Watching for false positives (example)

Hi all again, I've been playing a lot with spam today.

Using the SpamTestBuddy posted earlier, here is how I'm watching SpamProbe 
for potential false positives. I grew tired of checking the huge spam 
folder for FPs, probably a common result of getting used to SpamProbe. This 
method will flag a small subset of the emails that are normally SPAM, so 
it's easier to examine visually. And it's largely independent of SP score.

(I left SpamProbe alone for scoring and filtering my mailbox.)

SpamThreshold   1.5
+TestDnsProblems        DNSPROBLEM
+TestHeaderFloat        SPAMPROBE       X-SpamProbe:
+TestDNSBL              SORBSDUL        dul.dnsbl.sorbs.net
+TestDNSBL              ZEN             zen.spamhaus.org
+TestDNSBL              WPBL            db.wpbl.info
-TestDNSBL              DNSWL           list.dnswl.org

Since each Test adds a score of 0-1, this means that SpamProbe alone is not 
enough to push the score over 1.5. So the above requires at least one more 
test to trigger; if SpamProbe is alone, I have a potential false positive.

The other tests query external IP databases. SORBSDUL is pretty good at 
eliminating dynamic/dialup IPs which are almost always zombies. ZEN is the 
new SpamHaus list which combines known spam companies, infected hosts, and 
IP addresses designated by ISPs as not valid senders. WPBL is the list 
which is fed by many SpamProbe users, and DNSWL is a whitelist which 
subtracts from the score if the IP is a known good mail server.

>From the mail that SpamProbe catches as SPAM, I'm observing approx 4% that 
the rules above flag as UNDER the threshold. No SpamProbe mistakes found so 
far, but my theory is that any false positives would show up there.



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV