ietf-asrg
[Top] [All Lists]

Re: [Asrg] 7. Best Practices - DNSBLs - Article

2003-08-12 19:07:34

Brad Knowles writes:
      I note that several of the black lists have zero hits on both the 
"spam" and "ham" categories.  Is this because you do not have access 
to them on this machine, and therefore cannot measure their 
effectiveness and accuracy?  

No -- they are commercial.  (the bl.spamcop.net test is semi-commercial,
in that donations are requested).  Since these figures are used in the
SpamAssassin rescore run, we can't use commercial tests since most users
would not be able to enable them.

Of course, the lists with a negative 
score should be white listed.

Yes, I should have noted that, they are whitelists.  The "Bonded Sender"
list if I recall correctly.

      What about measures of unique hits?  I.e., a particular IP is 
found only in a single black list?  Is there some other way to 
measure hit coverage?  It would be interesting to know what the 
minimal set of black lists would be to get the maximum coverage....

It's pretty tricky to figure that out from this table, unfortunately; one
good guideline is, if a score is higher than the accuracy would suggest,
the GA has found it to provide useful "information" (in the Shannon
sense).  If the score has been zeroed, it overlapped too much with other
tests or was massively inaccurate (see RCVD_IN_OSIRU,
RCVD_IN_OSIRU_SPAM_SRC).

We do occasionally run overlap tests, but they're quite heavy tests to
run, since you have to run each rule against every other rule as far as I
can see.

--j.

_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg