{"action":"closed","issue":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/340","labels_url":"https://api.github.com/repos/vstakhov/rspamd/issues/340/labels{/name}","comments_url":"https://api.github.com/repos/vstakhov/rspamd/issues/340/comments","events_url":"https://api.github.com/repos/vstakhov/rspamd/issues/340/events","html_url":"https://github.com/vstakhov/rspamd/issues/340","id":97297565,"number":340,"title":"Bayesian classifier should also look at headers","user":{"login":"patrakov","id":2943163,"avatar_url":"https://avatars.githubusercontent.com/u/2943163?v=3","gravatar_id":"","url":"https://api.github.com/users/patrakov","html_url":"https://github.com/patrakov","followers_url":"https://api.github.com/users/patrakov/followers","following_url":"https://api.github.com/users/patrakov/following{/other_user}","gists_url":"https://api.github.com/users/patrakov/gists{/gist_id}","starred_url":"https://api.github.com/users/patrakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patrakov/subscriptions","organizations_url":"https://api.github.com/users/patrakov/orgs","repos_url":"https://api.github.com/users/patrakov/repos","events_url":"https://api.github.com/users/patrakov/events{/privacy}","received_events_url":"https://api.github.com/users/patrakov/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-26T08:19:28Z","updated_at":"2015-09-08T15:39:48Z","closed_at":"2015-09-08T15:39:48Z","body":"I had a chance to directly compare dspam and rspamd, by forwarding all my email from a production server that runs dspam to a test server that runs rspamd. This is a comparison of \"pure bayes\" (dspam) and \"bayes plus extra checks\" (rspamd). One would expect that, after a period of learning, \"bayes plus extra checks\" should win, but the result, for me, is not so conclusive: there are errors from both, of different kinds.\r\n\r\nOne particular pattern that I consider issue-worthy is that dspam, somehow (see below for a guess), correctly identifies all \"one link plus an image\" spams for me. Sure, rspamd has a special rule for such spams, and in recent versions it works. However, the bayesian classifier in rspamd refuses to even learn on such messages, on the basis that there are too few words.\r\n\r\nI think that this refusal is wrong. The real problem, if I understand correctly, is that the set of words to learn on is taken from the message body in rspamd and from the whole message in dspam. I.e. there is something in the headers, mime boundaries, or something like that, that is sufficient to identify such spam with pure bayes, and rspamd throws this information away. It could be improved to take headers into account for bayesian filtering.\r\n\r\nOne guess would be that these messages:\r\n\r\n * are addressed (in the To: header) to a limited set of recipients not belonging to my domain and not matching any mailing lists that I am subscribed to\r\n * claim to come from a fixed non-current version of Microsoft Windows Live Mail\r\n * have obvious spammy subjects\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/24969263-bayesian-classifier-should-also-look-at-headers?utm_campaign=plugin&utm_content=tracker%2F320726&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F320726&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"}}