higher When Spam/Ham ratio is high (i.e., more spam after hours), lower the Spam Hit requirements! When Spam/Ham ratio is high for a particular time frame, use it as a multiplier for the regular scores When Spam/Ham ratio is high, weight certain rules that are very "spammy" but can cause false-positives higher (less likelihood for positives so less false-positives?) For example, CTYPE_JUST_HTML +4, BASE64_ENC_TEXT +4... I'm just brainstorming. Upon further reflection, and viewing the graphs, I see that a timestamp-based rule is not going to work. But the idea can be tweaked to bring something useful to light. More discussion and ideas, please! ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
