Thank you very much. I will absorb this and share what I learn
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Wednesday, September 08, 2004 2:00 PM > To: Harry Vanderzand > Cc: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Test needed along with sniffer > > > On Wednesday, September 8, 2004, 11:13:18 AM, Harry wrote: > > HV> I am testing sniffer right now and wonder if I need to > run all the > HV> other tests along side it. > > Well, you can probably get by without the other tests, but > since you have Declude it would be MUCH better if you keep > the other tests in place. Declude's strength is that it > allows you to aggregate a variety of tests for greater > accuracy. Sniffer is very, very good, but you will certainly > see some benefit by using it along with other tests. > > HV> I am trying to reduce my daily workload of analyzing the > "spamtrap" > HV> and hope that sniffer and surbl will do this. > > Sniffer is perfect for that - particularly if you share your > spamtrap data with us. Put another way, if you allow us to > use your spamtrap then we will be taking over this work for > you. All we need is POP3 account information and some details > on how your spamtrap was formed so that we can properly > classify it in our SPHUD (Spam Processing Heads Up Display). > > HV> Do I even need surbl? > > Probably not. One of the AI elements in our robots > crossreferences incoming spamtrap data with SURBL and other > tests. More often than not we have the domain tagged before > we see it in SURBL, and if we don't we grab it quickly. > > HV> Any advice in this matter would be greatly appreciated. > > I recommend reviewing the Spam Test Quality Analysis: > > <http://www2.spamchk.com/public.html> > > You can use this to help tune your Declude configuration. I > recommend applying the forumula: > > W = (a^2)100 > > Where (W) is the individual test weight (magnitude) based on > test accuracy and (a) is the accuracy measured in the > analysis (SA = spam-test accuracy, HA = ham-test accuracy). [ > Regarding (magnitude), ham tests generate negative weights > and spam tests generate positive weights. W will always be a > positive value, so if you use an HA value for (a) then you > will want to apply a negative W as your weight in Declude. ] > > For example, > > SNIFFER SA = 0.95, so W = ((0.95)^2)*100 = 90.25, Weight = 90. > > FIVETEN-SRC SA = 0.59, so W = ((0.59)^2)*100 = 34.81, Weight = 35. > > NOLEGITCONTENT HA=0.38, so > W = ((0.38)^2)*100 = 14.44, Weight = -14 > > -- This test is measured when the test does not fail, so -14 > must go in second weight column, not the first. > > If you use this analysis you should have your "hold weight" > at or about 100. If you set your hold weight lower than 100, > you will capture more spam at the risk of more false > positives. If you set your hold weight higher than 100 you > will have fewer false positives and more spam. > > !! This is research in progress - these formulas appear to > work very well in preliminary testing. If you are already > happy with your weighting system then you should probably > stick with that until this theory has been tested further. !! > > We are developing a utility to do this work automatically. > In the mean time, you can go through your test weights > manually. You shouldn't have to do this frequently. > > Hope this helps, > _M > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
