306468 - spam filter improvement

Status: RESOLVED WORKSFORME

(Thunderbird :: General, enhancement)

Description

[Vladislav Malyshkin]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b3) Gecko/20050712 Firefox/1.0+
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b3) Gecko/20050712 Firefox/1.0+

Is it possible to improve thunderbird spam filter so it will look across several
messages, not just to a single one, for determination whether a message is spam.

People often receive several spam messages with almost identical content, but
they come from different sources. Such messages similarity is a good
identification of spam.
Is it possible to add into spam filter one more indicator of spam: 
User received two or more almost identical messages.

Also, this indicator work better when spam volume increases,
because there are more chances to receive same spam from several places.

Reproducible: Always

Comment 1

[Adam Guthrie]

What makes you think we don't already do this?

Comment 2

[Vladislav Malyshkin]

Because I often recieve almost identical spam messages.
(I use version 1.6a1 (20050830))
I can not post them new right now (because I probably already marked them as
spam manually),
but if you want - I can post new such messages when I receive.

Comment 3

[Vladislav Malyshkin]

Attachment: spam letter 1

Comment 4

[Vladislav Malyshkin]

Attachment: spam letter 2

These two spam letters have almost identical content.
They were not marked as spam.

This is a very common behavior in version 1.6a1 (20050830)

Comment 5

[Vladislav Malyshkin]

Attachment: spam letter 3

Spam letter 3 almost idebtical to the first two

Comment 6

[Vladislav Malyshkin]

Attachment: different spam

And the next two spams are also identical as text seen on screen, but they are
different inside because of specially crafted HTML.

Comment 7

[Vladislav Malyshkin]

Attachment: see previous post

Comment 8

[Vladislav Malyshkin]

I meant first three examples are absolutly identical inside,
and the second two looks identically on screen, but have different html inside.

Comment 9

[Aaron Leventhal]

Attachment: Similar to 'different spam' but uses CSS float instead of <table> to get around Bayesian filtering

Comment 10

[Donnie Murdock]

I love this idea

Comment 12

[Wayne Mery (:wsmwk)]

The reporter seems to want that those same messages would *always* be marked junk - but that's not quite how bayes works, it is by definition "adaptive".  But marking one message does one aspect of what reporter requests - marking more than one increases the chances that a similar message will be marked junk. So I think this can be marked WFM.

If you still see problems with messages not being marked junk when using version 3, please comment and reopen the bug.