Slashdot Mirror


Working Bayesian Mail Filter

zonker writes "A real, working honest to god Bayesian spam filter. I've been waiting for something like this for a while (since I first read Paul Graham's research paper on this very topic a few weeks ago). Well here's POPFile, a small but extremely effective Perl script that runs on just about any system Perl does. After just a little training was I able to get very effective filtering out of it. From what I understand the new email client that comes with OS X Jaguar has a feature similar to this, but I don't know if it is true Bayesian. Hopefully this kind of feature will become more prevalant in client software as I see the Google results for it are growing."

141 of 312 comments (clear)

  1. Whas that? by cos(0) · · Score: 2, Interesting

    Would anyone care to explain what is a "Bayesian" mail filter?

    1. Re:Whas that? by DalTech · · Score: 4, Informative

      Bayesian is statistical theory and methods useful in the solution of theoretical and applied problems in science, industry and government. http://www.bayesian.org/

    2. Re:Whas that? by Evil+Adrian · · Score: 5, Funny

      If you had just clicked the POPFile link, you would see the explanation.

      Initiative is your friend.

      Hyperlinks are your friend.

      Don't be afraid, just click.

      --
      evil adrian
    3. Re:Whas that? by dvk · · Score: 5, Informative
      From what I understand, it is a mail filter which determines what to filter out based on a statistics-based machine learning system called "Bayesian Learning".

      A couple of URLs quickly found on Google:
      http://www.faqs.org/faqs/ai-faq/neural-nets/part3/ section-7.html
      http://www.csse.monash.edu.au/courseware/cse5230/a ssets/images/week09.pdf

      Also, any decent AI/machine learning textbook ought to cover the topic.

      -DVK

      --
      "The right to figure things out for yourself is the only true freedom everyone shares. Go use it"-R.A.Heinlein
    4. Re:Whas that? by sfe_software · · Score: 5, Informative

      If you had just clicked the POPFile link, you would see the explanation.

      I also highly recommend this link, as it goes into quite a lot of detail on this filtering technique. After reading it, I am going to give the Perl variation a shot.

      --
      NGWave - Fast Sound Editor for Windows
  2. spambayes.sf.net by supton · · Score: 5, Informative

    Saw this a few weeks back... Spam filter in Python using Naive Bayes.

    1. Re:spambayes.sf.net by mpieters · · Score: 2, Informative

      Note that the spambayes core has been developed by Tim Peters of the PythonLabs team, someone who has tons of experience with statistical schemes and the fine-tuning of them. The results from this filter so far have been fenomenal.

      --
      "The truth shall make ye fret" -- The Truth, Terry Pratchett
    2. Re:spambayes.sf.net by Weird+Dave · · Score: 2

      I think you mean phenomenal. I don't mean to be the spelling nazi or anything, but your post was going so well, and that ending was just anticlimactic.

      --

      Grumble, Grumble
  3. Sure it's promising by bigberk · · Score: 4, Insightful

    And I'm going to check it out right now :) But one long standing I fear with such solutions is spammer's adapting to new environments (changing wording used, making the emails look more professional). Sure, they're dumb shits but they're still humans with brains.

    1. Re:Sure it's promising by outlier · · Score: 5, Informative

      While spammers will undoubtedly continue to refine the content of their messages, one of the strengths of using a Bayesian filter like this is that it uses the user's own spam and non-spam (ham) as the basis for its calculations. This means that messages are categorized not only by whether they contain spammy words, but also whether they contain the hammy words from your own messages. So, even if spammers could refrain from using words like "free" "mortgage" "sluts" and "spam", they probably wouldn't use words that discriminate your own ham from others (e.g., if you are a computer scientist, your mail may include hammy words like "algorithm" "compile" "project" or "stargate" that would help distinguish ham from spam. The challenge to the spammer would then be to target you with spam that looks like *your* ham (which is probably different from the ham of others).

      Future systems (assuming faster processors and more HD space) could include semantic analysis (e.g., Latent Semantic Analysis) to do an even better job and go beyond the word level.

    2. Re:Sure it's promising by bmwm3nut · · Score: 2, Interesting

      that's the beauty of this approach. the filter learns all the time (or atleast you can set it up that way). so if spammers get smart, it doesn't take long until the filter adjusts. what i'd love to see is this filter built into a mail client where you have two buttons for delete. one, just to delete the mail, the other to delete it and mark it as spam. when you press that button the filter would scan the email and update its rules.

    3. Re:Sure it's promising by Theodore+Logan · · Score: 2

      Well, as the man says in the article:

      The Achilles heel of the spammers is their message. They can circumvent any other barrier you set up. They have so far, at least. But they have to deliver their message, whatever it is. If we can write software that recognizes their messages, there is no way they can get around that.

      And I think that in this he is correct, almost even provably correct. That's theory, however. In practice no system, short of "real" AI, will be good enough to always recognize spam with a zero false positive rate. It may eventually be good enough, but it won't be perfect. Natural language is just too hard to parse in this way.

      But don't despair. If it flunks, there's always spammotel and their likes.

      --

      "If you think education is expensive, try ignorance" - Derek Bok

    4. Re:Sure it's promising by rgmoore · · Score: 4, Informative

      Another important point is that there are some things that they can't hide, at least not in their current working model. If they're trying to sell you something, they have to describe what that thing is and where you can get it, and those descriptions are unlikely to be in any legitimate email. If they want to advertize a web site, they have to include its URL in the message, and the filter can catch that. If they advertize a physical address or phone number, the system can catch those, too. If they don't repeat the message, it means that there's inherently less spam, because I'm only seeing each add once.

      It's also not possible to disguise everything in their headers, so things like their posting host (either the one they pay for legitimately or any open relay they're taking advantage of) will wind up being a pointer to who they are. They certainly can't change anything about the headers that's added downstream of their posting host, so as long as they keep using the same one it's likely that there will be characteristic stamps there that the spammers absolutely can't change. I know that analysis of the headers is part of bogofilter, another Bayesian filter that I've been using to good effect.

      --

      There's no point in questioning authority if you aren't going to listen to the answers.

    5. Re:Sure it's promising by Brendan+Byrd · · Score: 2

      Is there an application to this theory with SpamAssassin? Right now, it's more or less human-edited words and phrases, but applying a real Bayesian method to it would increase it's accuracy. I've also consider making a filter that would change the scores of the different SA rules to reduce the false positives, but this would be a long project.

    6. Re:Sure it's promising by rgmoore · · Score: 4, Informative

      Bogofilter comes close to this. It has an operating mode where each file that it filters is automatically added to the appropriate corpus, either of spam or non-spam. Since it's correct the vast majority of the time, that means that there's very little for the user to do. When it is wrong, you just take the messages that it miscategorized and feed them back into the system with the notation that they were originally marked incorrectly, and it backs out the changes to the wrong category and adds them to the correct category.

      I'm using bogofilter with Evolution, and it works very well. I just have two extra folders, one for false negatives and one for false positives. When I notice mail that's been flagged incorrectly, I drag it into the appropriate folder and run a script that tells bogofilter to correct its mistake. Then I either flush the mail (if it was spam marked as non-spam) or process it normally (if it was non-spam marked as spam). I've only been using it for about two weeks and it already has a nearly zero false positive rate (i.e. incorrectly flagged as spam) and a usefully low false negative rate (i.e. incorrectly flagged as legitimate).

      --

      There's no point in questioning authority if you aren't going to listen to the answers.

    7. Re:Sure it's promising by dvdeug · · Score: 2

      it already has a nearly zero false positive rate

      True. I think I've only had one message falsely get pegged as spam.

      a usefully low false negative rate

      I haven't found this to be true. Maybe it's because I didn't save up all my spam to send through it, but I estimate that it's only catching half my spam. Nigerian spams still get through sometimes, which should been very easy to catch.

    8. Re:Sure it's promising by marmoset · · Score: 2, Informative

      Over the last month or so, I've received a few really strangely worded porn spams that seem to be engineered so as not to trip ISP porn filters. They use lots of passive verbs, no exclamation points, no HTML, and dictionary definitions of whatever kink the spammer is selling.

      Since I use Jaguar's mail client, I just told it that these were spam too and now it catches them by itself. :)

    9. Re:Sure it's promising by tsg · · Score: 4, Insightful

      Any solution that requires spammers to be more clever is going to reduce the number of spammers. And that is the end goal.

      --
      People's desire to believe they are right is much stronger than their desire to be right.
    10. Re:Sure it's promising by Tim+Browse · · Score: 4, Interesting

      One interesting fact that came out of these statistical analyses of spam was from one that was featured a while back on slashdot - the guy was doing word analysis, and was looking for good spam indicators/correlations, and expected "sex" or "teens" to be a good match, but the best word was, surprisingly, "ff0000". This was because so much spam uses HTML mail with red text.

      So if nothing else, it will force spammers to stop using red text - that has to be some kind of victory :-)

      Tim

    11. Re:Sure it's promising by shayne321 · · Score: 2

      Is there an application to this theory with SpamAssassin?

      Yup, they've been working on getting this added to the tests they're already doing, so you get the benefits of bayes filtering PLUS all of the other tests SA does. I'm not attached to the project, but I follow the sa-devel list.. From what I've seen, most of the code is in CVS so you can get it by downloading one of the nightly test builds.. I imagine if it goes well it will be included in the next release.

      Shayne

      --
      Today I didn't even have to use my AK; I got to say it was a good day -- Icecube
    12. Re:Sure it's promising by Brendan+Byrd · · Score: 2

      Any links to the archive of devel messages? I didn't see much with the search for "Bayesian" in the list archive.

    13. Re:Sure it's promising by Alsee · · Score: 5, Funny

      (e.g., if you are a computer scientist, your mail may include hammy words like "algorithm" "compile" "project" or "stargate" that would help distinguish ham from spam.

      I have a cousin that lives in Nigeria and we regularly discuss tips on penis enlargement. He works at a bank refinancing mortgages and his wife is a professor at an accredited university. I work in in a Las Vegas casino producing shows featuring live nude showgirls. He offered to help me pay some bills and get out of debt (a generous offer, but I told him I just found a second part time job working from home earning thousands of dollars per week). My wife is a stock broker and I regularly let my cousin in on hot stock tips. I have an herb garden, I take viagra, and use rogaine. Since we both own the same brand of printer we've been working out the best way to refill the ink cartridges. I've been trying to lose weight, but it comes right back as soon as I quit smoking.

      I don't quite understand this "beysian filter" stuff, but I can't wait to try it out!

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    14. Re:Sure it's promising by shayne321 · · Score: 2
      Here's SourceForce's Archive. The developers mostly refer to it as Bayes, so try that in your searching.. Also you can search their bugzilla for "bayes" to see some of the discussion there, too.

      Shayne

      --
      Today I didn't even have to use my AK; I got to say it was a good day -- Icecube
    15. Re:Sure it's promising by tsg · · Score: 2

      It may eventually be good enough, but it won't be perfect.

      "Good enough" is usually all that's required. We could spend a ton of money and a bunch of time coming up with the perfect solution (maybe) to a problem that, for most people, is largely just a nuisance. Or we can go with a much cheaper, easier to implement, "good enough" solution that will bring the problem down to manageable levels.

      If it flunks, there's always spammotel

      I found this in their FAQ: "there is nothing to install on your computer. When you download the SpamMotel User Interface and place it on your desktop, it is ready to go."

      OK, so which is it?

      --
      People's desire to believe they are right is much stronger than their desire to be right.
    16. Re:Sure it's promising by stand · · Score: 2, Insightful

      This is true, but remember, with computer-related ventures like a spam operation, all you need is one clever person to write the clever program that gets distributed to all the morons. This spam filter is a perfect example. I'm not clever enough to write something like that myself, but I'm certainly clever enough to download it and use it.

      --
      Four fifths of all our troubles in this life would disappear if we would just sit down and keep still. -C. Coolidge
    17. Re:Sure it's promising by Autonomous+Crowhard · · Score: 2

      While you're right about all the things that are difficult to hide, you (and apparently everyone else) have missed one of the other neat aspects. Filtering of the "ham" quickly becomes a inadvertant whitelist.

  4. Server-side solutions? by Quixote · · Score: 3, Interesting

    Any server-side solutions (MTA==qmail, MDA==procmail) using this (Naive-Bayesian) technique out there?

    1. Re:Server-side solutions? by rehannan · · Score: 2

      I've been using PopTray (a POP3 email checker for Windows). You have the option of defining "rules" which allow you to delete emails server-side.

      It's not a "smart filter" but it works fine for me.

    2. Re:Server-side solutions? by cmeans · · Score: 4, Interesting
      James is a 100% Java Email server (SMTP, POP3, NNTP, and IMAP soon) that supports mail-server extensions via the Mailets API. I developed a Java implementation of the Bayesian rules discussed, so that they could be used in any configuration, but also provided a mailet wrapped implementation so that the filtering (or flagging) could be done at the server side.

    3. Re:Server-side solutions? by koreth · · Score: 4, Interesting

      I've been using SpamProbe (which gets invoked from procmail) with excellent results.

    4. Re:Server-side solutions? by ragnar · · Score: 2

      Yes, my company provides an online service to do this sort of thing. We are in beta right now. email me (ragnar@spinweb.net) if you are interested in some more details, as the marketing stuff on the site is a bit lacking.

      --
      -- Solaris Central - http://w
  5. Mozilla in Process of adding Bayesian filter by AT · · Score: 5, Interesting

    The mozilla mail client is getting a Bayesian mail filter, too. See http://bugzilla.mozilla.org/show_bug.cgi?id=163188 . Unfortunately, it probably won't show up until after version 1.2 is released.

    1. Re:Mozilla in Process of adding Bayesian filter by Jugalator · · Score: 2

      And it seems likely the SpamBayes project will work as the foundation for their mail filter.

      There are a few other applications that use this code as well, such as an Outlook 2000 add-in.

      --
      Beware: In C++, your friends can see your privates!
  6. That Google search... by Jugalator · · Score: 4, Insightful

    Try searching for "bayesian email filter" instead of just "bayes email filter" (as in the news post). You'll get better results and more hits since Google doesn't match "*bayes*" (as one would think) when searching for "bayes", but only the actual word "bayes".

    --
    Beware: In C++, your friends can see your privates!
    1. Re:That Google search... by Preposterous+Coward · · Score: 2
      Google doesn't match "*bayes*" (as one would think) when searching for "bayes",

      Just curious: Why at all would anyone think that "bayes" would match "*bayes*"? Imagine if searching for "cars" also got you "scars", "Johnny Carson", and so on...

      It might make sense for a search engine to do limited stemming (cars -> car, eating/eats/ate -> eat), but that's something completely different...

      --

      "Biped! Good cranial development. Evidently considerable human ancestry."
  7. Bayesian? Wow!!! I'm sooo excited. (Irony!) by davids-world.com · · Score: 5, Interesting
    A true Bayesian filter, wow. Let's face it, statistical classifiers based von Bayes' formula are not really state of the art. They make false assumptions about the data (independence of features).

    More intelligent classification algorithms can solve non-linear problems far better. Check out Kernel Machines and, somewhat older, Maximum Entropy models.

    Enough nerd talk for today :-)

    1. Re:Bayesian? Wow!!! I'm sooo excited. (Irony!) by Lenbok · · Score: 3, Interesting

      Actually compresssion-based techniques don't work particularly well, mainly because they are very sensitive to the amount of training data. If you have a lot of non-spam mail, your non-spam compressor will compress better than your spam compressor.

      In the long view, all compression is machine learning anyway :-)

    2. Re:Bayesian? Wow!!! I'm sooo excited. (Irony!) by JPZ · · Score: 3, Informative

      A true Bayesian filter, wow. Let's face it, statistical classifiers based von Bayes' formula are not really state of the art. They make false assumptions about the data (independence of features).

      Bullshit. Bayes' formula is exact, and makes no assumption on independence whatsoever. Naive Bayesian approaches make independence assumptions, hence the use of the term naive.

      The only inherent drawback in using Bayes' rule in classifiers is that you have to assume the number of classes to be known a priori.

      JPZ

  8. Forget Bayes by Evil+Adrian · · Score: 5, Funny

    We need the Stalin Mail Filter (TM) -- it detects spam, hunts down the spammer, and exiles them to Siberia.

    --
    evil adrian
    1. Re:Forget Bayes by Galahad2 · · Score: 3, Funny

      I tried that, but it was constantly too paranoid about idenifying spam. I can't even remember how many of my friends and family ended up in Vladivostok for sending me bad jokes. The problem sort of solved itself though, since the filter program eventually just barracaded itself in my second hard drive and refused to come out. The only drawback is that now I can't save anything on the drive, since the Stalin Filter instantly deletes everything it can.

  9. *BUT* it's a Perl script... by pilot1 · · Score: 2, Redundant

    Sure it's great that someone made one, but its a perl script. We might be able to use perl , but most of the "normal" people have never even heard of perl, let alone them having knowledge of running perl scripts. It would be great if someone ported this, to an .exe file or something that everyone could run. It'll probably happen eventually.

    1. Re:*BUT* it's a Perl script... by Niksie3 · · Score: 2, Funny

      sure... an .exe file everyone could run... have you had your pills today? a perl script runs on many more platforms then any .exe file.

      --
      Sig you!
    2. Re:*BUT* it's a Perl script... by Elias+Israel · · Score: 2

      This is a very good point.

      Truth is, to really tackle the problem of spam, a solution is needed that doesn't require the user to be a software engineer.

      Plus, another problem with rolling out a Bayesian filter for a large collection of users is that each individual user needs their very own filter database. The statistical analysis of my mail would be nearly useless for anyone else.

      OK, cards on the table: I am working on a new solution that will be useful for the general public and overcomes these problems.

      Those who care to learn more can sign up to be notified when it becomes available.

      Check out www.PureMessaging.com

    3. Re:*BUT* it's a Perl script... by rgmoore · · Score: 2, Informative

      But perl scripts are just as easy to run as .exe files, so long as you have the perl interpreter installed. So now it's just a two step process:

      1. Install perl.
      2. Install the perl script.

      This is not exactly brain surgery. Perl can be installed on essentially any system you choose to name, with no more trouble than installing any other executable. For those people running Windows, there's an excellent port available from Activestate. As somebody else pointed out, this means that a perl script is actually available to more people than a .exe would be, because it's truly cross-platform.

      --

      There's no point in questioning authority if you aren't going to listen to the answers.

    4. Re:*BUT* it's a Perl script... by crisco · · Score: 2

      You're absolutely right. I've been closely following POPFile's development (and trying to help with docs) and it is a goal of the developer to create a brainless install that the masses can use, while still retaining the cross platform core that is useful for much more than spam detection. POPFile is under very active development and is only recently getting close to the point where it will be ready to stabilize on a release.

      --

      Bleh!

    5. Re:*BUT* it's a Perl script... by Jeremy+Erwin · · Score: 2

      Lots of libraries allow you to embed a perl interpreter in a C program... I suspect that a number of linux email clients could be altered to run such a script as part of their "retrieve_mail()" functions.

      What do you want? a hideous visual basic macro in Outlook? The mere fact that one OS is difficult to use with perl shouldn't be a obstacle to innovation.

    6. Re:*BUT* it's a Perl script... by B'Trey · · Score: 2

      Might want to check your own medicine cabinet. Sure, Perl runs on more platforms. So what? How many of the worlds actual computers have Perl installed? Even better, how many of the worlds computers that are used daily to read email have perl installed? How many of them can run an .exe file? I'd suggest that the latter is orders of magnitude more than the former.

      --

      "The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.

    7. Re:*BUT* it's a Perl script... by crucini · · Score: 3, Informative
      It would be great if someone ported this, to an .exe file or something that everyone could run.

      I don't think an .exe would help much - a Windows user doesn't need a standalone executable. He needs a filter (probably a .dll) coded to the specific filtering API of his mail client. Or does Microsoft have a generic mail filtering API? That way the filter seems to run "inside" the mail client.

      In general this illuminates one of the advantages of Unix. Lots of programs are written as filters that read from STDIN (standard input) and write to STDOUT (standard output). My own mail filtering script, for example, does that. I didn't have to learn any mailer-specific API, and my script can be used in different contexts. (Actually my script doesn't write to STDOUT - it saves the message to the appropriate folder.)

      Windows does not lend itself to the everything-is-a-filter idea because, among other things, process creation is slow and expensive. When a filter is invoked, a process is launched. Unix has more efficient process creation, and Linux has especially efficient and light process creation. Therefore on Windows a mail filter should be implemented as a reusable software component (probably a COM object) that can be called by the mail client.

      Also, most mail clients on Unix use the same mail folder format (mbox) which is basically just the literal messages from the network written to a file. Since it is the assumed common language of mail folders, it encourages software to interoperate on the file level, which my script does by writing messages to mail folders. (Unix is file-centric.) Windows mail clients, in contrast, seem to store mail folders in proprietary formats. That's because Windows philosophy is that an application serves as gatekeeper to "its" files - the file is not a unit of interoperability. In our case it means a standalone mail filter probably couldn't write messages to the mail folder.

      Unix is a more friendly, efficient development environment because you can write a mail filter as a standalone program and test it without building a test harness.
  10. I don't get any spam by Istealmymusic · · Score: 3, Funny

    Can someone explain why this filter would be useful to me?

    --
    "The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
    1. Re:I don't get any spam by moosesocks · · Score: 4, Funny

      Just post your email address, and we'll be happy to tell you.

      --
      -- If you try to fail and succeed, which have you done? - Uli's moose
  11. bogofilter by stype · · Score: 4, Informative

    This isn't exactly the first bayesian mail filter out there. I've been using ESR's bogofilter for weeks now, and I must say it works better than I could have ever imagined. Bogofilter however is simply for sorting out spam, while it appears this filter can sort out other things. But honestly, I can setup some simple filters to separate personal emails from work emails, so I'm not entirely sure the extra stuff is that useful.

    --
    -Stype
    Bus error -- driver executed.
    1. Re:bogofilter by Theodore+Logan · · Score: 2
      You quite obviously haven't checked out bogofilter's README. Let me quote:
      • This package implements a fast Bayesian spam filter along the lines suggested

      • by Paul Graham in his article "A Plan For Spam".
      'Nuff said.
      --

      "If you think education is expensive, try ignorance" - Derek Bok

    2. Re:bogofilter by SubtleNuance · · Score: 2

      what is your point?

    3. Re:bogofilter by Theodore+Logan · · Score: 2
      The parent said:
      • This isn't exactly the first bayesian mail filter out there.
      But the FAQ of bogofilter, which the poster uses as an example of an earlier filter, clearly explains that it is actually built according to the principles laid out in the very article it is claimed to have preceeded.

      Why is it that you always have to spell things out for your fellow slashdotters? What on earth is so difficult about just reading a post carefully before you reply? Sorry for the harsh tone, but I'm just so tired of this.
      --

      "If you think education is expensive, try ignorance" - Derek Bok

  12. IMAP by Evil+Adrian · · Score: 2, Insightful

    Does anyone know of any spam solutions for IMAP? Everything I've seen out there is POP3, but goddammit I like my IMAP folders!!! (Not to mention that the server on which my e-mail resides gets backed up nightly...)

    --
    evil adrian
    1. Re:IMAP by LetterJ · · Score: 2

      If you use SquirrelMail, you can use a Bayes spam filter from the Squirrelmail plugin page.

    2. Re:IMAP by vondo · · Score: 2
      Yep. I wrote IMAPAssassin (on sourceforge).

      Its a perl script that uses SpamAssassin on runs on any machine as an IMAP client. Spam shows up in your INBOX and disappears shortly there after.

      People are working on a Bayesian module for SpamAssassin, which will be promising. The great thing about SA (as many others have said) is that it uses a number of inputs to decide if a mail is spam-like, including auto-whitelists which keep track of the people who send you mail.

    3. Re:IMAP by vondo · · Score: 2

      The problem is that lots of us don't have root access to our mail servers to install these filters. And sending the mail to a home computer first for filtering is less than satisfactory.

      Just guessing this is the poster's issue.

  13. product of marketrons by hfastedge · · Score: 2, Interesting
    I don't know if it is true Bayesian


    You know, on this issue, you really depress me. You are clearly not of the academic nature, so your stance toward something thats probably way above your head really frustrates part of me.

    As long as you're not developing the idea, it shouldnt matter how it works as long as it works.

    I read the original article here as you did to. After all the mumbo jumbo about learning, i picked out one effective tip from the article on filtering my email: filter out HTML.

    With 1 line of regex I eliminate 95% of my spam:
    match and throw it out.
    --

    -- -- --

    Help my mini cause: My journal

    1. Re:product of marketrons by spitzak · · Score: 2

      Filtering out "

    2. Re:product of marketrons by crucini · · Score: 3, Insightful
      You know, on this issue, you really depress me. You are clearly not of the academic nature, so your stance toward something thats probably way above your head really frustrates part of me.

      I think you may have misunderstood that comment. Since Paul Graham started talking about Bayesian filtering, there's been some tendency here to refer to all learning spam filters as Bayesian. Which results in complaints, which results in the designation "pseudo-Bayesian" for the many independently-discovered learning algorithms that don't have a theoretical underpinning.

      Put another way: if an algorithm outputs a dimensionless "score", and the author can't set an upper bound on the score, it's at most pseudo-Bayesian. If it outputs a probability that the message meets certain criteria, then it could be "true Bayesian". Additional implication: the "pseudo-Bayesian" filter may have a stack of rules in addition to its table of probabilities.

      I don't think we're splitting hairs on some deep statistical issue. I think we're groping for very rough categories in a new field of application software. If you can establish clearer categories, that might help.
      With 1 line of regex I eliminate 95% of my spam: match and throw it out.

      Graham addresses this in the article. One can identify most spam with a simple rules-based engine. That tends to make one lazy in reading the spam folder, which means false positives can languish unread. Enhancing the rules-based engine becomes an ongoing project as the volume and clerverness of spam increase. Hopefully Bayesian filtering can automate this.
  14. Not integrated solution by unfortunateson · · Score: 2, Insightful

    What will make this thing work is if it is integrated with the e-mail client.

    With this tool, you unfortunately have to manually add a message of a certain classification (work, pr0n, spam, family...) to the progrma through the perl script -- very awkward.

    A tool like this need to run as a daemon and 'notice' when a message is added to a folder. Unfortunately, with different formats for e-mail folders, it's a much tougher job.

    As it stands, with something like Outlook, I'd have to export each message individually, then run the Perl script. I can probably add a macro to do that (with its own pains -- you add a VBA macro to Outlook and it gripes every time you start up), and possibly even one that responds to filing in a folder.... hmm... maybe I will try this out.

    --
    Design for Use, not Construction!
    1. Re:Not integrated solution by crisco · · Score: 2

      This tool also has a web interface to reclassify mail. Not as good as client integration but a little easier than the command line for the masses.

      --

      Bleh!

  15. You know what I'd kill for? by Saint+Aardvark · · Score: 3, Interesting
    A version of this for Outlook Express.

    I work on the helpdesk of a small ISP; I also take care of the spam filtering, and answer abuse@. We recently added SpamAssassin, and God does it rock. (The big spike you see is me getting MRTG to graph what SA catches now; it's 6-10 times better than what we used to catch.)

    But I still get complaints from our customers about spam that gets through. Just the other day a crapload got through because it was relatively subdued spam (no webbugs, NO LINE OF YELLING, etc); unfortunately, it also advertised pictures of young boys having sex. It's hard to explain why it's very, very hard to filter for this sort of thing, especially when I'm going through the talk for the nth time this week. (I need a good analogy that non-geeks can understand; I'm still looking.)

    The good folks at DeerSoft have a version of SpamAssassin for Outlook, and are promising one for OE Real Soon Now. But I would loooooooooooooooooooooooove a good spam program -- this or SA or something else -- that I could point our customers to. Download, double-click, say yes, and bam it's installed. I can figure out how to install this on a Unix box; I could probably, eventually figure out how to do it on a Windows box; there's no way the customers could do it.

    Or am I missing good, free spam filtering for Windows? Can anyone point me in the right direction?

    Slightly OT: There has got to be a huge market for setting up spam filtering for small businesses. My idea: Tell 'em that if they provide the box -- an old Pentium or 486 will do -- I'll set up spam filtering and a firewall on it, set up some maintenance tools (whitelist this, firewall that). They get great mail service, I get $x00.

    1. Re:You know what I'd kill for? by bstadil · · Score: 3, Informative
      You know what I'd kill for?

      It might be smarter to read the article, than killing someone.

      You could have installed the program for Outlook in the time it took you to type your rant, but then you would not get any Mod point would you.

      --
      Help fight continental drift.
    2. Re:You know what I'd kill for? by crisco · · Score: 2

      As others have pointed out, thats exactly what POPFile is. Unfortunately it is not yeat a point and click kind of install but that is the direction it is heading.

      --

      Bleh!

    3. Re:You know what I'd kill for? by Webmonger · · Score: 2

      This tool does work with windows. It's probably also possible to set it up as an alternate mail server for your users.

    4. Re:You know what I'd kill for? by q2k · · Score: 2

      You could try pointing customers to http://www.pocomail.com as their Windows email client. Not only does it solve all the MS Email Viri issues, but the built in spam filtering is pretty damn good. I'm not sure what the theroretical underpinnngs are, but out of the box it will put most spam in the junk mail folder, and with some tweaking it will get 90% of it.

  16. Re:Bayes Explained by johnynek · · Score: 5, Informative

    That's /. for you. You guys have modded up to 5 a post that is wrong in both of the equations it posts.

    It should be:

    Pr(h|D) = Pr(D|h) * Pr(h) / Pr(D)

    and:

    Pr("SPAM"|Email) = Pr(Email|"SPAM") * (proportion of spam) / (probability of getting this paticular Email)

    --
    jabber: johnynek@jabber.org
  17. Re:Um. No. by judd · · Score: 2

    I think you have failed to understand how the filter works.

    It is "trained" on a corpus of spam, which is compared to a corpus of known good messages. The important part is that YOU, the user, supply the spam corpus and the good messages. Thus in your case, as long as your "good spamlike messages" are in your "known good pile", similar new ones from the same source will not be tagged as spam. This is where the statistical approach shines over simple keyword matching.

    Go on, read about how it works. You might learn something.

  18. SquirrelMail has a Bayesian plug-in by ptbarnett · · Score: 4, Informative
    Plugins - BayesSpam - Intelligent Spam Filter

    SquirrelMail is a WebMail client implemented in PHP. I use the client, but not the plugin (I use Razor).

  19. Re:Um. No. by jjo · · Score: 2

    Well, if all spam is indistinguishable from the legitimate spamlike messages you want to see, then no filter will help you.

    However, it seems more likely that a large proportion of spam is distinguishable from mail you want to see. It's quite plausible that you don't want to see messages about nympho sluts, or penis enlargement, or breast enlargement (or at least not all three), and that a naive Bayesian filter could easily distinguish these and other spams from mail you do want to see.

  20. Uhmm.. like bogofilter? by Jamuraa · · Score: 3, Informative

    Bogofilter has been out since august, and does this bayesian spam-stuff in C, which probably will run a bit faster than the perl or python versions just because of it's compiled-ness. I've never run it myself, but people on debian lists say it works better or not as good as spamassassin.

    --
    You can't see this if you have sigs turned off.
  21. Professional Looking Spam May Be Impossible by Bob9113 · · Score: 4, Insightful

    This may be self-regulating. Consider the Skinner box; if something is capable of perfectly emulating recognition of Chinese, then it can be said to recognize Chinese. Likewise, if a spammer becomes sufficiently skilled at writing undetectable prose, he or she will have reached a skill level at which he or she can pursue more profitable writing ventures. The margins in spam are pretty small. Those spams are being written by morons because morons are cheap.

    1. Re:Professional Looking Spam May Be Impossible by ceswiedler · · Score: 3, Informative

      I don't think you're talking about the Skinner box, which is a device used in the psychology of learning, but rather the Chinese room, which is John Searle's take on AI and the Turing test.

    2. Re:Professional Looking Spam May Be Impossible by Bob9113 · · Score: 2

      Ahh yes, thank you for the correction!

  22. Re:Bayes Explained by capt.Hij · · Score: 2

    Great, now the spammers will hire mathematicians to figure out how to best defeat the common algorithms used to calculate Pr(D|h). It is the same old story. In a war over information only the mathematicians win.

  23. Oops, screwed up the URL... by cmeans · · Score: 2
    Apache Jakarta James is at http://jakarta.apache.org/james.

  24. Re:As effective as a well trained secretary by bmwm3nut · · Score: 2, Insightful

    but, unlike your secretary not showing you things. you can just set up the filter to put the spam in a spam folder. you can then periodically look at it and see if there are any false positives. or you can tell the filter to delete things that are 95% spam, but put things that are still most likely spam in a special folder. that's what's great about learning algorithims, they can always adapt to what you want (if you teach them enough).

  25. perlcc by Camel+Pilot · · Score: 3, Insightful

    I just received the November edition of the TPJ which included a fine article "perlcc & Compiling Perl Script".

    In short, the filter script could be compiled to C and built to a native binary for a variety of platforms eliminating the need for a Perl interperter.

  26. Re:The decimal issue by Spock+the+Baptist · · Score: 2

    One of my pet peeves is the obsession that folks have with zeros. An example is the year 2000. In base 10 you get beaucoup zeros whereas with hex you get 7D0, or 11A6 (base 12), or 3720 (octal), or 11111010000 (binary). Zeros are an artifice of both the base, and numeral system used to represent a pure number. Thus, the fact that most humans use the decimal Indo-Arabic numeral system to represent it is the only reason for all those zeros. Use another base, or numeral system to represent 2000, you don't get beaucoup zeros.

    The real properties of pure numbers are the relationships that they have with other numbers, and not the symbology used to represent them.

    --
    "Oh drat these computers, they're so naughty and so complex, I could pinch them." --Marvin the Martian
  27. Staged Categories by irritating+environme · · Score: 2, Interesting

    An advertised false positive rate of 0% is nice, but why not additional research into the spam, to attempt to categorize into blatant spam, probable spam, borderline, and non-spam, and see if false positives can be plopped into the borderline categories.

    Also, from what I saw in the article, there will already be a next level that spam can take: image-based messages, misspellings of key words (klik, Clic, Clik, etc), using 0xfe0000 for almost-bright-red.

    --


    Hey, I'm just your average shit and piss factory.
  28. Re:Um. No. by rgmoore · · Score: 2

    You're wrong, though. The whole point of this kind of filter is that it develops its rules based on the information that you give it, not what somebody else thinks. If you tell it that mails from your legitimate business partners aren't spam, it learns to tell them apart. I use a Bayesian filter on my mail, and it has no trouble telling my legitimate business mail, like messages from Amazon about books I've been waiting for, from illegitimate ones. Some of that is that the legitimate mail is written with a very different style from the illegitimate stuff, but I assume that the filter has also learned that mail with amazon.com as the sender is OK. In any case, I find that it just plain works.

    --

    There's no point in questioning authority if you aren't going to listen to the answers.

  29. Re:Bayes Explained by B'Trey · · Score: 4, Informative

    Read the referenced article. The only way to avoid the filter is to make your email sound like a normal message. In essence, the filter recognizes the sales pitch. If you remove the sales pitch to get your spam past the filter, you've removed the whole point of sending the spam.

    --

    "The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.

  30. Where's the news? by Roadmaster · · Score: 4, Informative

    Just because it's the first one that actually makes the slashdot frontpage it doesn't mean it's the only one.

    Do a freshmeat search for bayespam, bogofilter and spamprobe, they're all working and quite mature bayesian filters (or should we say "paulgrahamian" in order to appease the "true bayesian" crowd). Hell, even a search for "bayes" will turn out a few more hits, like ifilter, which aims to automatically classify mail in different folders, but could be easily tuned to filter out spam.

    Of these, I think spamprobe is becoming the true "swiss army knife" of "bayesian" filtering; I did find both bogofilter and bayespam spartan, but they work well. spamprobe, on the other hand, is very actively maintained, is under constant improvement by the author, Brian Burton, and has given me excellent results getting rid of over 90% of my spam.

  31. Good in combination with spamassassin? by Moritz+Moeller+-+Her · · Score: 2

    I am just about to put bogofilter in my mail filtering system. I am thinking about combining this baby with spamassassin, as described here:
    http://www.randomhacks.net/2002/09/23/#usin g-bogof ilter-with-spam-assassin

    I will use the pass through option and I can use spamassassin to protect against false positives and to adjust the sensitivity.

    BTW: Does anyone know if the number of SPAM and nonSPAM have to be about equivalent or is this accounted for? I have 4000 spam mails in a folder, but just about 500 nonspam mails.

    --
    Moritz
    1. Re:Good in combination with spamassassin? by Matts · · Score: 2

      FWIW, SpamAssassin 2.50 will include a statistical filter that works like similar bayesian filters.

      It should be pretty cool, in that it will automatically train on spamassassin results, as well as allowing you to add or remove spam and non-spams.

      Matt (a spamassassin developer)

      --

      Matt. Want XML + Apache + Stylesheets? Get AxKit.
  32. Developers missed this... by bigberk · · Score: 3, Insightful

    In my testing (over the last 30 mins) I discovered that filtering is employed when the POP3 "RETR" (retrieve entire message) command is used but no filtering is done when the equally useful "TOP" (show me the headers and X lines of the body) command is issued by a client.

    A huge advantage of also doing the filtering for the TOP command would be that mail clients such as The Bat, Pimmy, JBMail and PocoMail will let you preview all headers while leaving mail on the server (or deleting it, whatever) but without actually downloading the full message bodies.

    1. Re:Developers missed this... by crisco · · Score: 2

      Thats a good idea. Message classification would get less accurate on just the headers or headers+top of message but that might be enough to avoid downloading spam (biggest drawback to POPFile, you still download the spam, only to delete it).

      --

      Bleh!

    2. Re:Developers missed this... by crisco · · Score: 2

      No, not presently. It seems the author wants to keep it as simple as possible. However, as it matures it might be great to look at all the different ways people use mail and mail clients and start making allowance for what people like to do.

      --

      Bleh!

  33. Re:Spam will be spam by acceleriter · · Score: 2

    I try the creative step of prepending common Chinese names, e.g. zhao@chinacenter.com, chen@chinacenter.com, lchen@chinacenter.com, chang@chinacenter.com. Along with a nice "Thank you" for the beautiful picture of the Dalai Lama they sent me, and good wishes that the freedom of information contrary to the PRC's politics continues.

    --

    CEE5210S The signal SIGHUP was received.

  34. Is this intended for server, client, or both? by Rooney444 · · Score: 3, Insightful

    If this is only intended for client side use then it still doesn't address the issue of all the bandwidth that spam wastes. Wouldn't it just be a better project to help all the idiots close the open relays on their servers? Or maybe require authentication on all SMTP servers?

    1. Re:Is this intended for server, client, or both? by dzym · · Score: 4, Informative
      Yes, but remember, who runs the SMTP servers?

      The very design of the whole system specifies that anyone can just turn on a machine, hook it up to a network somewhere, and start spewing out messages to smtp ports all over the world.

      It doesn't have to be a sendmail, qmail, or exim server, remember. Some Windows viruses have taken advantage of that loophole to set up mini-SMTP servers in the network stack to continue propagating viruses without needing to connect to anything that provides authenticated external relay.

    2. Re:Is this intended for server, client, or both? by tsg · · Score: 2

      It's another tool to use. Just because it doesn't solve the entire spam problem doesn't make it useless.

      The main issue of spam for most end users is that they have to waste time wading through the spam to get to their real email. This filter does most of that for them.

      There isn't going to be one solution to end spam completely. It's going to take a lot of people nibbling away at the problem until it becomes more bother to send spam than it's worth. My father always said, "Do you know how to eat an elephant? One bite at a time." This is another bite out of the elephant.

      --
      People's desire to believe they are right is much stronger than their desire to be right.
  35. Re:Um. No. by dvdeug · · Score: 2

    Does this system know what businesses I've given my credit card to?

    Do you understand what a bayesian filter does? It tries to figure out what you consider spam. I don't like dentists sending me advertising junk; bogofilter trashes it. Anything about Esperanto or Project Gutenberg or Linux could probably fly on through, as it's got a lot of words that actually appear in my good email in it. At worst, a couple messages from that business get caught, and then it will recognize that the messages are good based on sender and embedded URL's.

    In any case, there tends to be a huge difference between the messages I've got from companies I've given my credit card to and the ones that are sending me spam. Usually, one is quietly informing me of new items for sale, and one is screaming about crap. A bayesian filter can often tell the difference.

  36. Re:Ximian Evolution? by rgmoore · · Score: 2, Informative

    With some cleverness, you can use any outside filter with the most recent version (i.e. the develpment fork) of Evolution. They've added the ability to pipe incoming messages to an outside program and read back the exit code. So if the program is written using standard Unixisms- i.e. it reads on standard input and returns a different value depending on whether the incoming message is spam or not- it can be used with Evolution. I know that bogofilter can do this because I'm using it with Evolution and it works pretty well.

    --

    There's no point in questioning authority if you aren't going to listen to the answers.

  37. What about random misspellings? by archeopterix · · Score: 2, Interesting

    Hm... what about an anti-anti spam filter that mangles the message inserting random misspellings into the spam-identifying words? The bayesian filter would perceive this as a message consisting of many 'unclassified' words, just like a message in some unknown language. Sure, the short words probably haven't got many possible misspellings (cock, c0ck, coock, cokc - hm... starts to look undecipherable ), so they would probably get classified after some time. And this would hopefully lower the spam success ratio. But the possibility still remains...

    1. Re:What about random misspellings? by PigleT · · Score: 3, Interesting

      Dual feedback loops. Every mail that matches spam gets fed back into the system so both the is-spam wordlist AND the is-good wordlists become more "concentrated" over time.
      Ifile does this, bogofilter does this with some wangling in procmail, ...

      That way, if someone sends something that's still mostly spam (one or two words in common with spam, enough to tip the balance) then all the neutral words will be tarnished as well.

      --
      ~Tim
      --
      .|` Clouds cross the black moonlight,
      Rushing on down to the circle of the turn
    2. Re:What about random misspellings? by archeopterix · · Score: 2, Interesting
      Dual feedback loops. Every mail that matches spam gets fed back into the system so both the is-spam wordlist AND the is-good wordlists become more "concentrated" over time. Ifile does this, bogofilter does this with some wangling in procmail, ... That way, if someone sends something that's still mostly spam (one or two words in common with spam, enough to tip the balance) then all the neutral words will be tarnished as well.
      This is clever, but might have some undesirable side effects. Suppose a spammer attaches a long list of neutral words to his e-mail in order to 'dilute' the bad words. This way some innocent words might get assigned positive spam probability thus resulting in false positives later.
    3. Re:What about random misspellings? by Dun+Malg · · Score: 2

      This is clever, but might have some undesirable side effects. Suppose a spammer attaches a long list of neutral words to his e-mail in order to 'dilute' the bad words. This way some innocent words might get assigned positive spam probability thus resulting in false positives later.

      This is a possibility, but if the words are "neutral" then they'll likely show up on the "notSPAM" side too, which keeps them neutral. For an otherwise "good" word to become "bad" it'll either have to never show up as "good" (which means it might as well be bad), or show up in a LOT of spam, and I don't think you'll ever see that level of co-operation between spam spewers.

      --
      If a job's not worth doing, it's not worth doing right.
  38. Missing the point? by crisco · · Score: 5, Informative
    I think lots of people here are missing the point of POPFile. Everyone is happy to point out that there are already several assorted solutions to Bayesian mail filtering in many different languages. Nearly all of these work on the mail server. Now lots of us are qualified and interested in setting up our own mail server, customizing the mail processing our own One True Way and happily enjoying an inbox free of spam. But the average windows user has no idea how to set up a mail server. Others could easily do it but feel their time is better spent on other things, not admining a mail server.

    This is what POPFile is for. Its a pop3 proxy server, it sits between your pop3 client and the server and simply adds a classification to the headers (or the subject line for braindead mail clients).

    Currently POPFile is a bit rough on computer newbies, it needs a Perl install and such. However, if you read the forums it is intended to end up as an easily installed executable for windows users and to remain a nifty little perl script for the rest of the platforms where it might come in handy. So when those pesky friends and relatives come asking about all the viagra and farmyard spam they get (and you haven't already set them up on your tightly filtered mail server) set up POPFile for them.

    Also, its not just for spam filtering. Think of what you could do if you could go beyond simple rules for your inbox. Want email you think is important forwarded to your phone? Create a category for important email and go through your archives and feed POPFile email you would have wanted forwarded instantly. Create a new folder to recieve those mails and watch it for a few days, retraining POPFile until it is getting reasonably good at putting important mail in there. Now set up your mail system to forward those to your phone. Will it work? I don't know, but based on the results I'm getting, it probably would. How about using it to filter help desk emails?

    --

    Bleh!

    1. Re:Missing the point? by Zuke8675309 · · Score: 2, Informative

      Exactly true. POPfile isn't just about filtering spam. It's about sorting email. Slightly different. One could think of the nuance this way - out of all the email you get you could teach POPfile to filter out the GOOD email and delete everything else. I've found POPfile extremely useful for bringing order to the clutter of my inbox. I have buckets for spam, fantasyfootball, personal, and several work related subject matters. I just pull up the web interface, classify the messages properly and POPfile works it's magic.

  39. Yahoo! Mail by sfe_software · · Score: 2

    Noone has mentioned it so far, but Yahoo mail has a Bulk Mail folder. SPAM is automatically sent there, and I have yet to see a single false positive (and false negatives are quite rare as well).

    The system works surprisingly well. I checked the FAQ and it doesn't go into any detail about how it works, but I wouldn't doubt if something like this is being used.

    I've been thinking, and it seems that this could potentially have a lot of use, aside from Spam filtering. Perhaps a mail client could let you categorize email in general (SPAM, Business-related, forwarded stuff from AOL users, etc), and learn how to spot and organize things.

    I'm putting this (either the POPfile or bogofilter) into place with a modified SquirrelMail, just to give it a good run; I might try and modify it to also categorize other types of email, just to see if something like that could work.

    I could easily see a mail client (web-based or otherwise) that lets you drag mail to specific folders, and eventually learns how to do this for you (and of course you can always correct it by simply dragging to another folder, which also contributes to the learnig process)...

    After reading this article my mind is just spinning with ideas... Bayesian search engines... perhaps speech/voice recognition applications... classifying text/html/doc files... organize songs (processing the lyrics)... ugh, I should stop now :)

    --
    NGWave - Fast Sound Editor for Windows
    1. Re:Yahoo! Mail by q2k · · Score: 2

      I think Yahoo is using Brightmail. Earthlink uses it too and I was quite impressed when I used Earthlink. I quickly got to a point where I never logged into the server to check the junk folder.

  40. Re:Um. Yes by crisco · · Score: 2
    Try it, you might be surprised.

    You can separate the newsletters from the businesses you've opted in to from the penile-enlargement spam. Thats one of the beautiful things about POPFile, it isn't just about spam vs useful mail. In fact, it seems to be more accurate and learn faster when you define categories for all the different types of mail you recieve, not just spam vs inbox.

    --

    Bleh!

  41. Re:Bayes Explained by Jim+Nugent · · Score: 4, Informative

    To put this in simpler terms, consider this scenario, 90% of all all X-rays that have a certain feature are from women with breast cancer. That is an easy statistic to compute; you have the x-rays and you follow up with the patients.

    The trick is derive a statement like: "If an x-ray has this feature, the patient has NN % chances of having breast cancer. THAT's useful tor screening, but it doesn't follow from the first statment (without some serious statistical calculations).

    Bayes theorem has all sorts of applications in prediction. In the case of E-mail, we can greatly oversimply and say "We found that X% of E-mails with this subject line are Spam." "We conclude that an E-mail with this subject line has Y% odds of being spam." Note that these are two very different statements. If we can find Y for the second statement and set a threshold we're comfortable with, say, 95% then we can create a filter with 95% confidence of correctness; it may well be wrong 5% of the time.

    Other responses have done a good job with the math so I won't repeat it here.

  42. Re:what is the point then? by rgmoore · · Score: 2, Insightful

    Well, there are potentially three points. One is that hopefully after a while the filter will work well enough that you can develop some real confidence in it and you won't have to check every time to see that it's working right. I'm pretty close to that point with bogofilter; I so rarely see any false positives that I can almost afford to flush the messages without checking. Actually, I assume that what I'll really do is to change the rules a bit so that alleged spam is sent to a waiting folder and doesn't even show up in my main inbox.

    That gets to point two: now I'll be able to check for spam in batch mode. Instead of going through my inbox every time I look for messages, marking some as spam and reading others, I'll be able to read just about everything in my inbox without worrying about spam. Then once a week I can check my spam box and see if there's actually anything legitimate there. This is going to be faster than doing it every time a new message shows up in my inbox.

    I'm not a compulsive mail reader, but for some people this would also be really useful because it would protect them from distractions. They are working on something and then their mailbox beeps them to let them know that a message has arrived. Unfortunately, when they check it out it turns out that their train of thought has been needlessly disrupted by another spam. If they can filter out the spam before the notification while still being alerted promptly when a real message shows up, that's a big win.

    --

    There's no point in questioning authority if you aren't going to listen to the answers.

  43. Bayes by John+Garvin · · Score: 5, Funny

    Now we can tell spammers: "All your Bayes are belong to us."

  44. Mail.app by Arker · · Score: 2

    The apple mail client, mentioned in the blurb, works very well with IMAP, that's what impressed me enough that I'm actually using it.

    --
    =-=-=-=-=-=-=-=-=-=-=-=-=-=-
    Friends don't let friends enable ecmascript.
  45. Multi-purpose tool by B'Trey · · Score: 3, Interesting

    An interesting idea that I haven't seen discussed is using this concept for more general uses. If we can sort spam from non-spam, how about business from personal? Technical from administrative? All you'd need is multiple databases of word probabilities, the ability to assign emails to multiple categories and a hierarchical method of sorting.

    --

    "The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.

  46. this battle cannot be won by mboedick · · Score: 4, Insightful

    These technologies are interesting, but the problem of spam should be solved at the source. Why should we waste our time, money, CPU and drive space trying to outwit spam with clever software? As has been said before, if you filter spam at the inbox, a lot of resources have already been wasted by the time it arrives.

    Spam is anti-social behavior - a perversion of technology to make a quick buck. It's a cancer, and we should try to kill it. If you try to fight it any other way, you will constantly be playing catch-up, as the spammers have technology on their side too.

    1. Re:this battle cannot be won by shayne321 · · Score: 4, Insightful

      These technologies are interesting, but the problem of spam should be solved at the source.

      And how do you propose we solve the problem at its source? Make it illegal? They'll just find loopholes in the law and/or move to a country where it is legal. Hunt them down and murder their wife and kids in front of them then hang them from a tree? Satisfying though it may be, last I checked murder was illegal.

      Techniques like this CAN eventually solve the problem.. As others have pointed out, for someone to buy something from a spammer they have to READ the spam. If they send out 1 million spams and 500,000 read them and 20 of them buy something, they'll keep doing it. If they send out 1 million and only 500 people read it and 1 person buys something, they'll loose their source of income and have to find a new line of work.

      Also, for each obstacle we put in their way (checksum databases, open relay databases, filters, etc) it costs them more time, effort and therefore, money to send their crap - all for less income.

      Shayne

      --
      Today I didn't even have to use my AK; I got to say it was a good day -- Icecube
    2. Re:this battle cannot be won by crucini · · Score: 3, Insightful

      It's all very well to say that spam should be stopped at the source, but how do you plan to do that? Blocklists that pressure the ISP? SPEWS is pretty effective, but Verio, UUNet and Sprint are deeply committed to spam. They won't dislodge their pet spammers until they feel financial pain. Want the government to stop spam at the source? I see lots of problems with that. One of them is the creation of another eternal government responsibility like the war on drugs. They will forever need more funding for "the war on spam" because spammers are getting more clever. These federal agencies develop a symbiotic relationship with the "problems" they're trying to "solve".

      In practice, a multipronged approach will work best, combining prosecution, litigation, blocklists, content-based filtering, complaints to upstream providers and education of new users. Graham's article, in fact, shows how attempts to avoid prosecution push spammers into the arms of content-based filtering.

      I don't ask for a 100% solution to spam, because any such solution will have awful side effects.

  47. Pedantry! by Tim+Browse · · Score: 3, Funny

    that's not irony, it's sarcasm.

    Actually, irony is generally considered to be "use of words to express something different from and often opposite to their literal meaning".

    Sarcasm is often defined as a form of irony (but not necessarily), intended to be cutting/offensive etc.

    So while his comment may have been sarcasm, it was also irony.

    And I'm not pedantic, I'm pernickety. :-)

    Tim

    1. Re:Pedantry! by Tim+Browse · · Score: 2

      Ha, I was well aware of the alternative spellings - I just happened to choose one that wasn't your favourite :-)

      Tim

  48. Re:As effective as a well trained secretary by spitzak · · Score: 2

    This is a problem for *any* email filter. I think they are trying make better solutions for this very problem. Actually solving it is impossible, but this may approximate a solution better than any other filter.

  49. What's the problem? by LS · · Score: 2

    I don't understand why everyone has so much difficulty with spam. Ever since my yahoo mail got deluged, I abandoned it and set up another account. I only gave it out ONLY to my friends/family (about 60 people in my address book right now), and no one else. I keep another mail alias for online purchases and other sites where I MUST give a real mail address. If my alias address starts getting spam, then I will simply redirect it to it's own folder instead of my inbox, then start using a new one. But I'm very selective about whom I purchase from on the net (read: no porn).

    I haven't received any spam in over a year.

    Ellis

    --
    There is a fine line between being a cultivated citizen and being someone else's crop. - A. J. Patrick Liszkie
  50. Welcome to the future by disarray · · Score: 3, Informative
    Future systems (assuming faster processors and more HD space) could include semantic analysis (e.g., Latent Semantic Analysis) to do an even better job and go beyond the word level.

    Welcome to the future: the mail client in Mac OS X 10.2 uses latent semantic analysis. (This isn't just marketingspeak--my mail folder includes "LSMMap"--LS as in "latent semantic".)

  51. I was wrong by crucini · · Score: 2

    I didn't read the POPFile link. Had I read it, I would have known that POPFile is a POP Proxy. Therefore it is a good candidate for conversion to a standalone executable. In other words, given the lack of standard email hooks on the Windows platform, POPFile cleverly avails itself of the one standard to which mail clients are pretty much forced to adhere - POP3.

    However while the proxy itself can live as an .exe, integration with the mail client is still desirable if the user is to categorize mail and thus "teach" the system. I guess the alternative, for naive users, is to ship the proxy with a static table of probabilities which can be periodically updated like virus definitions.

  52. Re:Bayes Explained by brw215 · · Score: 2, Informative

    Actually I didn't forget it. Typically in Bayesian expression the denomonator Pr(D) is dropped, meaning there is no more probabilty of any one email then any other.

  53. Other applications... by Ed+Avis · · Score: 3, Funny

    How long until we can set up Bayesian by-word filtering on Slashdot comments?

    --
    -- Ed Avis ed@membled.com
    1. Re:Other applications... by WolfWithoutAClause · · Score: 2

      What do you mean? Picking out keywords is how the moderation system actually works isn't it?

      --

      -WolfWithoutAClause

      "Gravity is only a theory, not a fact!"
  54. Growing a spam filter -- a firsthand experience by devphil · · Score: 4, Interesting


    So, the graduate CS course I'm taking this quarter is Evolutionary Computing, which is all about the convoluted nonlinear multidimensional-search-space problems, and guess what our current homework is? That's right, taking statistics on spam data, and using genetic algorithms to evolve a working spam filter.

    Due to one typo and two thinkos in my fitness evaluation function, my algorithm evolves -- within only a few dozen generations -- a solution which looks like this:

    Ignore the actual contents of the message. 34% of the time, it's spam.

    And it's right.

    --
    You cannot apply a technological solution to a sociological problem. (Edwards' Law)
  55. Spamassasin by fireboy1919 · · Score: 3, Interesting

    This seems to be about using strange approaches to spam filtering, but really...a bayesian network seems to be a natural step for a system that henceforth was composed of a series of heuristics with no knowledge of which is more important.

    (Why hasn't it been done? Bayesian networks are only taught in AI and statistics classes).

    What really interests me is that Spamassasin claims to use a genetic algorithm to rate how likely an e-mail is to be spam.

    --
    Mod me down and I will become more powerful than you can possibly imagine!
  56. Re:you are making my point.... by WolfWithoutAClause · · Score: 2
    No. I think you've missed atleast one point. Quite a lot of spammers send mail messages that contain URLs that are unique to you. If you open an email message that contains a URL like that- your browser opens the URL and that tells the spammer that the email is a good one, and they can sell it to other spammers for money- and then you're gonna get more spams.

    With the filters you can go offline before checking through the list of suspected spams; that way the URLs don't resolve and the spammers don't know you are there; and you get less spam.

    --

    -WolfWithoutAClause

    "Gravity is only a theory, not a fact!"
  57. Re:you are making my point.... by Blkdeath · · Score: 2
    No. I think you've missed atleast one point. Quite a lot of spammers send mail messages that contain URLs that are unique to you. If you open an email message that contains a URL like that- your browser opens the URL ...
    Whoa! What kind of browser and e-mail client are you using?!? I don't even think Outlook/IE are stoopid enough to automatically request URLs!

    Don't tell me you're confusing human stupidity with intelligent SPAM filtering?

    --
    BD Phone Home!

    Shameless plug. Like you weren't expecting it.

  58. Re:you are making my point.... by WolfWithoutAClause · · Score: 2
    I'm currently using Netscape 7.0 which does this; but I've used Outlook previously and it is stupid enough to request GIFs from a web server unless you explicitly turn it off; that misfeature is on by default in both.

    Whoa! Don't tell me you assume that GIFs always come with the email? Hey I've got this bridge, wanna buy one? ;-)

    --

    -WolfWithoutAClause

    "Gravity is only a theory, not a fact!"
  59. Spamvertised URL Tracker by herbierobinson · · Score: 2

    The tool we really need to combat spam is a personal tracking database for spamvertised URLs. The idea would be to put every URL adversited by spam into the database and then send DAILY complaints to the level 1 ISP for the host until either

    1. The URL no longer works.

    2. The ISP responds with proof that the URL owner filed criminal complaints against the spammer.

    I, for one, am thoroughly fed up with with the amount of time I have to waste dealing with spam. It's time to make it really painful for any ISP that tollerates it.

    --
    An engineer who ran for Congress. http://herbrobinson.us
    1. Re:Spamvertised URL Tracker by pne · · Score: 2

      Um, hello? How long would it take to set up a filter that would file all of your complaints straight to /dev/null? I fail to see how your solution would be very painful to any ISP with half a clue. I also fail to see how it can be effective.

      --
      Esli epei etot cumprenan, shris soa Sfaha.
    2. Re:Spamvertised URL Tracker by herbierobinson · · Score: 2

      Then I would have a record of the ISP habitually not responding to spam complaints. I am running a business. I am suffering 5-10% losses due to having to deal with spam. If I can prove an ISP is not responding to spam complaints, then I can sue them for damages in small claims court. The logic there is that the ISP's action (not responding to spam complaints) constitutes negligence and makes them directly liable for my damages.

      Not to mention that once you have proof that they are not responding to SPAM complaints, you also have some great material for press releases. I especially like the idea of sending press releases about publiicly traded companies to the financial press. A press release about pink contracts with a pron spammer sent to local news media can also be quite effective -- especially if the pron was sent to children (I have lots of examples of that archived for future use). This kind of pressure got level3 to drop a huge pron outfit (or at least fix it so traceroutes from my machine to to thier don't go through level 3). In that case, I was also sending e-mail directly to some of their major investors... Like I said, I am being severely damaged by SPAM and I am just starting to fight back.

      --
      An engineer who ran for Congress. http://herbrobinson.us
  60. Re:you are making my point.... by Blkdeath · · Score: 2
    I'm currently using Netscape 7.0 which does this; but I've used Outlook previously and it is stupid enough to request GIFs from a web server unless you explicitly turn it off; that misfeature is on by default in both.
    Ok; common-sense measures indicates you turn off remote images and plugins for your mail + news reading.

    Weren't we talking about people intelligent enough to be proactive about their SPAM prevention measures?

    Now then - what URLs are your e-mail client loading for you?

    --
    BD Phone Home!

    Shameless plug. Like you weren't expecting it.

  61. This was the least of their worries by edunbar93 · · Score: 2

    Heh. People that annoyed Stalin were exiled to Siberia if they were lucky, and were too important to simply kill. :)

    --
    "No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
  62. Several points come to mind by CySurflex · · Score: 2
    I just spent over two hours reading through Paul Graham's web pages, POPFile's web pages, this slashdot thread and most of the other links provided as well. Some points come to mind:

    1. Yahoo Mail has an interesting way of dealing with spam - you can "report as spam" any message that comes into your inbox. I suspect that they don't have a human reading these, but instead try to match multiple copies of the same e-mail being reported as spam by multiple people. When you have millions of users, if 10,000 report the same e-mail message as spam, it's probably spam. It would be interesting to have an open source program using P2P technology to do the same thing.

    2. Like somebody mentioned above, this could be very useful in categorizing helpdesk e-mails, and even providing some canned automatic repsonses for them. E-mails with the words "forgot", "password" and "can't" and "login" would have a very high probability of being about a user can't logging in for some reason, and could be resolved by an automated "HOWTO" and save a company some man hours.

    3. I'm going to try to integrate this into our exchange server at work tomorow if the IT guys will let me mess with it, and if not I'll try to integrate it into my (gasp) outlook exchange client.

  63. Already patented by MicrosofT by barfy · · Score: 3, Informative

    This whole methodology is already patented by Microsoft. ANY implementation not licensed by Microsoft is going to be a violation... And now that you know, it is treble damages...

    patent 6,161,130

  64. Spamassasin and Bayesian by tangent3 · · Score: 2

    BTW, the current unstable version 2.50 of Spamassassin also utilises a Bayesian filter as one of the rulesets. Pretty cool.

  65. Been posted before... by NNland · · Score: 2, Informative

    I hate to mention this, but I will anyways.

    Popfile was announced here in late August, shortly after the Paul Graham article came out. It was originally closed source, which prompted the creation of multiple other projects. Among them is Spambayes and even my own Pasp (both in python, both open source).

    As well, Popfile was announced open source at the end of September...on Slashdot. I know this because it was released under such a license as I was finishing up Pasp.

    So yeah. As for how well Popfile categorizes mail into multiple categories, I have not run many tests with multiple category bayesian filtering, though the Spambayes group has, and has discovered that filtering mail based on multiple categories is far less accurate (many false categorizations). In the minimal tests I have done, I find this to be the case as well (we are used to less than 2% FP and FN rates, and with >2 bin categorization, error rates spike easily into the 10% range).

    So yeah. Popfile has been announced here no less than 3 times now. I've not seen Spambayes announced at all (they deserve it), and Pasp has also not been announced, though I could care less about that.

  66. Not quite Re:Bayes Explained by WolfWithoutAClause · · Score: 2
    Kind of. The way to avoid the filter is to use words that are most commonly used in non spam email messages. The Bayesian classification doesn't actually recognize any kind of sales pitch per se.

    So it's really only sensitive to phraseology.

    --

    -WolfWithoutAClause

    "Gravity is only a theory, not a fact!"
    1. Re:Not quite Re:Bayes Explained by B'Trey · · Score: 2

      Actually, you not only have to use words that are commonly used in non-spam but you also have to avoid words that are commonly used in spam. So how do you convince someone to buy something without using words like "buy" "purchase" "special" "deal" "unique" etc? How do you convince people to come to your porn site without describing the pics you'll find there? Care to post an example spiel?

      And if someone does find a way, you'll correct the filter and it will start to recognize the new format.

      I don't claim that the Bayesian filter is in any way intelligent and actually recognizes the sales pitch. I do claim that sales pitches have certain characteristic word usages that can be identified by statistical analysis, and that the filter in effect recognizes those characteristics.

      --

      "The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.

    2. Re:Not quite Re:Bayes Explained by WolfWithoutAClause · · Score: 2
      So how do you convince someone to buy something without using words like "buy" "purchase" "special" "deal" "unique" etc? How do you convince people to come to your porn site without describing the pics you'll find there? Care to post an example spiel?

      I don't know you from Adam; you may be a spammer for all I know, or a spammer may read this. Either would be bad. So no, I don't care to.

      --

      -WolfWithoutAClause

      "Gravity is only a theory, not a fact!"
  67. Aaaarrrggghhh!!! by upper · · Score: 2
    The patent covers any method at all like Paul Grahm's method. He's discusses the patent here.

    The patent claims boil down to using a probabilistic classifier to recognize spam. There are many claims, but they're mostly trivial elaborations. Probabilistic classifiers aren't new, and there's no claim they invented them. And it doesn't look like they had to solve any real technical hurdles to apply it. It's one of the most egregiously obvious patents I've seen in a while.

    I say there's only one way to test whether an idea is obvious to people skilled in the field, and that's to pose the problem to people skilled in the field and see if they can find the solution. Anything less is a joke.

    Not to diss Horvitz and Heckerman -- they're big names in Bayesian inference and Bayes nets. They've been behind a bunch of solid research.

  68. bayesian modslapping by psamuels · · Score: 2

    Great, next we'll see slashcode automoderating based on bayesian probability of a troll. Use leetspeak, go to -1, Offtopic.

    Please someone tell me I didn't just give them the idea..

    --
    "How can you claim that you are anti-crack, while still writing a window manager?" — Metacity README