negative correlation in spamprobe?

I just read this additional suggestion on anti-image spam regexes and the
post about mime headers and it made me wonder if there could be some
sufficiently reasonable way to implement checking for patterns where
one token exists and another doesn't.

In this example you'd get a token for "Content-Type: multipart/related" and
*not* one for "type=".  (RFC 2387 has examples of the actual syntax.)

I realize for every email you train on you're not going to want to store
the absence of every other (non-present token listed in the database.
And I haven't thought of a practical way to do anything with this yet.

----- Forwarded message from Craig Sanders -----

if you like that one, you'll probably like this PCRE header
checks rule too. it blocks multipart/related messages without a
"type=" subheader....which is, according to RFC2387, required for
multipart/related messages. this catches a lot of image spam, although
spammers are starting to catch on and adapting their spamware.


# RFC2387 says that multipart/related requires a "type=", which is missing from most image spam
if /^Content-Type:\s*multipart\/related/
!/type=/ REJECT message content rejected.  bogus multipart/related. RFC2387 
endif


> Nice touch handling quoted printable.

yeah, i use it in several rules.

craig

----- End forwarded message -----

-- 
"I don't want people who want to dance, I want people who have to dance."
--George Balanchine
http://www.ChaosReigns.com

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV