New anti-spam appliance

The new anti-spam appliance finally has a license file, so I can start dorking around with it.

Happily, this appliance DOES catch picture-spam! YAY!

Unfortunately it also classifies the following as pic-spam:

To: <Everyone>
From: "The Bowler Family" <redacted>
Subject: In need of a serious laugh?

The Purina Diet

I was in Wal-Mart buying a large bag of Purina for my dogs and was in line to check out.

A woman behind me asked if I had a dog........ Duh!

I was feeling a bit crabby so on impulse, I told her no, I was starting The Purina Diet again, although I probably shouldn't because I'd ended up in the hospital last time, but that I'd lost 50 pounds before I awakened in an intensive care unit with tubes coming out of most of my orifices and IV's in both arms.

[...]

[attachments: "dadshirt Bkgrd.gif"]

Perhaps the spam/ham threshold was a bit low. Most pic-spam I know of is one line of text and an attached image. Which also makes it hard to differentiate between that stuff and stuff like this:

To: You
From: Me
Subject: Too damned cute

Dickens was sleeping upside down again. This time, I got a picture.

[attachment: UpsidedownHedgehog.JPG]

It's the pic-spam that is causing the powers that be to start mumbling about finding money, somewhere, anywhere, to just stop it. We've had these appliances sitting on the floor for a few months now, waiting for priorities to shift to the point where we can work with them. Now they have, and now I have.

I must say, it does a pretty good job. It scores on a 0-100 scale, which it sadly doesn't expose, and is hardcoded to toss anything that scores in the 90-100 range. And... it makes good decisions. You can tune the 'suspected spam' threshold lower then that, which is what I've been tweaking. Happily, it's in 'monitor and record' mode, so I can watch message flow without actually DOING anything with the messages; letting the antispam software actually on the Exchange boxes handle the load. This allows me to set the 'suspect' threshold to various spots and look to see what it tags.

Set it low enough, and I saw one message from a student to Financial Aid, asking about canceling a loan for the quarter, got picked up. Yep, raised the threshold a few ticks after that one. Apparently The Economist sends out bulletins, and that gets picked up around the 65 range. A group of students was chatting in e-mail about a class that got canceled yesterday (ice and snow), which got tagged due to the number of people on the To: line (also at about 65). One googlegroups message discussing in a scholarly way a subject that appears in spam a lot, which was tagged when the filter was set to 70.

All in all, less than 1% of the messages tagged as SPAM are tagged 'suspect'. This thing does a good job.