Re: IMF and UceArchive folder

Hmmm - I seriously debated as to whether to let this thread die or not, but
I figured since I started it I might as well continue it.

The IMF has been running over the weekend at a level of 5. I just got done
checking through every piece of archived email, and have no false positives.
There is still some spam getting through to the users mailboxes, as noted by
Rich and Alex. Some of the spam has been given a rating of 1 or 2, which I
will never catch, since that is a number I cannot live with for archiving.

I have archived 383 emails since Thursday.
Breakdown:
Level 5: 33
Level 6: 38
Level 7: 63
Level 8: 188
Level 9: 61
Even though I am not catching 100%, anything it catches is that much less in
my users' inbox.
I still need to determine how much spam is making it to the users' desktop
to determine the efficiency.

I would love to be able to customize the IMF to add in keywords, for
example, but as of now, it is at least helping somewhat.

Just thought I would share this with everyone.
Jerry

"Alex Zammit" <alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uNqOp43jFHA.3580@xxxxxxxxxxxxxxxxxxxxxxx
> > Nope, not at all. I do object to the tone in you reply, though.
> In that case please accept my apologies.
>
> I could stay here answering point by point but I think the issue is pretty
> much talked out. Clearly we are both sticking to our positions.
>
> The most important fact of this thread is what Jerry said (quoting):
>
> "I am pretty pleased with the results. I was using Symantec's product,
but
> could not get it to do what I needed, and decided to give the IMF a try.
I
> am getting what appears to be 0% false positives at a level of 7. "
>
> This is the most important hard fact that comes out of this discussion. He
> did try another product which is not free. I also think he will get false
> positives at some point but not at "those" levels.
>
> My goal was that to make sure that Jery uses IMF and judges the results
for
> himself.
>
>
> cheers,
>
> Alexander Zammit
> Software Development Consultant
> Check out, ExchangeInbox.com the MS Exchange Resource site at
> http://www.exchangeinbox.com/
>
>
> "Rich Matheisen [MVP]" <richnews@xxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:aq53e1pbd1cimtcrr2dmn18g54hbdilc1p@xxxxxxxxxx
> > "Alex Zammit" <alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> >
> >>I sounds like you are taking this a bit personal. Hope you don't.
> >
> > Nope, not at all. I do object to the tone in you reply, though.
> >
> >>> That you've never seen this doesn't mean it doesn't happen.
> >>
> >>That I have never seen that makes me doubt on the validity of your
> >>quotation.
> >
> > Well, I'm glad we're not taking this personally.
> >
> > The URL and the information it offers are not mine. If you dispute the
> > results you should take that up with the entities that provided the
> > test results. I'll bet the data they pass through the software's
> > standardized and the results repeatable.
> >
> > If not, use the input to SpamAssassin's spam/ham tests and rank the
> > results yourself.
> >
> >>> Yes, they would -- unless cost was the only driving factor. That zero
> >>> price-point sways a lot of people. I use it here on my servers at
> >>> home, but certainly not in production.
> >>
> >>Do you have 11% false positives?
> >
> > I also "front-end" my servers with FreeBSD and Postfix (which removes
> > a lot of the stuff that waltzes right through IMF). Anything I see
> > hitting the IMF is not raw data. I'm also not in the business of
> > testing and measuring other peoples software.
> >
> >>> The figures are there for you to disprove. They aren't mine. Go for
> >>> it.
> >>
> >>I followed the link. These guys are quoting MCP magazine. I tried to
> >>follow
> >>the link to the review but couldn't find it (I am not saying that it is
> >>not
> >>there.) Can you forward me the link to the review?
> >
> > Why not ask the operator of the web site?
> >
> > I had little trouble finding the article
> > (http://mcpmag.com/columns/article.asp?EditorialsID=756&page=1) some
> > of which is quoted here:
> >
> > "Of the 541 messages in the GoodMail database, 62 percent (332
> > messages) were given a completely clean score of 0 by the IMF. Another
> > 138 got a score of 1-3, making them almost certainly not spam. That
> > left 71 messages, or 13.1 percent of the total, with sufficient
> > spamminess to make them interesting for analysis. Because I had
> > already purged this database of spam, this 13.1 percent represents
> > potential false positives in the SCL range of 4-7."
> >
> > You're free to debate the results with the magazine and the author.
> >
> >>> BTW, spam varys a lot from company to company, and country to country.
> >>> How well does IMF fare with Japanese spam? German? Dutch? And the spam
> >>> we receive may be quite different to the spam you receive.
> >>
> >>Agreed. This is exactly what I am saying. One cannot just say 11% false
> >>positives without looking into the specific organization.
> >
> > Nope. But you can feed each of the spam filters the same set of data
> > and measure the results. What's ham is ham and it shouldn't be marked
> > otherwise.
> >
> >>In my previous
> >>post I mentioned ways of getting a high rate of false positives as well.
> >
> > Getting false positives is easy. Eliminating them is hard. Harder
> > still if you intend to keep a respectable detection rate on spam.
> >
> >>I would like to see if the review you are quoting has indeed looked into
> >>different setups.
> >
> > You need only look.
> >
> >>> I doubt it. Well, maybe if he's never used anything else.
> >>
> >>Well he answerred you saying that he is not getting that many false
> >>positives.
> >
> > He didn't cite volumes, either. And one or two days isn't long enough
> > for users to figure out they aren't getting the mail they expect,
> > especially if he's archiving the message and not marking them for
> > users to get feedback on the results.
> >
> >>This has nothing to do on whether he used anything else. Do you
> >>want to tell me that you know more than him?
> >
> > About what? Yeah, I know more than he does about the subject simply
> > because I've been at it longer. Ask him again in a year or two. If
> > he's happy, he's happy. But if he's never investigated anything else
> > he won't know any different.
> >
> >>> I was citing published data, not making a "blanket statement". You're
> >>> stating an opinion. Now back it with some facts. You should also
> >>> disclose that you're selling products that enhance the IMF.
> >>
> >>True I am stating my opinion based on my experiece. This is backed on
what
> >>my clients say to me. You are free to take it or leave it
> >
> > I'll leave it. Thanks.
> >
> >>You have provided no facts either you simply pasted a link. Can you
> >>provide
> >>some hard facts yourself??
> >
> > Since I don't IMF except very casually, no. As I said, I'm not testing
> > software.
> >
> >>You can easily find who I am by looking at my address of this post. My
> >>name
> >>is in many places on the web and the links are public.
> >
> > It says you're a "Software Development Consultant" in your sig. It
> > doesn't say "I sell software that modifies he behavior of the IMF".
> >
> >>I have been developing Exchange applications for many years and I have
no
> >>problem arguing this issue in detail if necessary. Lets stick to the
"11%
> >>false positves" issue just to make sure that we get something useful out
> >>of
> >>this discussion.
> >
> > You're barking up the wrong tree. If you dispute the finding of the
> > people that did the testing, then do your own test and refute theirs.
> > I'm not selling anything and anything I'd reccomend would be
> > considered too expensive and dismissed immediately by most of the
> > people that read this newsgroup.
> >
> >>> BTW, you should understand the 11% is a measurement of how much of
> >>> "known good" (i.e. ham) is determined to be spam, not 11% of all
> >>> messages examined. There's quite a bit of difference there. But you
> >>> knew that after you read the information, right?
> >>
> >>Since you are quoting my links I think you should immagine that I know
> >>that.
> >
> > Sorry, but thise were my words, not quotes from your web site. I did
> > click on the link in your sig last night, but not to plagerize
> > anything.
> >
> >>What 11% means is that if you look at the Junk Email folder (lets assume
> >>gateway blocking is disabled) out of every 10 emails filtered you will
> >>find
> >>a bit more than one good (ham) email.
> >
> > 'Fraid not. It means that for every 10 good messages about one of them
> > will be miscategorized as spam. It has nothing to do with how many
> > message that are truely spam are categoized as spam.
> >
> >>> Nothing like a little self aggrandizement, huh?
> >>
> >>As I told you my links are public. I have no problem challenging your
11%
> >>statement.
> >
> > You keep insisting that it's *my* statement. I may point out that
> > there's information stating that figure, but it's not *mine*.
> >
> >>Hope you will stick to the argument rather than truning this into
> >>something personal.
> >
> > Sure, just as soon as you stop telling me that I'm the one that's
> > wrong. If you quibble with the information published by others, refute
> > that. Don't try to make it my problem.
> >
> > --
> > Rich Matheisen
> > MCSE+I, Exchange MVP
> > MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
> > Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx
>
>


.

Relevant Pages

  • Re: IMF and UceArchive folder
    ... could not get it to do what I needed, and decided to give the IMF a try. ... > 138 got a score of 1-3, making them almost certainly not spam. ... > potential false positives in the SCL range of 4-7." ... > It says you're a "Software Development Consultant" in your sig. ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... > BTW, spam varys a lot from company to company, and country to country. ... post I mentioned ways of getting a high rate of false positives as well. ... > disclose that you're selling products that enhance the IMF. ... I have been developing Exchange applications for many years and I have no ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... a lot of the stuff that waltzes right through IMF). ... 138 got a score of 1-3, making them almost certainly not spam. ... potential false positives in the SCL range of 4-7." ... MCSE+I, Exchange MVP ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... >results would be quite crazy to use IMF. ... BTW, spam varys a lot from company to company, and country to country. ... >case yes I would say that you do risk a high level of false positives. ... Rich Matheisen ...
    (microsoft.public.exchange.admin)
  • Re: PLUG: PMAS
    ... The state of the art that can be obtained with DNSbsl is> 80% with out a DHCP list, and well into the 90% in spam detection. ... more good mail probably gets lost for other reasons beyond the mail server operator or network administrators control. ... So what DNSbls are you using that generate these higher rates of false positives? ... And most of the mail servers that I have seen allow local customization of the bounce message they send to their internal network users. ...
    (comp.os.vms)