Dan,
Individual tests do not "false positive" (unless they are poorly conceived).
The term "False Positive" in relation to spam filtering means a message that
was tagged as spam (with Declude this usually results from failure of
multiple tests), but is in reality a legitimate email that needs to be
delivered. Understandably there is some grey area in that, due to varying
definitions on what email should be considered spam. For this reason, many
admins' weighting systems vary on some of the details of implementation, due
mostly to their user community, individual policies, and attempts to filter
as much as possible without adversely affecting their community.
I believe the point Scott was making was that the HELOBOGUS should not have
much weight if you are seeing such a high percentage of emails (37%) that
fail this particular test but are not spam.
Darin.
----- Original Message -----
From: "Dan Geiser" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, April 22, 2004 2:42 PM
Subject: Re: [Declude.JunkMail] Scaling Up The Declude Weighting System
Hi, Scott,
Thanks for the feedback. The more I thought about it after sending the
e-mail a few minutes ago the more certain I was that my logic was not. in
fact not even remotely close to being sound. It really has to be thought of
as a factor of multiple tests and not just one, so I understand what you are
saying.
But I have to disagree with your terminology. I wasn't describing a false
positive situation. I don't think the HELOBOGUS test by itself can have a
false positive.
A message either passes or fails the HELOBOGUS test. If a message fails the
HELOBOGUS test, meaning the HELO is bogus by Scott's criterion, yet that
message is not a spam message, i.e. it is a legit e-mail, it doesn't mean
that the HELOBOGUS generated a false positive. The HELO either truly is
BOGUS or NOT BOGUS. If HELOBOGUS misidentified a message as being BOGUS
that was NOT BOGUS then, yes, I think that would be a false positive. But
by it's nature one single test cannot create a false positive unless the
program code for the test is written incorrectly.
Just my thoughts.
Dan
----- Original Message -----
From: "Scott Fisher" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, April 22, 2004 2:20 PM
Subject: Re: [Declude.JunkMail] Scaling Up The Declude Weighting System
If a test false positived 37% of the time, I certainly wouldn't be weighing
it that high.
Scott Fisher
Director of IT
Farm Progress Companies
>>> [EMAIL PROTECTED] 04/22/04 12:57PM >>>
Hi, Markus,
Thanks for responding.
Well I went ahead and did it. I've rescaled everything to have 100 points
be my HOLD weight. It was pretty easy because my previous HOLD weight was 5
so I just had to multiply everything by 20 to keep things relative.
Now, that I have it there I would like to re-tune some of my weights. In
your system, if you have a test like HELOBOGUS, for example, how do you
decide what weight to give HELOBOGUS?
I was thinking that if I had the correct statistics about which types of
messages, spam or legit, were flagged by which tests it would be pretty
straightforward. For example, if I knew that of 1000 messages that were
flagged as failing the HELOBOGUS test and 37% of them were legit messages
and 73% setting the weight of HELOBOGUS to 73 would be statistically sound.
Is my thinking correct on that or am I way off base?
Thanks,
Dan Geiser
[EMAIL PROTECTED]
----- Original Message -----
From: Markus Gufler
To: [EMAIL PROTECTED]
Sent: Tuesday, April 20, 2004 4:25 PM
Subject: RE: [Declude.JunkMail] Scaling Up The Declude Weighting System
Dan,
We've choosen to scale up the weighting system exactly for the two reasons
you've mentioned below:
-more granularity
-absolute weight and percentage is the same
Note that there are some good filter files maintained by other Declude
users that are updated regulary and has the "inside" weights set up for a
Hold-on-20 weighting system.
Markus
----------------------------------------------------------------------------
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Tuesday, April 20, 2004 4:48 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Scaling Up The Declude Weighting System
Hello, All,
Over the year or so that I've been reading the discussions on this list
it seems I've read quite a bit about people scaling their weights up, i.e.
instead of having a HOLD weight of 10, you might have a HOLD weight of 100
and then you adjust the corresponding test weights accordingly. Assuming
that what I've read is correct, for those who uses this scaled up system...
What sort of benefit is is that you feel that you receive from doing
this? Does it allow a more granular tuning of your weighting system? Are
there any other benefits I'm not thinking of? Does having a hold weight of
100, for example, help you think more clearly about each test being a
percentage of the overall HOLD weight?
I'm doing a major overhaul of Declude JunkMail configuration and I
figured if a scaled up weight system is the best way to do things then I
might want to implement that now.
Thanks In Advance For Your Comments!
Dan Geiser
[EMAIL PROTECTED]
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
-----------------------------------------------------------------------
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan
-----------------------------------------------------------------------
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
