On Jan 30, 2014, at 11:25 AM, John Hardin <jhar...@impsec.org> wrote:
> I'd suggest writing it as a subrule first, to see how well it performs > against the masscheck corpora. If it does well by itself (good hits, high > S/O), then a meta can be added to expose it for scoring. If it hits a lot but > the S/O ratio is low, then it could be analyzed for possible combinations > with other rules to get something that performs well. Certainly a good idea, but since I'm not familiar with how the masscheck corpora work, I don't know what changes are required for this. Hopefully you or Kevin can handle the necessary changes for that... --- Amir
