http://bugzilla.spamassassin.org/show_bug.cgi?id=3175
Summary: Possible Rules to defeat "bayes poison" word blocks
Product: Spamassassin
Version: 2.63
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P5
Component: Rules
AssignedTo: [EMAIL PROTECTED]
ReportedBy: [EMAIL PROTECTED]
The idea here is that the bayes poison text blocks have the following
characteristics
1) The words are usually long (>4 chars)
2) There is never any punctuation
3) Usually all lower case
So, I give you:
body SH_bayes_poison_lower_6_4 /(\w{4,}\s+){6,}/
describe SH_bayes_poison_lower_6_4 6 consequtive 4 letter or longer words
score SH_bayes_poison_lower_6_4 0.1
body SH_bayes_poison_lower_8_4 /(\w{4,}\s+){8,}/
describe SH_bayes_poison_lower_8_4 8 consecutive 4 letter or longer words
score SH_bayes_poison_lower_8_4 0.5
body SH_bayes_poison_lower_10_4 /(\w{4,}\s+){10,}/
describe SH_bayes_poison_lower_10_4 10 consecutive 4 letter or longer words
score SH_bayes_poison_lower_10_4 1.0
body SH_bayes_poison_lower_12_4 /(\w{4,}\s+){12,}/
describe SH_bayes_poison_lower_12_4 12 consecutive 4 letter or longer words
score SH_bayes_poison_lower_12_4 1.0
body SH_bayes_poison_lower_14_4 /(\w{4,}\s+){14,}/
describe SH_bayes_poison_lower_14_4 14 consecutive 4 letter or longer words
score SH_bayes_poison_lower_14_4 2.0
body SH_bayes_poison_lower_16_4 /(\w{4,}\s+){16,}/
describe SH_bayes_poison_lower_16_4 16 consecutive 4 letter or longer words
score SH_bayes_poison_lower_16_4 2.0
The 6 word rule hits quite a bit of ham, but I have not seen the 12-16 hit
anything but spam.
Obvious mutations of this suggest themselves.
1) Longer word length test
3) Caps
Notice that the scores will be cumulative, so if the 16_4 rule hit, so will the
shorter ones
What ya think?
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
