[Jeremy Hylton[
> The total collections are 1100 messages.  I trained with 1100/5
> messages.
I'm reading this now as that you trained on about 220 spam and about 220
ham.  That's less than 10% of the sizes of the training sets I've been
using.  Please try an experiment:  train on 550 of each, and test once
against the other 550 of each.  Do that a few times making a random split
each time (it won't be long until you discover why directories of individual
files are a lot easier to work -- e.g., random.shuffle() makes this kind of
thing trivial for me).

> > Note that header names are case insensitive, so this one's no
> > different than "MIME-Version:".  Similarly other headers in your list.
>
> Ignoring case here may or may not help; that's for experiment to decide.
> It's plausible that case is significant, if, e.g., a particular spam mailing
> package generates unusual case, or a particular clueless spammer
> misconfigures his package.
I found it made no difference for my testing.
> The brilliance of Anthony's "just count them" scheme is that it requires no
> thought, so can't be fooled <wink>.  Header lines that are evenly
> distributed across spam and ham will turn out to be worthless indicators
> (prob near 0.5), so do no harm.
zactly. I started off doing clever clever things, and, as always with
this stuff, found that stupid with a rock beats smart with scissors,
every time.
--
Anthony Baxter     <anthony@interlink.com.au>
It's never too late to have a happy childhood.

> Looks like your ham corpus by and large has To: jeremy@alum.mit.edu in
> a header while your spam corpus by and large doesn't.  But this one
> does.
Interestingly, for me, one of the highest value spam indicators was
the name of the mail host that the spam was delivered to, in the To:
line. So mail to info@gin.elax2.ekorp.com was pretty much a dead cert
for the filters.
--
Anthony Baxter     <anthony@interlink.com.au>
It's never too late to have a happy childhood.

>>> Jeremy Hylton wrote
> Then I tried a dirt simple tokenizer for the headers that tokenize the
> words in the header and emitted like this "%s: %s" % (hdr, word).
> That worked too well :-).  The received and date headers helped the
> classifier discover that most of my spam is old and most of my ham is
> new.
Heh. I hit the same problem, but the other way round, when I first
started playing with this - I'd collected spam for a week or two,
then mixed it up with randomly selected messages from my mail boxes.
course, it instantly picked up on 'received:2001' as a non-ham.
Curse that too-smart-for-me software. Still, it's probably a good
thing to note in the documentation about the software - when collecting
spam/ham, make _sure_ you try and collect from the same source.
Anthony
--
Anthony Baxter     <anthony@interlink.com.au>
It's never too late to have a happy childhood.