On 05-09-12 10:52, Hanno Hirschberger wrote:
> Thanks for the kind response Benny :)
>
> I'd like to check a few details here and there in order to tell what
> exactly my plan was. Maybe my first mail was a little bit confusing.
>
>>> I'd like to train DSPAM with the results from SpamAssassin. Incoming
>>> mails first are checked by SpamAssassin and then delivered to DSPAM.
>>
>> you need to understand why this might be a good ideer in the first
>> place, its important to not train ALL but learn incomming ALL mails is
>> not training, so you dont end up with a huge database digest to resolve
>> problems from later, again it keeps digest minimal, and speeds maximal
>>
>> my mailserver have only 1238M mem, and i consider it nice its still
>> handle both spamassassin and dspam here without any problem
>
> I don't really want to learn from ALL messages. But when SpamAssassin
> is like: "Oh well here's a spam message!" it would help if DSPAM would
> notice that too. When the SpamAssassin result is "not spam" then DSPAM
> can handle the message as any other and do its spam detection. My goal
> is to let DSPAM know that mails tagged as spam by SpamAssassin are
> definitely spam and if DSPAM calculates that it is not spam -> that's
> an error.
>
>>> When SpamAssassin marked a mail as spam is there any way to tell
>>> DSPAM
>>> that the mail is definitely spam and to learn from that?
>>
>> nope, this will be failure, dspam is not another spamassassin engine,
>> so you have to tell dspam what is spam, and let it know what is not
>> considered as spam by you is ham
>>
>> if for some reason one gets an spam mail it must be sent again to dspam
>> with the dspam signature that shows exacly what mail is spam
>>
>> when dspam got this signature, then it changes scores for all digest
>> that was learned in the original mail on incomming from internet
>
> I don't want to be DSPAM as a SpamAssassin engine. But it would be
> nice if it could learn from what SpamAssassin detects.
> I'm using Dovecot with Antispam plugin to watch the folders "SPAM" and
> "INBOX". When DSPAM claims that a spam message is not spam users can
> move the message from their INBOX into the SPAM folder an DSPAM gets
> the feedback like: dspam --source=error --signature=xyz --class=spam
> Sieve scripts are providing that DSPAMs spam-tagged messages are going
> directly into the SPAM folder. Again if a user is moving that mail to
> the INBOX, DSPAM learns from that.
>
> So my first thought was; hey, if SpamAssassin got a spam message and
> DSPAM says it's not spam, a Sieve script will automatically insert the
> message (because of the SpamAssassin spam-tag) into the SPAM folder.
> So now the Dovecot Antispam plugin will tell DSPAM whether or not this
> was an error. Unfortunately the message have to be in the INBOX once
> in order to let the Dovecot Antispam plugin execute the DSPAM learning
> so this won't work. Sieve is directly putting it into the SPAM folder
> what the Dovecot Antispam plugin ignores.
>
> Does anyone have an idea how I can realize my plan or is that even possible?
Dovecot has some experimental plugin to execute external commands. use
this to submit spamtrap messages to spamcop, but you could equally do
some thing like:
- run spamassassin (=SA), add headers
- run dspam, add headers
- run sieve, examine headers, execute retrain command based on headers.
This way you can also retrain dspam only with messages on which it
actually says they're innocent, in stead of training on all SA->spam
messages (most of those messages will be classified as spam by dspam
too, in the end).
Problem here is that you retrain dspam based on automated decisions by
SA. In the end, dspam can not get any better/smarter than its teacher
SA, so using dspam together with SA is useless (ok this is a bit blunt).
Maybe you could make multiple spam folders ('possible spam', 'definitely
spam') and use sieve to move messages that have "dspam->innocent +
SA->spam" into 'possible spam'. Then, have the user train dspam (and/or
SA bayes) using dovecot-antispam-plugin, by moving messages from
'possible spam' to 'definitely spam' or 'anywhere else'.
Note: the antispam plugin only works on message moves done by the user
at post-delivery time, so to automate training directly from sieve, you
cannot use the antispam plugin (but you can by using the experimental
'external command' plugin).
--
Tom
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Dspam-user mailing list
Dspam-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspam-user
