Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » Huge increase of low score spam
Huge increase of low score spam [message #607] Mon, 15 November 2004 12:38
Lorian
Messages: 1
Registered: November 2004
Junior Member
Over the last few weeks we are getting flooded with spam that has a very low spam score and is thus un-tagged. Today alone we had over 300 spam mails all with NST scores of between 1.2 and 3.0

We run NST set to 5.0 (set lower results in too many false-positives) and also use the blacklist checks yet each week more and more 'clever' spam is getting through.

Are there likely to be any future options within NST to combat this?


L
Re: Huge increase of low score spam [message #608 is a reply to message #607] Tue, 16 November 2004 13:48 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> Over the last few weeks we are getting flooded with spam that
> has a very low spam score and is thus un-tagged. Today alone we
> had over 300 spam mails all with NST scores of between 1.2 and
> 3.0
>
> We run NST set to 5.0 (set lower results in too many
> false-positives) and also use the blacklist checks yet each
> week more and more 'clever' spam is getting through.
>
> Are there likely to be any future options within NST to
> combat this?

These options are already present in the current release of NoSpamToday.
The most effective one is teaching the Bayes database. Please see

http://www.byteplant.com/support/nospamtoday/howtolearnspam.html

and (if you are running an Exchange server)

http://www.byteplant.com/support/nospamtoday/howtolearnexchange.html

for details.



Customer Support
Byteplant GmbH
Re: Huge increase of low score spam [message #609 is a reply to message #607] Mon, 22 November 2004 13:24 Go to previous message
Mario Konst
Messages: 12
Registered: November 2004
Junior Member
We have the same problem. We already use learn ham/spam with thunderbird (exchange env.) Today I will install the latest minor upgrade. But it's quite obvious how low spam scores are. I personally think it has something to do with the upgrade to the October 29th version. Before that stopping spam worked much better.
Re: Huge increase of low score spam [message #610 is a reply to message #607] Tue, 30 November 2004 16:42 Go to previous message
tomohare
Messages: 4
Registered: November 2004
Junior Member
My 2 cents is the fact that also many of these Spams use Pictures and not text. So it will be harder to try and filter them. The question is how do you filter pictures???

But I feel your pain, personally I get ~50 Spam emails a day to my private account. I have just added a very private account to allow only certain people to send me email -- mainly for when I am mobile (Smart Phone, Laptop, etc.)




~ Thomas O'Hare ~
President, RedTile, Inc. -- DBA: RedTile Software
Web, Wireless, Network, Database & Systems Software
http://www.RedTile.Com/ or http://www3.RedTile.Com/
Re: Huge increase of low score spam [message #611 is a reply to message #607] Tue, 21 December 2004 10:41 Go to previous message
Mario Konst
Messages: 12
Registered: November 2004
Junior Member
After using the latest version some time, I suspect that some mechanism is altering the balance between Spam/Ham. The stacked view over time seems to trend a bit towards more ham than spam, while in fact it seems more spam is coming through.

Probable cause for this is autolearning(at least if I think it works this way):
Some mail is autolearned as Ham, while some is autolearned as Spam. Most mail however has scores between the limits and are not autolearned. We train the database with spam that came through. I suspect we autolearn more ham than spam and trained spam together and therefore lowering spamscores for certain words etc.

The result of this will be that over time less spam is identified as spam, while further lowering the scores because more mail will be autolearned as ham. For maximum effect we would like to keep using autolearn ( people can be learned to put spam in public spamfolder, but noone will put ham in public hamfolder, except for it-personel)

So finally the question:
How to effectively configure NST to bend the trend from ham to spam, without increasing the change of FP's to much?

Mario Konst

Aan de Stegge B.V.
The Netherlands.
Re: Huge increase of low score spam [message #612 is a reply to message #611] Tue, 21 December 2004 11:11 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
[...]

> I suspect we autolearn more ham than spam and trained
> spam together and therefore lowering spamscores for certain
> words etc.
>
> So finally the question:
> How to effectively configure NST to bend the trend from ham
> to spam, without increasing the change of FP's to much?

To learn less ham, you can tweak the autolearn threshold score. SpamAssassin's default is 0.1, which we believe is a bit high. For this reasons it is set to -1.0 on new NoSpamToday! installations:

bayes_auto_learn_threshold_nonspam -1.0

You can decrease the value further if you think.

To find how many ham and how many spam tokens are in the database, type the following command while in the installation directory:

sa\sa-learn -c sa\ruleset --dump magic



Customer Support
Byteplant GmbH
Re: Huge increase of low score spam [message #613 is a reply to message #607] Tue, 21 December 2004 17:54 Go to previous message
coffeyc1
Messages: 2
Registered: December 2004
Junior Member
I agree, something changed after the latest update. I had gotten the software tweaked so that I was only getting 1 maybe 2 SPAM's a day in my inbox. Now I am getting upwards of 50 or 60 a day getting through. I have the same ruleset as before, the only thing I changed was updating the software. I had updated it everytime along the way as well, so it was definetely the last update that has caused this. I am at the point where I think I may have to reload the previous version, because it is just not working properly now.
Previous Topic: sa-learn in Windows XP
Next Topic: bayes databases lock failed
Goto Forum:
  


Current Time: Sun Dec 11 03:13:00 CET 2016