Print Page | Close Window

Bayesian filter

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=3428
Printed Date: 21 October 2017 at 2:51am


Topic: Bayesian filter
Posted By: Guests
Subject: Bayesian filter
Date Posted: 14 April 2004 at 2:57pm
How can I tell if the Baysian filter is working? We have over 65,000 good and bad e-mails but we still get a ton of spam. Is there a file that I can check that tells me how many have been blocked by the Bayesian filter?



Replies:
Posted By: Desperado
Date Posted: 14 April 2004 at 5:40pm

Bob,

There are several ways to check this.  First and least efficient, you can manually go through the log files and look for an entry that looks like "04/14/04 17:19:29:451 -- (4288) EMail from mailto:brian@celineclub.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - brian@celineclub.com to mailto:user@domain.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - user@domain.net matches Bayesian filter - rejected - 100% spam (78ms)"  There is also a program called Sawmill that will read your mail logs and give you some very nice graphical statistics.  Another thing you can do if you only want to see the messages still in quarantine (assuming you have a database is to issue a query directly to the DB such as:

SELECT * FROM "tblQuarantine" WHERE (RejectID = 14)

OR if you just want to return the quantity:

SELECT COUNT(RejectID) FROM "tblQuarantine"
WHERE (RejectID = 14)

I hope this helps

Regards,

Dan S.



Posted By: LogSat
Date Posted: 15 April 2004 at 12:13am

Bob,

Dan was correct in his response. Furthermore, if you'd like to know more about what the various filters are blocking, issuing the following query on the database will provide you more with info on how many emails each filter is blocking.

Roberto F.
LogSat Software

SELECT     tblQuarantine.RejectID, tblRejectCodes.RejectDesc, COUNT(tblQuarantine.RejectID) AS Total
FROM         tblQuarantine INNER JOIN
                      tblRejectCodes ON tblQuarantine.RejectID = tblRejectCodes.RejectID
GROUP BY tblQuarantine.RejectID, tblRejectCodes.RejectDesc



Posted By: Guests
Date Posted: 15 April 2004 at 1:53pm

A few more questions, in order for the bayesian filter to work, do you need to have keyword filtering enabled? Do you need to have the quarantine database enabled?

Also, is there instructions anywhere on how to configure this filter to work?



Posted By: LogSat
Date Posted: 16 April 2004 at 1:13am

Bob,

The Bayesian filter "learns" about good and bad emails as SpamFilter receives traffic. What your current filters identify as spam is fed to the learning engine. You should continue to use the filters that you normally use, in any combination so that SpamFilter can learn what they block.

The quarantine database does not need to be active for the Bayesian filter to work.

Configuration on behalf of the admins is minimal. You simply have to select a threshold which indicates the probability of an email to be spam in order to be rejected. The closer the threshold is to 100%, the more an email has to "resemble" your typical spam in order to be rejected. Higher thresholds mean lower false-positives, but also will allow mor spam to slip thru.

Roberto F.
LogSat Software



Posted By: Guests
Date Posted: 16 April 2004 at 9:54am
filter kicking in?

EMail from *** to *** passes Bayesian filter - 0% spam (0ms) < havent seen one say > 0%

running v2.0.1.302

query

Query1
RejectID RejectDesc Total
1 Domain is in local blacklist file 401
2 EmailFrom is in local blacklist file 140
4 Empty Mail From 743
12 IP found in MAPS search 3886
13 Keywords found in content 1484
14 Statistical filter match 4

corpu.ini

[Messages]
Spam=13817
Good=49039

Thanks



Posted By: Desperado
Date Posted: 16 April 2004 at 2:57pm

It looks like you have at least 4 in there:  Here is what I get when I run the same query:

14     Statistical Analysis filter match    5042
13     Keywords found in content    70324
7      Exceeded maximum number of RCPT TO    10476
8      IP address is from a blacklisted country    7622
12    IP found in MAPS search    281603
3      Reverse DNS not found    160350
1      Domain is in local blacklist file    178
4      Empty Mail From    55
2      EmailFrom is in local blacklist file    3026
9      EmailTO is in local blacklist file    1159

Regards,

Dan S.




Print Page | Close Window