spamassassin's sa-learn

[Alan Jackson]

On Tue, 11 Nov 2003 18:09:16 +0800
"M.W. Chang" <mwchang at i-cable.com> wrote:

> 
> have you ever toyed with the Bayesian learner?
> I wonder where SA stores her rules.
> 

It's not *really* Bayesian - I don't think any of them are. They all ignore the
cross-correlation. That is, they don't correct for the fact that enlarge and
p...s frequently occur together, and sum the probabilities. To do it right
is hard.

I used to run a "Bayesian" filter at work, until they disabled Unix e-mail
at the end of October, and it worked fairly well.

At home I run a homebrew. First I run a whitelist of known good addresses,
then I look for e-mail lists, then spamassassin, and then I run my
UniqIP filter. I keep a little database of every IP I have seen in the
handoff to my ISPs, and if I have never seen it before, I drop it into
a special folder. I also note spam IP's in the database as well. About 95%
of my spam currently comes from unique IP's. Apparently the blacklists
are effective enough that the big time spammers now use a "Hedy Lamar" style
multiplexing technology, and blast small loads from many compromised systems.

I'm also working on a spam detector utilizing DNA sequencing technology. 
Seriously!

-- 
-----------------------------------------------------------------------
| Alan K. Jackson            | To see a World in a Grain of Sand      |
| alan at ajackson.org          | And a Heaven in a Wild Flower,         |
| www.ajackson.org           | Hold Infinity in the palm of your hand |
| Houston, Texas             | And Eternity in an hour. - Blake       |
-----------------------------------------------------------------------