Chris Lewis wrote:
Each of the numbers is
scaled differently in a computation something like this:
if (((complaints * cf + contentblocked * bf + trap * tf) / non-blocked)
1) {
go block the IP
}
[Notice that we're not factoring in blocked IP. Specifically to avoid
the thresholder locking up thru positive feedback ;-). They're blocked
anyway, so it doesn't matter.]
Where cf, bf, and tf are chosen thru experience and experimentation.
Relative to my question, what you've said is that you have a scaling factor
specifically for the TIS hits. That lets you tune its specific confidence level.
But you don't cite any of the "good" attributes, nevermind scaling factors, per
your reference to good/bad.
I'm being pedantic because it was the differential nature of postive vs.
negative measurements that intrigued me, in terms of practical impact.
d/
--
Dave Crocker
Brandenburg InternetWorking
bbiw.net
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
https://www.irtf.org/mailman/listinfo/asrg