Re: What's the best way to process missed spams ?

Guillaume Laurent wrote:
> David A. Lee wrote:
>> Not entirely sure what your question is ... are you saying you dont 
>> think its right that spamprobe finds the headers as even more
>> informative then the body text ?
>>  
> In that case, yes. None of the info in the headers is particularly 
> helpful to detect this particular spam, since it changes almost every 
> time. The only header which doesn't change (the Subjec:) isn't taken 
> into account. So a spam with the exact same subject and text, not even 
> obfuscated by HTML tags, goes undetected almost every time even though 
> I've explicitely flagged as 'spam' all its previous occurrences.

Actually since you've trained SP on this email those headers are 
extremely useful to SP for THAT message.  Whether or not they will be 
again does not mean that SP should not have shown the top terms that it 
showed you.

Please keep in mind that while SP bases its decision for each message 
only on the top terms it does update the database for all of the 
message's terms when you train on the message.  So if you receive 
another spam with the same body but different headers then it will 
probably be scored properly based on the terms in the body.

All the best,
++Brian


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click