Symantec Brightmail Anti-spam 99.999% Accurate?

[dlevens]

Has anyone looked into this product? It claims fewer than 1 false positive in every 1 million messages identified as spam. Sounds to good to be true. Curious if anyone has used it?

 

http://www.brightmail.com/xsp-as-features.html

 

Dennis

[TCH-Bruce]

Moved for organization

[jandafields]

The title of your thread should be 99.9999%, not 99.999%

 

Having an accuracy of 1 in 1-million is impossible. I say this because spam is starting to look more and more like personal messages from friends:

 

Dear Bubba,

 

Here is the link you were looking for.  Please enjoy this.

 

h**p://www.show_me_something_I_don't_want_please.com

 

Your friend,

LeRoy.

 

 

I have seen spam like this, and friends have sent me stuff like this. How is a computer possibly going to tell the difference?

 

 

 

Will it do good with topics that is well-known to be spam? Well, what if 2 friends are actually writing back and forth with links to websites for certain body part enlargements? How could the computer possibly know that this is not spam?

 

I'm sticking with initial thought that those stats are definately impossible...

[dlevens]

I too am skeptical which is why I am curious if anyone has used this yet. However I do know that reading the actual email is only one test of many. It could be the exact email you list above, but lets say the link that they are sending you to could be on a known spam list which would nail it right there. Or lets say the email comes from a known public proxy that sends spam causing even more points towards being spam. Then there is the md5 value, if a spammer is sending the same message to many people it will have a numerical value based on how many characters and spaces and there is one test this program uses that checks the numerical value against an updated black list. This software has email programs around the globe that are never used so by that fact any email sent to them are spam. It then records the numerical value and maintains a database to scan against. And I am sure there are many more tests that would help even identify the email sample you listed.

 

99.9999% does seem outragous, but I do know that companies like valueweb.com deploy this and the numbers are so good for catching legit emails that they implement it server wide and auto delete spam. Customers have to actually elect not to have their email deleted. I have a friend who runs a realestate business and was getting on average 200+ spams a day even using spam cop as a filter. As soon as valueweb impleted Brightmail he instantly dropped to less than 10 a day. So far in several months with tons of legit email a day, he has not had one person say didn't you get my email?

 

So maybe not 99.9999 but I would venture to guess it is in the very high 90% range. At that level I think I too would elect to have an auto delete setup.

 

I am not sure how this compares to Spam Assassin so I am very interested if any people who have tried both. So far I am extremely happy with Spam Assassin, after switching on bayes and auto learn it seems to be getting better. I also move all my spam from my old hotmail account to my spam folder here and run my spam learn script which has been helping. I have my SA set at 8.0 since I am trying to get to a point where I can feel comfortable enough to turn on auto delete for SA. Then the ones that get through train SA and report to spam cop.

 

Also I could be wrong, but I believe the 99.999% is actually referring to how many legit emails it will mark as spam. 1 in a million. I doubt it means it will catch 99.9999% of all spam sent to you. My guess is some spam will still get through, as even my friend still gets 10 a day. But it is so safe that you can easily auto delete the spam it catches since it will be very rare it will see a legit email as spam.

 

 

Dennis

[jandafields]

I use SpamAssassin with required_hits=4.5 Everything marked as spam is deleted before it gets to me. I have not used auto learning or anything else extra.

 

I also edited all rules dealing with body parts and their growth and changed their score to 5 so they are definately deleted.

 

This has almost completely elimated my spam. I get very very little now. I am real happy with SpamAssassin.

[dlevens]

wow, very aggressive. I get emails all the time from family and friends that score 5 and even up to 5.5. You are not losing legit email at that score?

 

Dennis

[jandafields]

Messages marked as spam are automatically deleted, so I guess I would never know if I lost some.

 

 

Looking at my inbox, the messages from my friends all seem to have a score between negative-5 and positive-3.

 

And, I still get a few spams. 4.5 doesn't seem to be real aggressive.

[dlevens]

Maybe you have been using SA for a long enough time for it to know who your friends are. I am on week 3 now so maybe in a few months I can drop the score to 5. At first a lot of legit email was scoring above 5 now only a few are.

 

Dennis

[silica]

Can you briefly explain how to determine what number of hits Spam Assassin assigns to a particular email? And how to configure it to learn? I don't understand how to use these features from the Cpanel spam assassin interface.

 

Thanks

[jandafields]

This guide shows how to properly setup and configure Spam Assassin:

 

http://www.totalchoicehosting.com/forums/i...showtopic=11452

 

 

After Spam Assassin is running, look at your FULL email headers to see the Spam Assassin hits on a particular email.

[dlevens]

pretty cool, I actually have a "guide" now on these forums

 

As far as hits goes. SA assigns a score to each email it sees based on many tests it performs. For more details on the tests it does on an email see spamassassin.org.

 

IF you want to see the score, just click on view headers from which ever email program you use. It will look something like this:

 

Subject: Topic Subscription Reply Notification ( From TotalChoice Hosting Family Forums )

From: "TotalChoice Hosting Family Forums" <boards@totalchoicehosting.com>

X-Priority: 3

X-Mailer: IPB PHP Mailer

Message-Id: <E1BlxnH-00014F-9M@server1.totalchoicehosting.com>

Date: Sat, 17 Jul 2004 18:36:35 -0400

X-TCH-MailScanner-Information: Please contact the ISP for more information

X-TCH-MailScanner: Found to be clean

X-TCH-MailScanner-SpamCheck: not spam, SpamAssassin (score=-4.9, required 6,

    autolearn=not spam, BAYES_00 -4.90)

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server1.totalchoicehosting.com

X-AntiAbuse: Original Domain - levens.com

X-AntiAbuse: Originator/Caller UID/GID - [99 99]/ [47 12]

X-AntiAbuse: Sender Address Domain - totalchoicehosting.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam-Level:

X-Spam-Status: No, hits=-4.9 required=8.0 tests=BAYES_00 autolearn=ham

    version=2.63

X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on

    server74.totalchoicehosting.com

       

 

To set your threshold you can do it from cpanel. A safe number is between 6 and 8.

 

For how to setup auto learn and bayes see my guide which Jandafields pointed out.

 

Dennis