> -----Original Message----- > From: Charles Gregory > Sent: Saturday, December 13, 2003 12:56 PM [...] > > On Sat, 13 Dec 2003, Bryan Hoover wrote: > > > But if we were able to check the COUNT of how many times a particular > > > rule was matched, we could easily distinguish runaway use of > obfuscation. > > It is an interesting idea. It is analysis of the analysis, or meta > > analysis. >
Alternatively, offer a max count and pattern. The actual count would be expressed as a percentage of the maximum, and this would be multiplied by the score. For example, raw_body_count BC_HTML_FONT 10 /<FONT/i description BC_HTML_FONT use of HTML font score BC_HTML_FONT 3 In this scenario, if a <font> directive were found twice, it would be weighted 2/10*3, or 0.6. If it were found 10 times or more, it would receive the full score of 3. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
