On Wednesday, January 5, 2005, 10:55:35 AM, MCSE wrote:

SSMOE> Just wanted to chime in here that the original changes seem to have 
helped
SSMOE> my rulebase as it has gone down from 11,355,504 bytes to 4,871,976 bytes 
but
SSMOE> I believe I'm still at the 'standard' rulebase strength.

This is true - only ineffective rules have been removed. It was always
the case that ineffective rules would be removed, but that process was
less efficient before. As a result of the new process, all rulebases
should be somewhat smaller and all rulebases will become more
effective (relative to rule strength setting) over time.

One of the changes that have been put in place is that we now have a
differential rule boost analysis in place. This process uses messages
that hit our spamtraps and compares the scan results for the standard
rulebase and the "fullbase" which includes ever rule ever put in our
system.

If a message arrives at a spamtrap, passes through the standard
rulebase, but is captured by the fullbase, then the rules involved in
that message are "boosted" by recording an accelerated hit rate. This
pushes the rule strength of these rules above the 1.0 threshold
defined for the "standard" settings.

This mechanism tends to push marginal rules back into the mainstream
as long as they are still viable as measured by our spamtraps. In the
past these rules would have normally remained in the 0.1 to 1.0 range
along with other much less effective rules.

(Sorry for writing another book...)

_M




This E-Mail came from the Message Sniffer mailing list. For information and 
(un)subscription instructions go to 
http://www.sortmonster.com/MessageSniffer/Help/Help.html

Reply via email to