jhardin at apache
Oct 11, 2009, 4:56 PM
Post #1 of 1
(167 views)
Permalink
|
|
svn commit: r824203 - /spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
|
|
Author: jhardin
Date: Sun Oct 11 23:56:34 2009
New Revision: 824203
URL: http://svn.apache.org/viewvc?rev=824203&view=rev
Log:
reevolved ADVANCE_FEE using nightly logs
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf?rev=824203&r1=824202&r2=824203&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf Sun Oct 11 23:56:34 2009
@@ -1,58 +1,76 @@
#
-# Thu Oct 8 07:25:23 PDT 2009
+# Advance Fee scam rules for evaluation.
+# Evaluate via masscheck and keep the top
+# performers for publication.
#
+# Evolved on: Sun Oct 11 16:54:21 PDT 2009
# Evolve parameters: -m5 -t75 -e3 -p9
#
-# fitness: 114676.000000
+# Performance:
+# fitness: 119568.000000
# rule count: 75
# HAM HAM% SPAM SPAM% S/O
-# >=0 hits: 191 100.0000 5918 100.0000 0.5000
-# >=1 hits: 42 21.9895 2119 35.8060 0.6195
-# >=2 hits: 1 0.5236 1526 25.7857 0.9801
-# >=3 hits: 0 0.0000 1261 21.3079 1.0000
-# >=4 hits: 0 0.0000 996 16.8300 1.0000
-# >=5 hits: 0 0.0000 741 12.5211 1.0000
+# >=0 hits: 188 100.0000 5860 100.0000 0.5000
+# >=1 hits: 44 23.4043 2081 35.5119 0.6028
+# >=2 hits: 1 0.5319 1529 26.0922 0.9800
+# >=3 hits: 0 0.0000 1311 22.3720 1.0000
+# >=4 hits: 0 0.0000 1047 17.8669 1.0000
+# >=5 hits: 0 0.0000 775 13.2253 1.0000
#
# $Id$
#
-meta ADVANCE_FEE_02_NEW (__AGREED_RATIO + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_KJV + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_UUY + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INHERIT_PMT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __KAM_LOTTO2 + LOTTO_ADMITS + LOTTO_AGENT + LOTTO_AGENT_FM + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + LOTTO_YOU_WON_03 + __LUCKY_WINNER + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __SCAM + __SHARE_IT + SUM_OF_FUND + __THEY_INHERIT + __TRUNK_BOX + __T
RUSTED_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 1)
-describe ADVANCE_FEE_02_NEW Appears to be advance fee fraud (Nigerian 419)
+meta ADVANCE_FEE_2_NEW (__AFR_UNION + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + __DEAD_PARENT + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + LOTTO_AGENT_RPLY + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + __TRUSTE
D_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 1)
+describe ADVANCE_FEE_2_NEW Appears to be advance fee fraud (Nigerian 419)
-meta ADVANCE_FEE_03_NEW (__AGREED_RATIO + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_KJV + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_UUY + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INHERIT_PMT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __KAM_LOTTO2 + LOTTO_ADMITS + LOTTO_AGENT + LOTTO_AGENT_FM + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + LOTTO_YOU_WON_03 + __LUCKY_WINNER + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __SCAM + __SHARE_IT + SUM_OF_FUND + __THEY_INHERIT + __TRUNK_BOX + __T
RUSTED_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 2)
-describe ADVANCE_FEE_03_NEW Appears to be advance fee fraud (Nigerian 419)
+meta ADVANCE_FEE_3_NEW (__AFR_UNION + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + __DEAD_PARENT + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + LOTTO_AGENT_RPLY + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + __TRUSTE
D_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 2)
+describe ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
-meta ADVANCE_FEE_04_NEW (__AGREED_RATIO + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_KJV + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_UUY + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INHERIT_PMT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __KAM_LOTTO2 + LOTTO_ADMITS + LOTTO_AGENT + LOTTO_AGENT_FM + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + LOTTO_YOU_WON_03 + __LUCKY_WINNER + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __SCAM + __SHARE_IT + SUM_OF_FUND + __THEY_INHERIT + __TRUNK_BOX + __T
RUSTED_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 3)
-describe ADVANCE_FEE_04_NEW Appears to be advance fee fraud (Nigerian 419)
+meta ADVANCE_FEE_4_NEW (__AFR_UNION + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + __DEAD_PARENT + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + LOTTO_AGENT_RPLY + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + __TRUSTE
D_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 3)
+describe ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
-meta ADVANCE_FEE_05_NEW (__AGREED_RATIO + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_KJV + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_UUY + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INHERIT_PMT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __KAM_LOTTO2 + LOTTO_ADMITS + LOTTO_AGENT + LOTTO_AGENT_FM + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + LOTTO_YOU_WON_03 + __LUCKY_WINNER + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __SCAM + __SHARE_IT + SUM_OF_FUND + __THEY_INHERIT + __TRUNK_BOX + __T
RUSTED_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 4)
-describe ADVANCE_FEE_05_NEW Appears to be advance fee fraud (Nigerian 419)
+meta ADVANCE_FEE_5_NEW (__AFR_UNION + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT + __CONTACT_YOU + __COURIER + __DEAD_PARENT + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XVW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + LOTTO_AGENT_RPLY + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI + LOTTO_WIN_01 + LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + __TRUSTE
D_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 4)
+describe ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)
# if large sums of money are involved...
-meta ADVANCE_FEE_02_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_02_NEW
-describe ADVANCE_FEE_02_NEW_MONEY Advance Fee fraud and lots of money
+meta ADVANCE_FEE_2_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_2_NEW
+describe ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
-meta ADVANCE_FEE_03_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_03_NEW
-describe ADVANCE_FEE_03_NEW_MONEY Advance Fee fraud and lots of money
+meta ADVANCE_FEE_3_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_3_NEW
+describe ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
-meta ADVANCE_FEE_04_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_04_NEW
-describe ADVANCE_FEE_04_NEW_MONEY Advance Fee fraud and lots of money
+meta ADVANCE_FEE_4_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_4_NEW
+describe ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
-meta ADVANCE_FEE_05_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_05_NEW
-describe ADVANCE_FEE_05_NEW_MONEY Advance Fee fraud and lots of money
+meta ADVANCE_FEE_5_NEW_MONEY LOTS_OF_MONEY && ADVANCE_FEE_5_NEW
+describe ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
# if you fill in a form...
-meta ADVANCE_FEE_02_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_02_NEW
-describe ADVANCE_FEE_02_NEW_FORM Advance Fee fraud and a form
+meta ADVANCE_FEE_2_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_2_NEW
+describe ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form
-meta ADVANCE_FEE_03_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_03_NEW
-describe ADVANCE_FEE_03_NEW_FORM Advance Fee fraud and a form
+meta ADVANCE_FEE_3_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_3_NEW
+describe ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form
-meta ADVANCE_FEE_04_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_04_NEW
-describe ADVANCE_FEE_04_NEW_FORM Advance Fee fraud and a form
+meta ADVANCE_FEE_4_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_4_NEW
+describe ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form
-meta ADVANCE_FEE_05_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_05_NEW
-describe ADVANCE_FEE_05_NEW_FORM Advance Fee fraud and a form
+meta ADVANCE_FEE_5_NEW_FORM FILL_THIS_FORM && ADVANCE_FEE_5_NEW
+describe ADVANCE_FEE_5_NEW_FORM Advance Fee fraud and a form
+
+# if large sums of money and a form are involved...
+
+meta ADVANCE_FEE_2_NEW_FRM_MNY FILL_THIS_FORM && LOTS_OF_MONEY && ADVANCE_FEE_2_NEW
+describe ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud and lots of money
+
+meta ADVANCE_FEE_3_NEW_FRM_MNY FILL_THIS_FORM && LOTS_OF_MONEY && ADVANCE_FEE_3_NEW
+describe ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud and lots of money
+
+meta ADVANCE_FEE_4_NEW_FRM_MNY FILL_THIS_FORM && LOTS_OF_MONEY && ADVANCE_FEE_4_NEW
+describe ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud and lots of money
+
+meta ADVANCE_FEE_5_NEW_FRM_MNY FILL_THIS_FORM && LOTS_OF_MONEY && ADVANCE_FEE_5_NEW
+describe ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud and lots of money
|
