Hi, I just have three spreadsheets (one for each type: Spam, Positives and Not sure) and enter the information manually. I won't do this till the end of time, but I'm trying to find a good weighting to avoid false positives and hold spam.
Kevin's solution seems to be more professional, hope I have the possibility to try it sometimes! Here's the spreadsheet: A B C 1 BADHEADERS 8 0 2 BASE64 4 0 3 DNS 3 0 4 HELOBOGUS 6 0 5 IPNOTINMX 0 0 6 ipinmx -3 =IF(C5=0;1;0) 7 MAILFROM 12 0 8 NOABUSE 2 0 9 NOPOSTMASTER 1 0 10 REVDNS 4 0 11 ROUTING 4 0 12 PERCENT 10 0 13 SPAMHEADERS 3 0 14 Weight =SUMPRODUCT($B1:$B13;C1:C13) 15 16 WEIGHT10 =IF(C14>=10;1;0) 17 WEIGHT15 =IF(C14>=15;1;0) 18 WEIGHT20 =IF(C14>=20;1;0) For each mail I copy column C to a new column and enter "1" in the row where the test failed (except rows with a formula in it). # mails =COUNT(Dx:Xx) # failed tests =SUM(Dx:Xx) etc (min, max, avg). Best wishes Michael > -----Ursprüngliche Nachricht----- > Von: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Auftrag von Mark Brody > Gesendet: Freitag, 11. Juli 2003 10:00 > An: [EMAIL PROTECTED] > Betreff: RE: [Declude.JunkMail] re: Spam Statistics > > > How is this report being generated? > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > interactiveaustria > Sent: Friday, July 11, 2003 12:24 AM > To: [EMAIL PROTECTED] > Subject: AW: [Declude.JunkMail] re: Spam Statistics > > > Hi, > > got some overall statistics since I run Declude Junkmail Light (i.e. > 07-02-2003 - not too long...) I did not count mail that passed all tests, > and I could not count mail, that does not go to me except if the total > weight is 15 or more. I decided if a mail is Spam or not. > > Mails received: 412 > Spam Mails: 194 > Positives: 216 > Not sure: 2 > > Tests failed in Spam-Mail > ========================= > Test Weight # % > ---------------------------------- > BADHEADERS...........8...108...56% > BASE64...............4....19...10% > DNS..................3.....9....5% > HELOBOGUS............6....47...24% > IPNOTINMX............0...194..100% > ipimmx..............-3.....0....0%* > MAILFROM............12.....5....3% > NOABUSE..............2....82...42% > NOPOSTMASTER.........1....91...47% > REVDNS...............4....67...35% > ROUTING..............4....89...46% > PERCENT.............10.....0....0% > SPAMHEADERS..........3....29...15% > ---------------------------------- > WEIGHT10.................123...63% > WEIGHT15..................69...36% > WEIGHT20..................31...16% > ---------------------------------- > Min. Weight......................0 > Max. Weight.....................25 > Avg. Weight.....................12 > ---------------------------------- > > Tests failed in Positives > ========================= > Test Weight # % > ---------------------------------- > BADHEADERS...........8.....1....0% > BASE64...............4.....1....0% > DNS..................3.....0....0% > HELOBOGUS............6.....0....0% > IPNOTINMX............0...205...95% > ipimmx..............-3....11....5%* > MAILFROM............12.....1....0% > NOABUSE..............2.....6....3% > NOPOSTMASTER.........1....25...12% > REVDNS...............4....14....6% > ROUTING..............4.....2....1% > PERCENT.............10.....0....0% > SPAMHEADERS..........3.....6....3% > ---------------------------------- > WEIGHT10...................1....0% > WEIGHT15...................0....0% > WEIGHT20...................0....0% > ---------------------------------- > Min. Weight......................0 > Max. Weight.....................12 > Avg. Weight......................1 > ---------------------------------- > > Tests failed in "Not Sure" > ========================== > Test Weight # % > ---------------------------------- > BADHEADERS...........8.....0....0% > BASE64...............4.....0....0% > DNS..................3.....0....0% > HELOBOGUS............6.....2..100% > IPNOTINMX............0.....1...50% > ipimmx..............-3.....1...50%* > MAILFROM............12.....0....0% > NOABUSE..............2.....0....0% > NOPOSTMASTER.........1.....0....0% > REVDNS...............4.....2..100% > ROUTING..............4.....0....0% > PERCENT.............10.....0....0% > SPAMHEADERS..........3.....0....0% > ---------------------------------- > WEIGHT10...................1...50% > WEIGHT15...................0....0% > WEIGHT20...................0....0% > ---------------------------------- > Min. Weight......................7 > Max. Weight.....................10 > Avg. Weight......................9 > ---------------------------------- > > * ipinmx is not really a test, I just use it to generate the weight of -3. > I'm doing the statistics with a spreadsheet software (this is handmade and > time-consuming - Kevin, what do you use?). > > Conclusion: I may raise the weight for DNS and HELOBOGUS, as they seem not > to appear in the positives. Maybe BADHEADERS, BASE64 and MAILFROM as well, > but not so much, and the ROUTING test a bit. But I want statistics for a > longer period than one week before I do that. > > Who in Europe, esp. in Austria and/or other German-speaking areas, has > similar (or different) experiences and is able to send me his settings, as > far as they are different from the standard settings? > > Michael > +--------------------------------------+ > | interactiveaustria | > | Michael Tobisch EDV-Dienstleistungen | > | Wiesengasse 12, A-8160 Weiz | > | Tel +43 3172 4930 | > | GSM +43 664 2126941 | > | EMail [EMAIL PROTECTED] | > | Web http://www.iaa.at | > +--------------------------------------+ > | Kundeninformationen per E-Mail: | > | http://www.iaa.at/kundeninfo.asp | > +--------------------------------------+ > > > > -----Ursprüngliche Nachricht----- > > Von: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Auftrag von Kevin Bilbee > > Gesendet: Donnerstag, 10. Juli 2003 20:59 > > An: JunkMail Declude > > Betreff: [Declude.JunkMail] re: Spam Statistics > > > > > > I thought the group might want to see som spam stats. These are > our stats > > from yesterday. > > > > Does any one else have stats they could post so we can get an > idea of what > > test get triggered???? > > > > ------------------------------------------------------------- > > LogFile(s) Scanned: > > D:\IMAIL\spool\dec0709.log > > ------------------------------------------------------------- > > Total unique messages scanned: 1893 > > Total failed messages : 1172 > > Percent failed: 61.912 % > > Total deleted messages: 425 > > Percent deleted: 22.451 % > > Total held messages : 120 > > Percent held: 6.339 % > > Total log file length : 24384 > > ------------------------------------------------------------- > > Test Name : Count % of Failed % of All > > ------------------------------------------------------------- > > BADHEADERS : 272 23.208 % 14.369 % > > BASE64 : 33 2.816 % 1.743 % > > BLITZEDALL : 65 5.546 % 3.434 % > > BLOCKEDSENDERS : 22 1.877 % 1.162 % > > BODYFILTER : 19 1.621 % 1.004 % > > BONDEDSENDER : 23 1.962 % 1.215 % > > COMMENTS : 32 2.730 % 1.690 % > > DSBL : 178 15.188 % 9.403 % > > DSN : 45 3.840 % 2.377 % > > EASYNET-DNSBL : 458 39.079 % 24.194 % > > EASYNET-DYNA : 16 1.365 % 0.845 % > > EASYNET-PROXIES: 159 13.567 % 8.399 % > > HELOBOGUS : 229 19.539 % 12.097 % > > HELOFILTER : 151 12.884 % 7.977 % > > IPBLACKLIST : 60 5.119 % 3.170 % > > MAILFROM : 13 1.109 % 0.687 % > > MONKEYPROXIES : 116 9.898 % 6.128 % > > NOABUSE : 241 20.563 % 12.731 % > > NOPOSTMASTER : 188 16.041 % 9.931 % > > ORDB : 3 0.256 % 0.158 % > > OSPROXY : 1 0.085 % 0.053 % > > OSSOFT : 6 0.512 % 0.317 % > > REVDNS : 211 18.003 % 11.146 % > > ROUTING : 97 8.276 % 5.124 % > > SBL : 217 18.515 % 11.463 % > > SPAMCOP : 266 22.696 % 14.052 % > > SPAMDOMAINS : 124 10.580 % 6.550 % > > SPAMHEADERS : 187 15.956 % 9.879 % > > SPAM-HIGH : 399 34.044 % 21.078 % > > SPAM-LOW : 17 1.451 % 0.898 % > > SPAM-MED : 152 12.969 % 8.030 % > > WEIGHT5 : 717 61.177 % 37.876 % > > Whitelisted : 340 29.010 % 17.961 % > > ------------------------------------------------------------- > > > > Kevin Bilbee > > Network Administrator > > Standard Abrasives, Inc. > > [EMAIL PROTECTED] > > (805) 520-5800 x7332 > > ____________________________________ > > Changing the way industry works. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > Dieses E-Mail wurde von Declude.Virus auf Virusfreiheit geprueft > Ein Service von interactiveaustria, http://www.iaa.at > --- > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Dieses E-Mail wurde von Declude.Virus auf Virusfreiheit geprueft Ein Service von interactiveaustria, http://www.iaa.at --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
