>I wish I understood more of the code to be able ...
me to :):):) some times!?
>suggesting fixes rather than just reporting problems
But reporting helps allot to find bugs.
Thomas
Von: Colin <[email protected]>
An: [email protected]
Datum: 10.05.2012 10:21
Betreff: Re: [Assp-test] Antwort: HMM check in latest versions
That's great Thomas,
I wish I understood more of the code to be able to help you out by
suggesting fixes rather than just reporting problems!
All the best,
Colin.
On 10/05/2012 07:54, Thomas Eckardt wrote:
> Colin,
>
> There is an issue in 12130 - but I've fixed it - the fix is still in
> testmode on my prod system.
>
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] [scoring] 206.82.216.70
> <sender> to: recipient info: HMM-Check has taken 1 seconds and has
given
> 72 results
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient HMM Check [scoring] - Prob: 1.00000 / Confidence: 0.00772 =>
> confident.spam
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient Message-Score: added 49 for HMM Probability: 1.0000, total
score
> for this message is now 54
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient PB-IP-Score for '206.82.216.70' is 143, added 49 for HMM
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] [scoring] 206.82.216.70
> <sender> to: recipient info: Bayesian-Check has taken 0 seconds
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient Bayesian Check [scoring] - Prob: 1.00000 / Confidence: 0.00000
> => doubtful.spam
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient Message-Score: added 35 for Bayesian Probability: 1.00000,
total
> score for this message is now 89
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient PB-IP-Score for '206.82.216.70' is 178, added 35 for Bayesian
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] [Penalty] 206.82.216.70
> <sender> to: recipient [spam found] (totalscore for 206.82.216.70 is
178,
> last bad penalty was 'Bayesian') [About your employee retention plan...]
> -> c:/assp/spam/About_your_employee_retention_plan--53505.eml;
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient deleting spamming safelisted tuplet:
> (206.82.216.0,cybercoders.com) age: 3s
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient [SMTP Error] 554 5.7.1 Error, you have got a penalty - to much
> bad emails
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient [SMTP Status] 451 4.7.1 Please try again later
> May-10-12 00:17:39 M1-01856-00905 [Worker_2] 206.82.216.70<sender> to:
> recipient info: start damping on closing connection (17)
>
>
> It seems to be working - if the issue is gone, I'll release this version
> tomorrow (or this evening). I'm still less on time - sorry.
>
> Thomas
>
>
>
>
> Von: Colin<[email protected]>
> An: ASSP development mailing list<[email protected]>
> Datum: 09.05.2012 13:05
> Betreff: [Assp-test] HMM check in latest versions
>
>
>
> Hi there,
>
> Just to follow on from some previous emails. I seem to have deleted them
> so I can't carry on the conversation.
>
> I still seem to be having some issues with HMM, even with 12130. All the
> Berkeley modules are there and working but with the recent versions it
> seems like incoming mail is not being put through the HMM check. If I
> drop back to versions before the change to a single database table, HMM
> works without this issue.
>
> Rebuild reckons everything is fine:
>
> 2012-05-09 10:43:43 Start populating Hidden Markov Model. HMM-check is
> disabled for this time!
> 2012-05-09 10:43:44 start populating Hidden Markov Model with 2,517,965
> records!
> 2012-05-09 11:39:41 Finished populating Hidden Markov Model with
> 2,517,965 records!
> 2012-05-09 11:39:41 Finished populating Hidden Markov Model. HMM-check
> is now enabled again!
>
>
> If I put mail into the analyser I get all the expected HMM results.
> Below is an example of the maillog for a message that produces the
> following in the analyser:
>
> *Hidden-Markov-Model Spam Probability:*
>
> *combined HMM spam probability*: 1.0000 - got 6 - used 6
> most
> significant results
>
>
> 2012-05-09 11:53:55 [Worker_1] Connected: 178.162.148.85:54296>
> 2.2.2.2:25> 127.0.0.1:125
> 2012-05-09 11:53:55 [Worker_1] 178.162.148.85 [SMTP Reply] 220
> mail2.smtphost.co.uk ESMTP Exim 4.76 Wed, 09 May 2012 11:53:55 +0100
> 2012-05-09 11:53:55 [Main_Thread] Info: Main_Thread freed by idle
> Worker_1 in 0.057 seconds
> 2012-05-09 11:53:55 [Worker_1] 178.162.148.85 [SMTP Reply] 250 HELP
> 2012-05-09 11:53:55 [Worker_1] 178.162.148.85 info: injected STARTTLS
> request to 127.0.0.1
> 2012-05-09 11:53:56 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> [SMTP Reply] 250 OK
> 2012-05-09 11:53:56 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] [SMTP Reply] 250 Accepted
> 2012-05-09 11:53:56 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] [SMTP Reply] 354 Enter
> message, ending with "." on a line by itself
> 2012-05-09 11:53:56 m1-60836-12996 [Worker_1] [TLS-out] [MsgID]
> 178.162.148.85<[email protected]> to: [email protected] [scoring]
> (Message-ID missing)
> 2012-05-09 11:53:56 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] Message-Score: added 10
> (midmValencePB) for Message-ID missing, total score for this message is
> now 10
> 2012-05-09 11:53:56 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] Message-Score: added -10
> (spfpValencePB) for SPF pass, total score for this message is now 0
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] Bayesian Check
[monitoring]
> - Prob: 1.00000 => spam
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] [Plugin] calling plugin
> ASSP_AFC
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] [Plugin] calling plugin
> ASSP_DCC
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [TLS-out] [MessageOK]
> 178.162.148.85<[email protected]> to: [email protected] message ok
> [People can be just plain awkward] ->
>
/usr/local/assp/store/notspam/People_can_be_just_plain_awkward--57661.eml
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] [SMTP Reply] 250 OK
> id=1SS4Wq-0000lu-Ch
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [TLS-out] 178.162.148.85
> <[email protected]> to: [email protected] [SMTP Reply] 221
> mail2.smtphost.co.uk closing connection
> 2012-05-09 11:53:57 m1-60836-12996 [Worker_1] [SSL-out] 178.162.148.85
> <[email protected]> to: [email protected] finished message -
received
> DATA size: 25.50 kByte - sent DATA size: 26.05 kByte
> 2012-05-09 11:53:57 [Worker_1] Disconnected: 178.162.148.85 - processing
> time 2 seconds
>
------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond.
Discussions
> will include endpoint security, mobile security and the latest in
malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Assp-test mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
>
>
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential,
legally
> privileged and protected in law and are intended solely for the use of
the
>
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no
> known virus in this email!
> *******************************************************
>
>
>
>
>
------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond.
Discussions
> will include endpoint security, mobile security and the latest in
malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>
>
> _______________________________________________
> Assp-test mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/assp-test
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
