I've been getting a fair bit of spam with multiple punctuation
characters within a single word, getting through SA 2.64 (with most of
the SARE rulesets) with relatively low scores. No FNs so far thanks to
other rules, particularly the antidrug set, but some have been very
close to the limit and I've been trying to come up with a rule specific
to this type of obfuscation.
| Experience the reliable service and check out the l-o_w price on Xalatan,
| Aten_`olol, Zyban, and V^al''ium. Find out m^or_e here o_n~line with us.
|
| That's all I want.I just don't want to waste time in the do_^ct`'or's
| waiting room,or even I don't kn^,ow how much time I would have to sit like
| this.--Nancy G. in CA
My current best attempt is
| body local_OBFU_MULTIPUNCT /[a-z]([\~'"`_\,]{1,4}[a-z]{1,6}){2}/i
| describe local_OBFU_MULTIPUNCT Two or more punctuation characters
within a word
| score local_OBFU_MULTIPUNCT 0.1
| # score low during testing
but this is getting false positives, particularly on various mailing
lists where things like perl module names and code are discussed.
Any suggestions?
John.
--
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages - www.tradoc.fr
