Matus UHLAR - fantomas wrote:
<snip/>
We have significantly upgraded our plugin for SpamAssassin.
<snip/>
looks to me like collaborative system containg functionalities like those in
SA already (dcc,razor.pyzor,blacklists) and bayes
Well, I suppose all collaborative systems look alike on some level. SNF
learning happens on two levels out front (and many behind the scenes).
The two pieces that happen on SNFServer (at the MTA) are:
1. GBUdb keeps track of IP reputation based on sources matching pattern
rules or not. This is shared with all other nodes in the SNF system
within 90 seconds. Also note that this piece customizes itself to the
system it lives on -- after a time it gives more weight to it's own
experiences than that of the cloud -- so a system that gets nothing but
spam from an IP will have a different local reputation than a system
that gets more legitimate messages from that IP.
2. The pattern rules and heuristics must compete to represent messages.
Those that out-compete their peers remain active while the others are
retired. Retired rules are automatically reactivated when needed -- so
the content scanning system is always evolving toward the best mix of
rules and is always changing so it's harder to predict against.
---
BTW: We've had a little confusion about the plugin in that it won't work
all by itself -- SNF4SA Requires SNFServer -- it connects SpamAssassin
to SNFServer where the heavy lifting is done.
SNFServer is probably missing or not running If you get an error like this:
[32343] warn: (Snf4sa: Error from SNFServer: cannot connect to socket
(Connection refused) at /etc/mail/spamassassin/snf4sa.pm line 466.
SNF Server/Client can be found for *nix and Win* platforms here:
http://www.armresearch.com/products/index.jsp
_M
