Thank you Pete for your dedication !!

-----Original Message-----
From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf Of 
Pete McNeil
Sent: Tuesday, December 01, 2015 10:22 PM
To: Message Sniffer Community
Subject: [sniffer] Re: Short Match FPs.

Hi folks,

Good News!

After much research and experimentation we have determined that some time on 
Nov 28 a corrupted rule entered the rulebase and caused the intermittend 
short-match problem. We have removed a group of rules surrounding that 
timeframe and have observed a 3 sigma drop in the rate of short-match events. 
This indicates that the problem is solved and not likely to return.

Now that we know this kind of event is possible (it's not supposed to be
mathematically) we will be building a detection and mitigation strategy into 
the engine... just in case it does happen again. Once in two decades makes that 
seem unlikely.

We will also be continuing our research on the sequestered rules to identify 
the one(s) that caused the problem and identify a way to prevent that recurring.

In the mean time the detection mechanisms we used to monitor our experiments 
will remain in place so that if we do see any future events we will be able to 
identify them much more quickly.

Sorry for the trouble,

Thanks for your patience and continued support!

_M

--
Pete McNeil
Chief Scientist
ARM Research Labs, LLC
www.armresearch.com
866-770-1044 x7010
twitter/codedweller 


#############################################################
This message is sent to you because you are subscribed to
  the mailing list <sniffer@sortmonster.com>.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: <sniffer-...@sortmonster.com>
To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com>
To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com>
Send administrative queries to  <sniffer-requ...@sortmonster.com>






#############################################################
This message is sent to you because you are subscribed to
  the mailing list <sniffer@sortmonster.com>.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: <sniffer-...@sortmonster.com>
To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com>
To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com>
Send administrative queries to  <sniffer-requ...@sortmonster.com>

Reply via email to