Bug 2220 - Meta rule raising value for mail that matches razor and dcc.
Summary: Meta rule raising value for mail that matches razor and dcc.
Status: RESOLVED FIXED
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Rules (show other bugs)
Version: unspecified
Hardware: Other other
: P5 enhancement
Target Milestone: 3.0.0
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-07-12 14:18 UTC by Lucas Albers
Modified: 2004-03-06 15:43 UTC (History)
0 users


Attachment Type Modified Status Actions Submitter/CLA Status
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Lucas Albers 2003-07-12 14:18:00 UTC 
The FP rate for mail that matches both razor and DCC is very low.
So we can be relativelly certain that mail that matches both, is spam.

What score to assign to this rule?
Starting incrementally, I set the score to 1....

#matches razor and pyzor
meta MATCH_RAZOR_AND_PYZOR RAZOR2_CHECK && DCC_CHECK
describe MATCH_RAZOR_AND_PYZOR Message matches both DCC and Razor.
score MATCH_RAZOR_AND_PYZOR 1
Comment 1 Lucas Albers 2003-09-09 22:33:49 UTC 
meta MATCH_RAZOR_AND_DCC RAZOR2_CHECK && DCC_CHECK
describe MATCH_RAZOR_AND_DCC Message matches both Razor and DCC.
score MATCH_RAZOR_AND_DCC 1

wrote my rules wrong, fixed. duh.
Comment 2 Daniel Quinlan 2003-09-10 17:55:12 UTC 
Well, such a rule might help, but probably not a huge amount:

  score RAZOR2_CHECK 0 0.899 0 1.047
  score RAZOR2_CF_RANGE_11_50 0 0.559 0 0.876
  score RAZOR2_CF_RANGE_51_100 0 1.552 0 1.101
  score DCC_CHECK 0 1.806 0 2.907

So, the score is already getting at least 0.899+0.559+1.806=3.264 and
probably more likely 0.899+1.552+1.806=4.257.

I checked the original corpus results we used to generate those scores and
found the following with our current scores:

only 7% of spam matched both DCC_CHECK and RAZOR2_CHECK.  Only 3% of that
ended up with a score less than 5.0 (or 0.26% of the entire spam corpus run).
So, this rule would only affect 0.26% of all spam.  What's more, a score
of 1.0 would only affect 0.12% of all spam (by correctly changing the
classification from ham to spam).

Anyway, I'd suggest testing the following:

meta T_DIGEST_MULTIPLE       (RAZOR2_CHECK + DCC_CHECK + PYZOR_CHECK > 1)
describe T_DIGEST_MULTIPLE   Message hits more than one network digest check
score MATCH_RAZOR_AND_DCC    1.0

It affects a bit more spam.
Comment 3 Lucas Albers 2003-09-12 14:15:02 UTC 
Thanks!
I think you meant this:

meta T_DIGEST_MULTIPLE       (RAZOR2_CHECK + DCC_CHECK + PYZOR_CHECK > 1)
describe T_DIGEST_MULTIPLE   Message hits more than one network digest check
score T_DIGEST_MULTIPLE    1.0
Comment 4 Theo Van Dinter 2004-03-07 00:43:09 UTC 
added to head for testing.  r7041