ePrism User Guide - EdgeWave

STA (Statistical Token Analysis)
Dictionary Spam Count
Recent changes to the way that spammers compose their messages have reduced the effectiveness
of the basic Bayesian filter. By introducing large numbers of normal words into their spam
messages, they can hide their content because the normal words outweigh the spam words and
result in a low spam count. More aggressive settings may result in more false positives.
ePrism counters this in two ways:
1. All words in the ePrism dictionary are now assigned a base level of how likely they are to be
spam. In a normal message, this increased level will not result in a false positive, since the
overall count is low. In a spam message, the result is different; the normal words will not
counteract the spam content, and the message is correctly identified as spam.
2. Training on local mail now works to reduce this base level closer to zero. This further reduces
the likelihood of a false positive.
The Dictionary Count is set to one "1" by default. This should be sufficient for most situations. It is
recommended that you only change the default value if the following conditions occur:
• If there are too many false positives and this is not alleviated by training, then the Dictionary
Count should be set to zero "0", disabling this feature.
• If too much spam is passing, then the Dictionary Count can be increased. Try increasing the value
to ten "10". If this results in too many false positives, reduce it to five "5".
Note: This setting should only be considered for modification if other measures (training,
threshold changes, uploading spam and/or legitimate mail) have been tried and have not
provided the desired result.
STA Mail Transport Log Entries
STA log entries which indicate the metric for each message can be viewed in the Transport logs.
Select Status/Reporting -> System Logs, and then select Mail Transport to view the
Transport logs.
For example:
Apr 4 17:58:50 mail postfix/qmgr[64521]: BAFB2D2DDD: from=,
size=3401, nrcpt=1 (queue active)
Apr 4 17:58:50 mail postfix/smtpd[76468]: disconnect from
mx2.freebsd.org[216.136.204.119] Apr 4 17:58:50 mail postfix/qmgr[64521]:
BAFB2D2DDD: STA: spam_metric=12
131