Cerebrus update
[1/2] from: gchiu:compkarori at: 21-Feb-2003 15:04
Patches to version 1.2.5 are now up.
Cerebrus will now not start up if another instance is
already started. This may solve the problem for those who
got into a loop downloading new patches.
HTML comments are now stripped out in non multipart email
( they were already being stripped out in multipart base64
encoded html email etc ).
And some statistics on the spam that I have received since
November 2002.
This is a breakdown of the ways Cerebrus has caught spam:
No To Address: 28
No DNS: 126
Spamserver: 126
Forged Hotmail: 150
Content: 275
Bayes: 280
Forged Headers: 381
Spamcop: 420
Banned: 438
Header: 517
Subject: 997
Spamtrap: 1048
NoSubject: 4
Total spam 4790 since 1st November 2002 ( 42.8/day )
False -ves ( 1/week ) 16/4790 is .3%
False +ves ( 1/fn ) 8/4790 is .15%
Detection Rate is 99.7%
the false -ves/+ves are not entirely accurate as I haven't
kept figures, but this is my impression. False positives
for me may be even less.
I relaxed the criteria for what constitutes a forged email
earlier this month, and this may lead to an increase in
false negatives, and also fixed some bugs which may lead
to a decrease in false positives.
I am interested in stopping false positives as they
constitute a type of programming error. If someone is
experiencing a high rate, please let me know and I'll try
and see why.
--
Graham Chiu
http://www.compkarori.com/cerebrus
[2/2] from: gchiu:compkarori at: 26-Feb-2003 15:14
I've built the experimental version 1.3.0 with the SDK and
this is available at
http://www.compkarori.com/cerebrus/cerebrus130.zip
I'm hoping that there are no major bugs introduced and
since the SDK has read/lines fixed, it should be quicker
now in downloading email.
Using Cerebrus will always be slower than using your email
client, but the time saved in cleaning your email up if
you get a lot of spam will more than make up for it.
Apart from using the SDK for this build, there are the
following changes:
1. Email sent from a mail server that lacks a DNS record
will now always be flagged as spam unless the sender is in
your allowed lists.
2. You no longer need the network.txt file, and a new
installation does not drop to the console to build the
network.txt file. The network settings are set up in the
GUI configuration screen. And of course you can enter
them in the email dialect.
3. Cerebrus will now backup the configuration file, and
numbers them sequentially, before saving any new changes.
Nearly losing the banned server list of several hundred
spam server IP addresses was the incentive for this
change.
4. Your statistics of spam vs ham are posted to the
Compkarori/cerebrus site, and can be turned off in the
modes
setting ie. sendstatistics
You can see my spam/ham statistics at
http://compkarori.com/cgi-local/statistics.r
and if you have a static ip address, you can see your own
as
http://compkarori.com/cgi-local/statistics.r?ip=ipaddress
This doesn't tell you about accuracy, just the ratio of
your email which is ham/spam.
The funny looking icon at the top left is where I'm
supposed to load an icon image :(
--
Graham Chiu
http://www.compkarori.com/cerebrus