On Thu, Oct 26, 2006 at 12:19:23PM -0400, Peter H. Lemieux wrote: > >No, because there are going to be a lot of mails that would hit that. > > Really? Maybe it's because I live in the US, but I can't think of a > legitimate message I've ever received consisting only of a base64 blob.
You look at a lot of raw messages? ;)
> Our of curiosity, how frequently does this appear in the SA ham corpus?
Well, there isn't "a" SA corpus, so there's no answer to that question. As
for how often it happens in my corpus, I don't know I'd have to write a rule
and run it against the messages.
> Rather than making anyone else do the work for me, is there something I
> can read about how to determine the frequency of different message
> features appearing in the corpus?
You can generate some rules and use mass-check to run against your own corpus
to gather some statistics. I'm willing to run some rules for you against my
corpus if you want. I just don't have time to come up with the rules right
now.
--
Randomly Selected Tagline:
strrev(strcpy("xus yti "+7,"varg")-7)[0]='G'
pgpF2Hq77D2uV.pgp
Description: PGP signature
