Re: Spam filtering regexp - keyword countermeasure countermeasure

I am also using POPFile and I didn't notice that it failed to catch spam with "split" words. Most of the time it seems that there are sufficient other clues to categorize the e-mail as spam or not.

If it ain't broken, don't repair it!

However, as it is an interesting question, I would go along the following track:

First, delete all "funny" characters (*, #, _, ...).
Then collapse all whitespace in between single alphabetic characters (this might catch the occasional 'I' or 'a', but that would be quite rare I think. If it happens too much, you could make an 'I' or 'a' at the beginning of end of a sequence of a 'split' word an exception to the rule. Alas, 'V *I *A *G *R *A' would then become 'VIAGR' and 'A' and 'I *N *T *E *R *E *S *T *R *A *T *E *S D *R *O *P' would make 'I' and 'NTEREST RATES DROP', but POPFile would quickly catch on to these as well)

CountZero

"If you have four groups working on a compiler, you'll get a 4-pass compiler." - Conway's Law

Comment on Re: Spam filtering regexp - keyword countermeasure countermeasure

Replies are listed 'Best First'.
Re: Re: Spam filtering regexp - keyword countermeasure countermeasure by shemp (Deacon) on May 12, 2003 at 21:15 UTC
To help trying to avoid inadvertently collapsing a legitimate single character, you could maybe use the idea that the "funny" separator is the same between things that should be collapsed. (until the spammers catch on to that) It will be a not fun day when they do random grouping of chars in their headers, i.e.: viagra = V IA GR *A But, ignoring that situation, get the separator, " ", for instance, and remove all occurences. just a thought	[reply]
Re: Re: Re: Spam filtering regexp - keyword countermeasure countermeasure by hv (Prior) on May 12, 2003 at 23:05 UTC
Sorry to be the bearer of bad tidings, but I saw some spam a couple of days ago that compared its product to "`vi ag r a`". Hugo	[reply] [d/l]
Re: Re: Re: Re: Spam filtering regexp - keyword countermeasure countermeasure by Popcorn Dave (Abbot) on May 13, 2003 at 04:14 UTC
Ah yes, but would you buy V1agra? :) Saw that one too. There is no emoticon for what I'm feeling now.	[reply]
Re: Re: Spam filtering regexp - keyword countermeasure countermeasure by John M. Dlugosz (Monsignor) on May 12, 2003 at 19:15 UTC
That sounds pretty good. Thanks for the pointer.	[reply]