[spambayes-dev] Re: Evading bayesian spam filtering?

[Tony Meyer]

> > I just got this "interesting" spam, you might be interested
> > in. Clever way to evade bayesian filters that classify "I don't
> > know" (which looks to me like is the guaranteed score here...)
> 
> I meant "if you get the details right", obviously. This particular
> mail screwed the details (still sent HTML, still a spammy sentence in
> the first link in the HTML (!), ...), but I wouldn't be surprised a
> mail with "the details right" would evade most bayesian filtering. Am
> I missing something?

I wrote a whole response to this before I figured out that these are ascii
art pictures and not images (they look like images to me).

The message will have to HTML for this to work, though, or the ascii art is
too huge to fit anything in (or the ways that it can be drawn are limited).
(Looking at the plain-text version of the message, I can't make out the
words at all).

I get a fair number of these sorts of messages now - although I had thought
they were images, so I'm not sure what percentage actually are images and
which are ascii art.  Typically the only spammy content in the body of the
message is an image and the text is word salad, or news clippings or
something like that.

What did the message score for you?  I notice these in my unsures (high
unsures, usually) - there may be ones in the spam folder, too, but I don't
pay enough attention to those messages to know for sure.  Your message
scored 0.997712 for me, which isn't too bad considering it was to you and
not me.  (All but five of the spam clues were hapaxes, so this is almost
certainly because I received something very similar that was unsure and then
trained on).

There are filters that make an effort to look at the message in 'eye space'
(i.e. as the user sees it), which SpamBayes doesn't really do.  If this sort
of thing works, then more of that might be necessary, although I think there
are other ways of countering this.

=Tony.Meyer