home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
ftp.f-secure.com
/
2014.06.ftp.f-secure.com.tar
/
ftp.f-secure.com
/
support
/
hotfix
/
fsis
/
IS-SpamControl.fsfix
/
iufssc
/
rules
/
96_fs-worddump.cf
< prev
next >
Wrap
Text File
|
2006-11-29
|
2KB
|
46 lines
# 96_fs-worddump.cf -- era Tue Nov 23 15:33:23 2004
# Copyright (C) 2004 F-Secure Corporation
# Look for symptoms of dictionary or corpus dump to thwart bayes filtering
# $Id: 96_fs-worddump.cf 2346 2005-12-09 13:59:39Z $
ifplugin FS::MsgStructure
# rule: MSGSTRUCT_DICTIONARY_DUMP_JUNK_OPENSQ_NUM
# added 2004-11-18 or thereabouts
# edit 2005-01-07: don't force MIME structure to be present
# edit 2005-01-07: cover HTML variant as well
# edit 2005-01-07: allow dot in MIME separator string
# edit 2005-01-18: allow <FONT ...></FONT> in each DIV
# edit 2005-01-18: allow message to continue after MIME ending terminator
# test: spam-2005-01-06/1685767947-1104884060.V802I3be82.localhost.localdomain
# test: spam-2005-01-07/1772147595-1105014560.V802I3ccf1.localhost.localdomain
# test: spam-2005-01-07/1772149649-1105021328.V802I3cf07.localhost.localdomain
# test: spam-2005-01-18/2722717272-1105932598.V802I3c203.localhost.localdomain
define_structure MSGSTRUCT_DICTIONARY_DUMP_JUNK_OPENSQ_NUM
structure (?:\n\n|
structure \n<DIV>(?:<FONT[^<>]{0,75}></FONT>)? </DIV>\n
structure <DIV>(?:<FONT[^<>]{0,75}></FONT>)? </DIV>\n
structure <DIV><FONT[^<>]{0,75}>)
structure [A-Za-z0-9][-a-z'0-9]{0,25}
structure (?:[.,:;?!]{0,5} [-A-Za-z0-9][-a-z0-9']{0,25}){0,50}[ .!?]?
structure \[\d{1,20}
# MIME terminator, or actual end of message
structure \n{0,4}(?:$|--[-=_A-Za-z0-9.]{14,120}--\n{0,3})
describe MSGSTRUCT_DICTIONARY_DUMP_JUNK_OPENSQ_NUM Single line of words.[number
score MSGSTRUCT_DICTIONARY_DUMP_JUNK_OPENSQ_NUM 5
endif
# rule: X_MAILER_DICTIONARY_DUMP 3
# added 2004-11-18 or thereabouts
######## TODO: regression tests
header X_MAILER_DICTIONARY_DUMP X-Mailer =~ /^(?:[a-z]{1,20} ){4,20}\d{1,20}$/
describe X_MAILER_DICTIONARY_DUMP X-Mailer appears to contain dictionary words
score X_MAILER_DICTIONARY_DUMP 3