After very little... lots of spam - How about you? system ok? - Page 2

ioneja · 5 Mar 2014, 10:19 AM

Quote:

Originally Posted by 1611mac

I trust you have checked to make sure that everything is setup correctly

Yes, everything is set up correctly, but it's always good to double-check.

I suspect the initial increase of spam was probably due to the issue brong mentioned (and theoretically fixed). Then perhaps the continued spam may be the luck of the draw, getting on yet another spam database... but it doesn't explain why my Bayes filter isn't doing a good job. Perhaps this new spam I'm marking is Bayes-resistant, i.e.: poisoning my database somehow. Maybe I'll look more closely at the spam and see if there's something different about it.

HM24 · 5 Mar 2014, 12:23 PM

I have been getting more spam too, on a regular basis for the last 6 months.

Due to FM reliability issues, I was looking at the pobox email system. They have an option in the account to also block spam/email by country, which seems to be a handy option.
A lot of my spam seems to be coming from UK or Russia.

Does FM have an option to block by country, I don't know. If it doesn't, it should.

randian · 5 Mar 2014, 01:03 PM

Quote:

Originally Posted by HM24

Does FM have an option to block by country, I don't know.

No it doesn't. Pobox is the only provider I've seen with that feature. I really like how their spam quarantine works too.

ioneja · 5 Mar 2014, 09:39 PM

So as a follow up -- I double-checked that my personal Bayes filter is set up correctly and working, and I also looked more closely at the spam that is getting through.

One example is scoring BAYES_99 3.5 but otherwise still makes it through based on other factors. I looked at the source of the email, and sure enough, there is a large chunk of hidden text that looks like it is copied from some cookbook, which must somehow screw things up for my filter. Very annoying. I mark emails like this as spam, and so far, the most I get out of the Bayes filter is BAYES_99 3.5. Maybe eventually it will tune into the headers better.

Oh well... not going to deal with this for now...

ioneja · 5 Mar 2014, 10:26 PM

I spoke too soon. More spam just floating right into my inbox. Why isn't the Bayes database catching this? I've marked multiple emails almost exactly like this as spam, and the Bayes database shows that they have been added (by incrementing the counter), but the results are the same... it still gets into my inbox. Again, with a big chunk of hidden text from a cookbook. How many do I have to mark as spam before it kills these?

Code:

X-Spam-score: 4.4
X-Spam-hits: BAYES_99 3.5, BAYES_999 0.2, HTML_MESSAGE 0.001, MIME_HTML_ONLY 0.723,
  RP_MATCHES_RCVD -0.001, T_REMOTE_IMAGE 0.01, LANGUAGES en,
  BAYES_USED user, SA_VERSION 3.3.2

Okay, now I'll get back to work...

5kft · 6 Mar 2014, 04:59 AM

This spam issue has been driving me crazy...all the time I am moving spam to Junk now (probably 40-50 spams a day).

Is it correct that BAYES_999 is being scored at 0.2? I thought it was supposed to be 1.0? If it is at 1.0 then this looks like it would largely solve my incoming spam problems. Also, I thought that BAYES_999 meant that the email was 99.9%-100% spam, so it seems like it should have a higher score than 0.2.

For a time I thought FM increased it to 5.0 -- all the spam stopped for me then.

Is there a sieve rule that I could add that could look for BAYES_999 scored as 0.2 in the header and then move that email to Junk?

Thanks!

5kft · 6 Mar 2014, 05:09 AM

Oops, it looks like SA did this, so it's not FM -- http://mail-archives.apache.org/mod_...08@PCCC.com%3E

They changed the score to 0.2.

Oh well...

ioneja · 6 Mar 2014, 05:11 AM

Yeah, that 0.2 seems odd to me too.... If BAYES_999 means 99.9%+, it doesn't make sense to be so low, right?

As for my spam today, it's been ridiculous. I've had way, way too much today. As if some mysterious spam god read my post and decided to toy with me today and flood my inbox.

DrStrabismus · 6 Mar 2014, 05:50 AM

Just setup a rule to file anything that hits BAYES_9* into the spam folder or a temporary folder for asssessment. By the sound of it Bayes is catching the spam, it just isn't scored highly enough. The problem is that there is no correct scoring that's optimal for all cases, but commonly on well trained per-user databases the higher BAYES rules have no significant FP rate.

ioneja · 6 Mar 2014, 06:17 AM

Quote:

Originally Posted by DrStrabismus

Just setup a rule to file anything that hits BAYES_9* into the spam folder or a temporary folder for asssessment. By the sound of it Bayes is catching the spam, it just isn't scored highly enough. The problem is that there is no correct scoring that's optimal for all cases, but commonly on well trained per-user databases the higher BAYES rules have no significant FP rate.

Thanks for the suggestion... I think I'm understanding how this is working now... essentially, if I read that spam result correctly, the personal Bayes database is already correctly identifying the spam I'm getting as 99+ AND 99.9+ chance of spam... but it's only rating 3.5 + 0.2, or 3.7 total for those two issues.... and when combined with other spam indicators, the total rating is only 4.4.

Am I correct in understanding that no further training of the Bayes database will actually help out at this point? Since it's already correctly hitting the BAYES_99 and BAYES_999 flags, then further training is useless, right? The problem is the other flags aren't high enough, and therefore the total spam score doesn't hit 5.0, which I'll assume is my threshold right now....

So how could I just tell it to have a threshold of 4.0 instead of 5.0? Or maybe 4.4, since most of the flood of spam I'm getting lately is falling at about that level?

Honestly, it seems like FM could simply change the BAYES_999 result from 0.2 to 0.8 and it would wipe out most of my spam right now...

DrStrabismus · 6 Mar 2014, 06:43 AM

Personally I wouldn't lower the threshold because it can have a higher risk of false positives from non-Bayes rules.

BAYES_999 is a red-herring IMO, what happened is that it was released by accident with the default score of 1.0 with the rules being mutually exclusive. Subsequently BAYES_99 has been put back to its previous 0.99-1.00 definition so BAYES_999 is now an additional score. If the scores were to be increased then focusing on just BAYES_999 would be sub-optimal.

ioneja · 6 Mar 2014, 07:11 AM

Quote:

Originally Posted by DrStrabismus

Personally I wouldn't lower the threshold because it can have a higher risk of false positives from non-Bayes rules.

BAYES_999 is a red-herring IMO, what happened is that it was released by accident with the default score of 1.0 with the rules being mutually exclusive. Subsequently BAYES_99 has been put back to its previous 0.99-1.00 definition so BAYES_999 is now an additional score. If the scores were to be increased then focusing on just BAYES_999 would be sub-optimal.

Understood, thanks for that explanation. So how does a "normal" user deal with this, then? I'm happy to try various filters/rules (I just set one up to see if it will catch these types of spam), but most people are just going to get slammed with this spam, and if the Bayes flags are already being triggered, no amount of additional "training" will improve the situation of this specific, clever class of spam, that manages to hover in between 4 and 5 rating. What good is a personal Bayes database if it can't handle this type of thing?

5kft · 6 Mar 2014, 07:23 AM

Quote:

Originally Posted by DrStrabismus

BAYES_999 is a red-herring IMO, what happened is that it was released by accident with the default score of 1.0 with the rules being mutually exclusive. Subsequently BAYES_99 has been put back to its previous 0.99-1.00 definition so BAYES_999 is now an additional score. If the scores were to be increased then focusing on just BAYES_999 would be sub-optimal.

Ah, got it, that makes sense. So this is just more new spam that needs to get worse in terms of overall scoring before it passes the right thresholds...sigh.

This has been helpful -- thanks

n5bb · 6 Mar 2014, 07:45 PM

Quote:

Originally Posted by HM24

... Does FM have an option to block by country, I don't know. If it doesn't, it should.

It's easy to block or classify as spam messages from certain countries. Earlier in the thread at this link I describe how to customize your spam threshold and use address book whitelisting to reduce false positives. Use the Advanced>Rules screen and be sure to apply your new rules. You can add multiple rules to block several countries. See:
http://www.emaildiscussions.com/show...947#post559947

The country code list is shown in the first column at:
http://en.wikipedia.org/wiki/ISO_316..._code_elements

Bill

ioneja · 6 Mar 2014, 09:57 PM

BTW, I've set up a new rule that seems to help so far:

1) I created a new folder to collect those clever spams that don't quite make it to a rating of 5.0, but are above a rating of 4.2.

2) I created a new rule "Spam score >= 4.2" and have it file those emails into the folder created above.

So far it is catching those annoying, hard-to-get spam that were still making it through to my inbox. The only problem is that some false positives have already shown up--- so I am using those to further train my Bayes filter with more HAM.

Crossing fingers this does the trick. Thanks to those who suggested similar ideas in this thread.

5 Mar 2014, 12:23 PM	#17
HM24 Junior Member Join Date: Jun 2011 Posts: 20	country blocking I have been getting more spam too, on a regular basis for the last 6 months. Due to FM reliability issues, I was looking at the pobox email system. They have an option in the account to also block spam/email by country, which seems to be a handy option. A lot of my spam seems to be coming from UK or Russia. Does FM have an option to block by country, I don't know. If it doesn't, it should.

5 Mar 2014, 10:26 PM	#20
ioneja Cornerstone of the Community Join Date: Jul 2011 Posts: 713	I spoke too soon. More spam just floating right into my inbox. Why isn't the Bayes database catching this? I've marked multiple emails almost exactly like this as spam, and the Bayes database shows that they have been added (by incrementing the counter), but the results are the same... it still gets into my inbox. Again, with a big chunk of hidden text from a cookbook. How many do I have to mark as spam before it kills these? Code: X-Spam-score: 4.4 X-Spam-hits: BAYES_99 3.5, BAYES_999 0.2, HTML_MESSAGE 0.001, MIME_HTML_ONLY 0.723, RP_MATCHES_RCVD -0.001, T_REMOTE_IMAGE 0.01, LANGUAGES en, BAYES_USED user, SA_VERSION 3.3.2 Okay, now I'll get back to work...

5 Mar 2014, 09:39 PM	#19
ioneja Cornerstone of the Community Join Date: Jul 2011 Posts: 713	So as a follow up -- I double-checked that my personal Bayes filter is set up correctly and working, and I also looked more closely at the spam that is getting through. One example is scoring BAYES_99 3.5 but otherwise still makes it through based on other factors. I looked at the source of the email, and sure enough, there is a large chunk of hidden text that looks like it is copied from some cookbook, which must somehow screw things up for my filter. Very annoying. I mark emails like this as spam, and so far, the most I get out of the Bayes filter is BAYES_99 3.5. Maybe eventually it will tune into the headers better. Oh well... not going to deal with this for now...

6 Mar 2014, 04:59 AM	#21
5kft Junior Member Join Date: Oct 2011 Posts: 22	This spam issue has been driving me crazy...all the time I am moving spam to Junk now (probably 40-50 spams a day). Is it correct that BAYES_999 is being scored at 0.2? I thought it was supposed to be 1.0? If it is at 1.0 then this looks like it would largely solve my incoming spam problems. Also, I thought that BAYES_999 meant that the email was 99.9%-100% spam, so it seems like it should have a higher score than 0.2. For a time I thought FM increased it to 5.0 -- all the spam stopped for me then. Is there a sieve rule that I could add that could look for BAYES_999 scored as 0.2 in the header and then move that email to Junk? Thanks!

6 Mar 2014, 05:09 AM	#22
5kft Junior Member Join Date: Oct 2011 Posts: 22	Oops, it looks like SA did this, so it's not FM -- http://mail-archives.apache.org/mod_...08@PCCC.com%3E They changed the score to 0.2. Oh well...

6 Mar 2014, 05:11 AM	#23
ioneja Cornerstone of the Community Join Date: Jul 2011 Posts: 713	Yeah, that 0.2 seems odd to me too.... If BAYES_999 means 99.9%+, it doesn't make sense to be so low, right? As for my spam today, it's been ridiculous. I've had way, way too much today. As if some mysterious spam god read my post and decided to toy with me today and flood my inbox.

6 Mar 2014, 05:50 AM	#24
DrStrabismus The "e" in e-mail Join Date: May 2002 Posts: 2,804	Just setup a rule to file anything that hits BAYES_9* into the spam folder or a temporary folder for asssessment. By the sound of it Bayes is catching the spam, it just isn't scored highly enough. The problem is that there is no correct scoring that's optimal for all cases, but commonly on well trained per-user databases the higher BAYES rules have no significant FP rate.

6 Mar 2014, 06:43 AM	#26
DrStrabismus The "e" in e-mail Join Date: May 2002 Posts: 2,804	Personally I wouldn't lower the threshold because it can have a higher risk of false positives from non-Bayes rules. BAYES_999 is a red-herring IMO, what happened is that it was released by accident with the default score of 1.0 with the rules being mutually exclusive. Subsequently BAYES_99 has been put back to its previous 0.99-1.00 definition so BAYES_999 is now an additional score. If the scores were to be increased then focusing on just BAYES_999 would be sub-optimal.

6 Mar 2014, 09:57 PM	#30
ioneja Cornerstone of the Community Join Date: Jul 2011 Posts: 713	BTW, I've set up a new rule that seems to help so far: 1) I created a new folder to collect those clever spams that don't quite make it to a rating of 5.0, but are above a rating of 4.2. 2) I created a new rule "Spam score >= 4.2" and have it file those emails into the folder created above. So far it is catching those annoying, hard-to-get spam that were still making it through to my inbox. The only problem is that some false positives have already shown up--- so I am using those to further train my Bayes filter with more HAM. Crossing fingers this does the trick. Thanks to those who suggested similar ideas in this thread.