wikidiffs at apache
Oct 31, 2009, 11:10 AM
Post #1 of 1
(211 views)
Permalink
|
|
[Spamassassin Wiki] Update of "AutoWhitelist" by DanielNorton
|
|
Dear Wiki user,
You have subscribed to a wiki page or wiki category on "Spamassassin Wiki" for change notification.
The "AutoWhitelist" page has been changed by DanielNorton.
The comment on this change is: perhaps default auto_whitelist_factor should be documented here.
http://wiki.apache.org/spamassassin/AutoWhitelist?action=diff&rev1=28&rev2=29
--------------------------------------------------
== Introduction ==
- Tracks scores from messages previously received and adjusts the message score, either by boosting messages from senders who send ham or penalizing senders who have sent spam previously. This not only treats some senders as if they were whitelisted but also treats spammers as if they were blacklisted. Each message from a particular sender adjusts the historical total score which can change them from a spammer if they non-spam messages. Senders who are considered non-spammers can become treated as spammers if they send messages which appear to be spam.
+ Tracks scores from messages previously received and adjusts the message score, either by boosting messages from senders who send ham or penalizing senders who have sent spam previously. This not only treats some senders as if they were whitelisted but also treats spammers as if they were blacklisted. Each message from a particular sender adjusts the historical total score which can change them from a spammer if they non-spam messages. Senders who are considered non-spammers can become treated as spammers if they send messages which appear to be spam.
A sender is identified using both their address and the most significant 2 octats of their IP address
(ex: mailer-daemon @club-internet.fr 194.158) This is intended to penalize spam claiming to be From you with forged headers.
@@ -17, +17 @@
The algorithm works using a local database of entries. Each entry has a key formed by
the From: address of the mail, and the IP address it originated at. It
- contains a TOTAL score of messages and a COUNT of messages. The MEAN score is TOTAL/COUNT.
+ contains a TOTAL score of messages and a COUNT of messages. The MEAN score is TOTAL/COUNT.
The algorithm:
1. Compute the SCORE of the message from RULES
@@ -26, +26 @@
4. Increment historical COUNT by one
5. Set the final score of the message to SCORE+DELTA
- auto_whitelist_factor can be adjusted in the configuration to vary the impact of the MEAN, and may be useful when starting off.
+ auto_whitelist_factor can be adjusted in the configuration to vary the impact of the MEAN, and may be useful when starting off.
For example:
The first mail received from a sender scores 20 based on RULES. When they send you a second message that scores 2.0 based on RULES, the MEAN will push the score up to 11 ( 20/1 - 2.0 )on the second mail. This is auto blacklisting, based on their past history of spam.
@@ -35, +35 @@
== How do I whitelist/blacklist someone? ==
- Not with the this! This is a automatic heuristic system.
+ Not with the this! This is a automatic heuristic system.
You want to use the manual whitelist/blacklist. See ManualWhitelist.
==== Previous version implementation ====
- In 3.1, it is a plugin, loaded by default in the file {{{v310.pre}}}.
+ In 3.1, it is a plugin, loaded by default in the file {{{v310.pre}}}.
- In 3.0, it is enabled by default and turned off with the configuration setting {{{use_auto_whitelist 0}}}.
+ In 3.0, it is enabled by default and turned off with the configuration setting {{{use_auto_whitelist 0}}}.
In earlier versions, it is enabled using the -a flag to spamassassin or spamd.
@@ -65, +65 @@
.
.
- ----
+ ----
@@ -74, +74 @@
Even if "we were there first", this it is more than whitelisting."
TODO: verify example calculation, verify auto_whitelist_factor and show default, upload sa-awlUtil.
- .
+ .
@@ -84, +84 @@
From http://wiki.apache.org/spamassassin/ManualWhitelist "the name is a misnomer. The AutoWhitelist is designed as an automatic score averaging system." Maybe score averaging system? -Roger
+ It seems to me that this would be the place to document the default value of '''auto_whitelist_factor'''. I gather from other sources that it's 0.5. -- DanielNorton
+
|
