In [4]:
import salearner.importer as importer
import tensorflow as tf
import pickle
import numpy as np
import sys
import salearner.utils as utils
import matplotlib as mpl
import matplotlib.pyplot as plt
import salearner.saconfig as saconfig
import time
In [2]:
# import pickle
with open('data.pickle', 'rb') as file_handler:
data = pickle.load(file_handler)
In [3]:
data
Out[3]:
{'filename': array(['1364512096.38213_1.leviathan.boiteameuh.org',
'1484686097.19650_2.banquise',
'1364512269.48016_1.leviathan.boiteameuh.org', ...,
'1472037113.M315432P26537.banquise,S=1211,W=1242',
'1277219860.M354931P27930.stinger.boiteameuh.org',
'1388160722.74539_1.leviathan.boiteameuh.org'],
dtype='<U69'),
'hot-ones': array([[ True, True, False, ..., False, False, False],
[ True, False, True, ..., False, False, False],
[ True, True, False, ..., False, False, False],
...,
[ True, False, False, ..., False, False, False],
[False, True, False, ..., False, False, False],
[False, False, False, ..., False, False, False]], dtype=bool),
'labels': array([False, False, False, ..., False, False, False], dtype=bool),
'messageid': array(['<20090924113447.9CE7C7900FE@fax-1-b6.proxad.net>',
'<20170117154804.8625232.1818143@sailthru.com>',
'<-5776905360315523008@unknownmsgid>', ...,
'<20160818012738.32142CB4A@popple.boiteameuh.org>',
'<3773-432-1-0000001075@mta0.sbr09.net>',
'<52BDA749.3010303@achamo.net>'], dtype=object),
'rules': ['AWL',
'BAYES_00',
'DCC_CHECK',
'HTML_FONT_FACE_BAD',
'HTML_FONT_LOW_CONTRAST',
'HTML_IMAGE_RATIO_04',
'HTML_MESSAGE',
'MIME_HTML_ONLY',
'MIME_HTML_ONLY_MULTI',
'MPART_ALT_DIFF',
'RCVD_IN_DNSWL_NONE',
'URIBL_GREY',
'T_RP_MATCHES_RCVD',
'FREEMAIL_FORGED_REPLYTO',
'HEADER_FROM_DIFFERENT_DOMAINS',
'HTML_IMAGE_ONLY_12',
'HTML_SHORT_LINK_IMG_1',
'RCVD_IN_DNSWL_LOW',
'RCVD_IN_MSPIKE_H3',
'RCVD_IN_MSPIKE_WL',
'FREEMAIL_FORGED_FROMDOMAIN',
'FREEMAIL_FROM',
'MANGLED_SEX',
'MIME_HTML_MOSTLY',
'NIX_SPAM',
'T_KAM_HTML_FONT_INVALID',
'LOTS_OF_MONEY',
'US_DOLLARS_3',
'DKIM_SIGNED',
'DKIM_VALID',
'DKIM_VALID_AU',
'RCVD_IN_MSPIKE_H2',
'SPF_PASS',
'MIME_BAD_LINEBREAK',
'MIME_QP_LONG_LINE',
'RCVD_IN_MSPIKE_H4',
'HTML_IMAGE_RATIO_02',
'URIBL_SBL',
'URIBL_SBL_A',
'HTML_FONT_SIZE_HUGE',
'ALL_TRUSTED',
'DATE_IN_PAST_12_24',
'T_TVD_MIME_NO_HEADERS',
'J_CHICKENPOX_12',
'TW_FT',
'BAYES_50',
'DATE_IN_FUTURE_03_06',
'RCVD_IN_BL_SPAMCOP_NET',
'URIBL_BLACK',
'HTML_IMAGE_RATIO_06',
'HTML_TITLE_SUBJ_DIFF',
'RCVD_IN_DNSWL_MED',
'T_REMOTE_IMAGE',
'RCVD_IN_SORBS_DUL',
'FH_DATE_PAST_20XX',
'DIGEST_MULTIPLE',
'PYZOR_CHECK',
'URI_HEX',
'J_CHICKENPOX_16',
'BAYES_60',
'DNS_FROM_OPENWHOIS',
'HTML_MIME_NO_HTML_TAG',
'SUBJ_ALL_CAPS',
'EMPTY_TO_OR_FROM_OR_CC',
'HTML_IMAGE_ONLY_24',
'RCVD_IN_IADB_DK',
'RCVD_IN_IADB_DOPTIN',
'RCVD_IN_IADB_LISTED',
'RCVD_IN_IADB_RDNS',
'RCVD_IN_IADB_SENDERID',
'RCVD_IN_IADB_SPF',
'RCVD_IN_IADB_VOUCHED',
'TW_CX',
'TW_DC',
'TW_JT',
'TW_KX',
'TW_MZ',
'TW_XD',
'TW_XZ',
'TW_ZN',
'MIME_BASE64_TEXT',
'HTML_FONT_SIZE_LARGE',
'RAZOR2_CHECK',
'MIME_8BIT_HEADER',
'HK_RANDOM_ENVFROM',
'J_CHICKENPOX_52',
'RCVD_IN_RP_CERTIFIED',
'RCVD_IN_RP_SAFE',
'USER_IN_DEF_DKIM_WL',
'NO_RELAYS',
'MIME_BASE64_BLANKS',
'MANGLED_CREDIT',
'MISSING_MID',
'BAYES_99',
'RCVD_IN_PBL',
'FUZZY_AMBIEN',
'BAD_CREDIT',
'RP_MATCHES_RCVD',
'RCVD_IN_PSBL',
'HTML_IMAGE_ONLY_32',
'T_OBFU_PDF_ATTACH',
'HTML_IMAGE_ONLY_20',
'HTML_SHORT_LINK_IMG_3',
'SPF_HELO_PASS',
'TVD_PH_BODY_ACCOUNTS_PRE',
'MANGLED_VIDEO',
'FUZZY_REFINANCE',
'J_CHICKENPOX_22',
'TW_FL',
'HTML_TAG_BALANCE_BODY',
'TW_NQ',
'URI_NOVOWEL',
'URI_TRY_3LD',
'TW_WD',
'HK_LOTTO_NAME',
'J_BACKHAIR_31',
'J_BACKHAIR_55',
'BAYES_40',
'TVD_SPACE_RATIO',
'J_CHICKENPOX_14',
'DRUGS_MUSCLE',
'HTML_TAG_BALANCE_HEAD',
'J_BACKHAIR_37',
'RCVD_IN_DNSWL_HI',
'TO_NO_BRKTS_FROM_MSSP',
'UNPARSEABLE_RELAY',
'J_CHICKENPOX_18',
'J_BACKHAIR_33',
'RAZOR2_CF_RANGE_51_100',
'RAZOR2_CF_RANGE_E8_51_100',
'EXTRA_MPART_TYPE',
'HTML_IMAGE_ONLY_04',
'MANGLED_MEDS',
'RDNS_NONE',
'T_FREEMAIL_DOC_PDF',
'J_CHICKENPOX_31',
'J_CHICKENPOX_42',
'J_CHICKENPOX_61',
'RCVD_IN_BRBL_LASTEXT',
'TW_FK',
'TW_FS',
'HTML_IMAGE_ONLY_16',
'ANY_BOUNCE_MESSAGE',
'CRBOUNCE_MESSAGE',
'RCVD_IN_IADB_DOPTIN_LT50',
'DKIM_ADSP_CUSTOM_MED',
'T_DKIM_INVALID',
'ADVANCE_FEE_2',
'MISSING_SUBJECT',
'FROM_STARTS_WITH_NUMS',
'HTML_IMAGE_RATIO_08',
'T_END_FUTURE_EMAILS',
'FROM_EXCESS_BASE64',
'MISSING_HEADERS',
'J_CHICKENPOX_35',
'J_CHICKENPOX_51',
'TW_SX',
'FUZZY_CREDIT',
'DATE_IN_PAST_06_12',
'MANGLED_LOW',
'MANGLED_SPCALS',
'LONG_IMG_URI',
'PLING_QUERY',
'MANGLED_MEN',
'HTML_NONELEMENT_30_40',
'T_FILL_THIS_FORM_SHORT',
'RDNS_DYNAMIC',
'TW_XI',
'HTML_IMAGE_ONLY_28',
'J_CHICKENPOX_65',
'TW_PG',
'RCVD_IN_BSP_OTHER',
'HELO_DYNAMIC_IPADDR',
'BAD_ENC_HEADER',
'DATE_IN_PAST_24_48',
'MANGLED_SIDE',
'URIBL_BLOCKED',
'RCVD_IN_BSP_TRUSTED',
'TW_CM',
'NORMAL_HTTP_TO_IP',
'DIET_1',
'TW_FX',
'TW_JX',
'TW_VZ',
'SUBJECT_NEEDS_ENCODING',
'SUBJ_ILLEGAL_CHARS',
'SPF_SOFTFAIL',
'MANGLED_SAVELE',
'FREEMAIL_ENVFROM_END_DIGIT',
'TW_JR',
'J_CHICKENPOX_54',
'MSGID_FROM_MTA_HEADER',
'SPF_FAIL',
'RCVD_IN_SORBS_WEB',
'TW_TM',
'URIBL_DBL_ABUSE_REDIR',
'DRUGS_ERECTILE',
'TW_OK',
'TW_QC',
'TW_QQ',
'HTML_IMAGE_ONLY_08',
'MPART_ALT_DIFF_COUNT',
'TW_QJ',
'RCVD_IN_IADB_OPTIN',
'BAYES_20',
'FREEMAIL_REPLY',
'J_CHICKENPOX_62',
'J_CHICKENPOX_17',
'T_FROM_12LTRDOM',
'HTML_OBFUSCATE_20_30',
'J_BACKHAIR_11',
'OBFUSCATING_COMMENT',
'TW_BF',
'HK_RANDOM_FROM',
'FOURLA',
'LDOSUBSCRIBER',
'LDO_WHITELIST',
'WWWRO',
'TW_HK',
'TW_LH',
'TW_UU',
'HTML_COMMENT_SAVED_URL',
'STYLE_GIBBERISH',
'TW_HX',
'TW_JC',
'TW_LP',
'TW_MN',
'TW_WH',
'HTTPS_HTTP_MISMATCH',
'TO_EQ_FM_DOM_SPF_FAIL',
'J_CHICKENPOX_15',
'SUBJ_OBFU_LOW_CNTRST',
'TW_BH',
'TW_MF',
'TW_QG',
'DC_PNG_UNO_LARGO',
'HTML_SHORT_LINK_IMG_2',
'DOS_HIGHBIT_HDRS_BODY',
'MALFORMED_FREEMAIL',
'RCVD_IN_MSPIKE_H5',
'BAYES_05',
'TW_MV',
'RCVD_IN_XBL',
'FH_HELO_EQ_D_D_D_D',
'TW_XU',
'TW_ZS',
'TW_GT',
'TW_MH',
'TW_UX',
'T_HEADER_FROM_DIFFERENT_DOMAINS',
'J_CHICKENPOX_45',
'MSGID_MULTIPLE_AT',
'MANGLED_LIMITD',
'RCVD_IN_IADB_OPTIN_GT50',
'MIME_HEADER_CTYPE_ONLY',
'BODY_URI_ONLY',
'DC_IMAGE_SPAM_TEXT',
'TRACKER_ID',
'T_MONEY_PERCENT',
'J_BACKHAIR_41',
'FUZZY_ANDROID',
'MANGLED_MEDICL',
'TW_XX',
'TW_EV',
'TW_JL',
'WEIRD_PORT',
'DATE_IN_PAST_03_06',
'RCVD_IN_SBL',
'FREEMAIL_REPLYTO_END_DIGIT',
'SORTED_RECIPS',
'DNS_FROM_RFC_DSN',
'URIBL_WS_SURBL',
'J_CHICKENPOX_92',
'HK_NAME_FREE',
'MANGLED_LOAN',
'URIBL_RHS_DOB',
'TW_QF',
'XPRIO',
'J_CHICKENPOX_55',
'HTML_EXTRA_CLOSE',
'BAYES_80',
'TW_XH',
'J_CHICKENPOX_21',
'FUZZY_CPILL',
'DYN_RDNS_AND_INLINE_IMAGE',
'DYN_RDNS_SHORT_HELO_HTML',
'DYN_RDNS_SHORT_HELO_IMAGE',
'SHORT_HELO_AND_INLINE_IMAGE',
'URIBL_AB_SURBL',
'FORGED_MUA_EUDORA',
'LONGWORDS',
'REPTO_QUOTE_QUALCOMM',
'NO_RDNS_DOTCOM_HELO',
'TW_HF',
'TW_HH',
'TW_QS',
'TW_XF',
'TW_XM',
'URIBL_JP_SURBL',
'INVESTMENT_ADVICE',
'TW_DB',
'TW_PW',
'TO_MALFORMED',
'HABEAS_ACCREDITED_SOI',
'J_CHICKENPOX_82',
'MANGLED_PENIS',
'TW_FM',
'TW_KU',
'TW_HZ',
'TW_KD',
'TW_QM',
'TW_RR',
'TW_VK',
'TW_YC',
'TW_ZQ',
'TW_QO',
'FORGED_HOTMAIL_RCVD2',
'HTML_OBFUSCATE_05_10',
'NA_DOLLARS',
'AD_PREFS',
'TW_BQ',
'TW_WB',
'TW_NW',
'J_BACKHAIR_36',
'MANGLED_DEALS',
'FRT_REFINANCE1',
'HTML_OBFUSCATE_10_20',
'TO_NO_BRKTS_HTML_IMG',
'GR_DOMAIN_SENDGR1',
'FM_SCHOOLING',
'TW_DQ',
'HEAD_LONG',
'SUSPICIOUS_RECIPS',
'RAZOR2_CF_RANGE_E4_51_100',
'INVALID_MSGID',
'MSGID_SHORT',
'MANGLED_CAMERA',
'AC_DIV_BONANZA',
'PP_MIME_FAKE_ASCII_TEXT',
'UPPERCASE_75_100',
'FRT_PENIS1',
'MANGLED_EQUIV',
'J_CHICKENPOX_41',
'J_CHICKENPOX_19',
'HTTP_ESCAPED_HOST',
'T_LOTS_OF_MONEY',
'MANGLED_FREE',
'HTML_SHORT_CENTER',
'GR_DOMAIN_CAMN10',
'GR_DOMAIN_CHIMP1',
'GR_DOMAIN_CHIMP2',
'GR_DOMAIN_CHIMP3',
'GR_DOMAIN_CHIMP4',
'SB_GIF_AND_NO_URIS',
'J_CHICKENPOX_64',
'TW_IB',
'T_FSL_HELO_BARE_IP_2',
'TW_IK',
'TW_CF',
'TW_DP',
'TW_QE',
'TW_YM',
'TW_MJ',
'BANG_GUAR',
'RCVD_IN_MSPIKE_BL',
'RCVD_IN_MSPIKE_L3',
'TVD_PH_SEC',
'DATE_IN_PAST_96_XX',
'J_CHICKENPOX_32',
'J_CHICKENPOX_66',
'T_TO_NO_BRKTS_FREEMAIL',
'FREEMAIL_REPLYTO',
'NML_ADSP_CUSTOM_MED',
'J_BACKHAIR_14',
'URI_ONLY_LOW_CONTRAST',
'J_CHICKENPOX_34',
'TW_AV',
'TW_BX',
'TW_DW',
'TW_HP',
'TW_KR',
'TW_KV',
'TW_PM',
'TW_QL',
'TW_TJ',
'TW_VP',
'TW_WT',
'ACT_NOW_CAPS',
'URI_OBFU_WWW',
'TW_XW',
'TVD_FW_GRAPHIC_NAME_LONG',
'LONG_HEX_URI',
'TW_JZ',
'FRT_APPROV',
'FRT_OFFER2',
'LOW_PRICE',
'GR_DOMAIN_ACEMML1',
'GR_DOMAIN_ACEMML2',
'J_CHICKENPOX_25',
'TW_CS',
'MISSING_MIME_HB_SEP',
'J_CHICKENPOX_46',
'TW_DH',
'FROM_WORDY',
'FH_FROMEML_NOTLD',
'FROM_BLANK_NAME',
'NULL_IN_BODY',
'DATE_IN_FUTURE_06_12',
'MISSING_DATE',
'T_BIG_HEADERS_2K',
'T_FSL_HELO_NON_FQDN_2',
'T_NOT_A_PERSON',
'T_SINGLE_HEADER_1K',
'T_THREAD_INDEX_BAD',
'TW_NP',
'TW_VU',
'MANGLED_DIET',
'FUZZY_VLIUM',
'GAPPY_SUBJECT',
'CK_HELO_GENERIC',
'HK_NAME_MR_MRS',
'MONEY_FROM_41',
'MONEY_FROM_MISSP',
'TW_VF',
'DC_GIF_UNO_LARGO',
'DC_IMAGE_SPAM_HTML',
'TW_QA',
'TW_WP',
'URIBL_RED',
'TW_CL',
'DNS_FROM_RFC_BOGUSMX',
'TW_MB',
'TW_NV',
'MANGLED_ACTION',
'X_IP',
'RCVD_IN_NJABL_SPAM',
'TW_VL',
'TW_VB',
'RCVD_ILLEGAL_IP',
'ROUND_THE_WORLD_LOCAL',
'TW_IY',
'TW_OZ',
'TW_VN',
'TW_YF',
'TW_ZJ',
'TW_BG',
'TW_CB',
'TW_GL',
'NO_DNS_FOR_FROM',
'TW_TK',
'J_CHICKENPOX_56',
'J_CHICKENPOX_27',
'J_CHICKENPOX_71',
'TW_RB',
'TW_TB',
'J_CHICKENPOX_38',
'TW_IJ',
'TW_KJ',
'TW_WQ',
'SPF_NEUTRAL',
'STOCK_IMG_OUTLOOK',
'TVD_STOCK1',
'TW_NX',
'URIBL_DBL_SPAM',
'GR_DOMAIN_CHIMP6',
'TW_MG',
'GR_DOMAIN_AMAZON1',
'TW_OC',
'MANGLED_CABLE',
'J_CHICKENPOX_57',
'REPLYTO_WITHOUT_TO_CC',
'NAME_EMAIL_DIFF',
'UPPERCASE_50_75',
'J_CHICKENPOX_72',
'TW_TF',
'TW_DF',
'INVALID_TZ_EST',
'TW_BN',
'TW_FW',
'TW_HL',
'TW_HR',
'TW_JH',
'TW_RZ',
'TW_SJ',
'TW_UJ',
'TW_WJ',
'TW_WW',
'TW_XC',
'TW_YJ',
'TW_YK',
'TW_ZT',
'TVD_RCVD_SPACE_BRACKET',
'MANGLED_SPAM',
'TW_ZM',
'TW_KB',
'TW_ZB',
'TW_HW',
'TW_UZ',
'SUBJ_BUY',
'FROM_LOCAL_NOVOWEL',
'J_CHICKENPOX_37',
'TVD_SUBJ_ACC_NUM',
'J_CHICKENPOX_102',
'TW_FP',
'J_BACKHAIR_52',
'J_CHICKENPOX_36',
'T_TVD_FW_GRAPHIC_ID1',
'GR_DOMAIN_SENDGR3',
'TW_FC',
'TW_RJ',
'FU_COMMON_SUBS2',
'FROM_ILLEGAL_CHARS',
'TW_DL',
'TW_VD',
'TW_HQ',
'MONEY',
'STOCKLIKE',
'TVD_FUZZY_FINANCE',
'T_HTML_ATTACH',
'T_KHOP_FOREIGN_CLICK',
'J_CHICKENPOX_75',
'TW_TD',
'TW_UQ',
'URI_GOOGLE_PROXY',
'TW_QX',
'TW_LV',
'REMOVE_BEFORE_LINK',
'TW_ZC',
'AXB_X_FF_SEZ_S',
'EMPTY_MESSAGE',
'TW_KM',
'SPAMMY_XMAILER',
'MANGLED_NAIL',
'TW_NR',
'TW_SV',
'TW_TP',
'TW_XV',
'TW_KC',
'TW_PH',
'TO_IN_SUBJ',
'HTML_FONT_TINY',
'DSN_NO_MIMEVERSION',
'TW_OV',
'TW_QD',
'TW_VJ',
'TW_WX',
'TW_YV',
'HELO_DYNAMIC_DHCP',
'HTML_NONELEMENT_40_50',
'RATWARE_GECKO_BUILD',
'CTYPE_8SPACE_GIF',
'J_CHICKENPOX_91',
'TW_KY',
'RCVD_NUMERIC_HELO',
'TW_BD',
'TW_BV',
'TW_JS',
'TW_RQ',
'T_OBFU_DOC_ATTACH',
'MANGLED_RVRSES',
'HTML_EMBEDS',
'SINGLE_HEADER_1K',
'TW_HG',
'MANGLED_GIRL',
'WEIRD_QUOTING',
'INVALID_DATE',
'TW_YB',
'URIBL_PH_SURBL',
'FORGED_YAHOO_RCVD',
'MANGLED_HERE',
'TW_GV',
'TW_LC',
'TW_JQ',
'TW_JW',
'TW_PQ',
'TW_QP',
'LOTTERY_PH_004470',
'DIGITS_LETTERS',
'HS_INDEX_PARAM',
'TW_FD',
'GR_DOMAIN_CAMN17',
'TVD_FROM_1',
'J_CHICKENPOX_81',
'TW_BP',
'TW_JM',
'TW_WF',
'TW_PX',
'TW_DK',
'TW_UW',
'DEAR_FRIEND',
'UNRESOLVED_TEMPLATE',
'TW_AQ',
'TW_DT',
'TW_IH',
'TW_KZ',
'TW_MD',
'TW_RG',
'GR_DOMAIN_CHIMP5',
'J_BACKHAIR_45',
'TW_FV',
'TW_IF',
'MISSING_MIMEOLE',
'TW_CD',
'TW_WC',
'TW_YD',
'TW_YY',
'T_HTML_TAG_BALANCE_CENTER',
'FSL_HELO_NON_FQDN_1',
'J_CHICKENPOX_47',
'TW_GD',
'TW_KQ',
'TW_LX',
'DEAR_SOMETHING',
'TW_WR',
'TVD_RCVD_IP',
'TVD_RCVD_IP4',
'T_TVD_FUZZY_SECURITIES',
'ACCT_PHISHING',
'T_HDRS_LCASE',
'J_BACKHAIR_32',
'URI_TRUNCATED',
'MANGLED_LIST',
'MANGLED_ACTVTY',
'URIBL_DBL_REDIR',
'TW_FZ',
'TW_HJ',
'TW_WL',
'TW_ZH',
'T_TVD_MIME_EPI',
'TVD_PH_SUBJ_ACCOUNTS_POST',
'FROM_MISSPACED',
'FROM_MISSP_EH_MATCH',
'FROM_MISSP_FREEMAIL',
'FROM_MISSP_MSFT',
'FROM_MISSP_REPLYTO',
'FROM_MISSP_TO_UNDISC',
'FROM_MISSP_USER',
'FROM_MISSP_XPRIO',
'FSL_CTYPE_WIN1251',
'FSL_NEW_HELO_USER',
'NSL_RCVD_FROM_USER',
'TW_OY',
'ADVANCE_FEE_2_NEW_MONEY',
'TW_CN',
'TW_EP',
'TW_GJ',
'TW_GX',
'TW_XB',
'J_BACKHAIR_16',
'TW_OQ',
'TW_KW',
'RCVD_IN_MSPIKE_L5',
'TW_CZ',
'TW_MQ',
'TW_QK',
'TW_ZR',
'TW_FN',
'J_BACKHAIR_21',
'T_FRT_ADULT2',
'T_FREEMAIL_FORGED_FROMDOMAIN',
'MANGLED_SPICE',
'BAYES_95',
'TW_DZ',
'TW_LQ',
'TW_OJ',
'TW_PK',
'TW_PZ',
'TW_QW',
'TW_QY',
'TW_SD',
'TW_LZ',
'TW_QT',
'TW_XK',
'TW_ZP',
'RCVD_IN_IADB_UT_CPR_MAT',
'TW_SR',
'TW_ZL',
'TW_LG',
'TW_KG',
'TW_VH',
'GR_DOMAIN_GRES1',
'GR_DOMAIN_GRES2',
'DRUG_ED_CAPS',
'TW_LB',
'TW_GW',
'SUBJECT_DRUG_GAP_C',
'TW_GK',
'J_CHICKENPOX_48',
'TW_SF',
'TW_GZ',
'TW_SN',
'TOTAL_SCORE',
'HELO_LOCALHOST',
'TW_EG',
'TW_GC',
'TW_XY',
'RCVD_IN_NJABL_PROXY',
'TW_ZD',
'OBSCURED_EMAIL',
'TW_ZU',
'TW_DJ',
'MIME_ASCII0',
'TW_QH',
'TW_KT',
'MIME_BOUND_DD_DIGITS',
'TW_WV',
'TW_BJ',
'TW_IW',
'TW_CQ',
'TW_VR',
'TW_GF',
'TW_QU',
'TW_ZF',
'FVGT_m_MULTI_ODD',
'LONGLINEURL',
'DKIM_ADSP_NXDOMAIN',
'J_CHICKENPOX_110',
'TW_GQ',
'GR_DOMAIN_CMAIL4',
'GR_DOMAIN_CMAIL7',
'TW_LR',
'TW_CC',
'TW_VT',
'TW_CR',
'TW_KN',
'IP_LINK_PLUS',
'J_CHICKENPOX_101',
'TW_FQ',
'TW_JD',
'TW_RX',
'J_BACKHAIR_54',
'TW_JJ',
'TW_JP',
'TW_XN',
'HK_RANDOM_REPLYTO',
'J_CHICKENPOX_29',
'TW_VG',
'TW_WM',
'GR_DOMAIN_MAILJE1',
'GR_DOMAIN_MAILJE3',
'GR_DOMAIN_MAILJE4',
'TW_KP',
'TW_TR',
'TW_YG',
'TW_RK',
'TW_GG',
'SUBJECT_DIET',
'TW_XJ',
'TW_BZ',
'TW_PD',
'FORGED_MUA_OUTLOOK',
'TW_MX',
'TW_KL',
'TW_EQ',
'TW_UH',
'SUBJECT_FUZZY_TION',
'TW_BW',
'TW_DN',
'TW_IX',
'TW_JF',
'TW_ZZ',
'TW_BL',
'TW_XQ',
'TW_YQ',
'TW_XT',
'TW_PC',
'TW_IQ',
'MANGLED_EMAIL',
'RCVD_IN_MSPIKE_L4',
'MANGLED_TRNFER',
'TW_NM',
'TW_YH',
'MANGLED_OFF',
'TW_KH',
'URIBL_ABUSE_SURBL',
'TW_QZ',
'MANGLED_STOP',
'TW_TN',
'MANGLED_RX',
'TW_VV',
'TW_YW',
'RISK_FREE',
'FORGED_OUTLOOK_TAGS',
'TW_JV',
'FROM_LOCAL_DIGITS',
'FROM_LOCAL_HEX',
'SUBJ_DOLLARS',
'J_BACKHAIR_27',
'J_BACKHAIR_42',
'MANGLED_DELETE',
'LOCALPART_IN_SUBJECT',
'T_FRT_PROFIT1',
'TW_OH',
'FILL_THIS_FORM',
'ADMITS_SPAM',
'STOX_REPLY_TYPE',
'TVD_FINGER_02',
'HTML_30_40',
'TW_FJ',
'TW_YI',
'J_CHICKENPOX_26',
'TO_NO_BRKTS_HTML_ONLY',
'J_CHICKENPOX_210',
'GREYLIST_ISWHITE',
'TW_SG',
'TW_JB',
'TW_XS',
'TW_SM',
'TW_II',
'TW_DR',
'TW_GP',
'TW_MK',
'MIME_NO_TEXT',
'TW_TQ',
'TW_PR',
'TW_NH',
'TW_NL',
'TW_QR',
'TW_XG',
'JOIN_MILLIONS',
'TW_ZG',
'APOSTROPHE_FROM',
'TW_XP',
'TW_XR',
'TW_YT',
'TW_VM',
'TW_WZ',
'TW_DX',
'TW_VW',
'MANGLED_AVOID',
'BASE64_LENGTH_78_79',
'MANGLED_RVLUTN',
'TW_BT',
'BODY_ENHANCEMENT',
'TW_ZV',
'HIDE_WIN_STATUS',
'HELO_DYNAMIC_SPLIT_IP',
'DOS_RCVD_IP_TWICE_C',
'ZMIvirSobY_SUB51',
'FAKE_REPLY_C',
'TW_VS',
'TW_BK',
'REPTO_QUOTE_YAHOO',
'URIBL_SC_SURBL',
'FB_WORD1_END_DOLLAR',
'URIBL_OB_SURBL',
'RCVD_IN_SBL_CSS',
'TW_SW',
'TW_DM',
'TW_QN',
'FM_VIAGRA_SPAM1114',
'J_CHICKENPOX_111',
'USER_IN_WHITELIST',
'NO_RECEIVED',
'MATTA_HAS_PGP_SIGNATURE',
'TO_NO_BRKTS_NORDNS',
'MANGLED_VIAGRA',
'TW_YZ',
'MANGLED_PRICE',
'MANGLED_COST',
'J_CHICKENPOX_74',
'MANGLED_GAME',
'MANGLED_RATES',
'TW_NB',
'MANGLED_SOMA',
'MANGLED_HOME',
'J_CHICKENPOX_24',
'MANGLED_DOSE',
'MANGLED_TEXT',
'MANGLED_PREMTR',
'T_SHARE_50_50',
'URIBL_DBL_ABUSE_BOTCC',
'SHORTENED_URL_SRC',
'URIBL_DBL_ABUSE_SPAM',
'HELO_MISC_IP',
'URIBL_MW_SURBL',
'T_MANY_HDRS_LCASE',
'FSL_HELO_BARE_IP_2',
'TBIRD_SUSP_MIME_BDRY',
'MILLION_USD',
'T_HK_NAME_FM_MR_MRS',
'MANGLED_LSBIAN',
'THIS_AD',
'J_BACKHAIR_57',
'SYSADMIN',
'TW_JN',
'T_HK_NAME_DR',
'TW_TX',
'HK_SCAM_N15',
'FROM_OFFERS',
'T_CDISP_SZ_MANY',
'RCVD_HELO_IP_MISMATCH',
'MARKETING_PARTNERS',
'J_CHICKENPOX_39',
'TW_JG',
'TO_NO_BRKTS_NORDNS_HTML',
'RCVD_IN_RP_RNBL',
'CURR_PRICE',
'LONG_TERM_PRICE',
'DKIM_ADSP_ALL',
'DOS_OE_TO_MX',
'HELO_DYNAMIC_HCC',
'PDS_FROM_2_EMAILS',
'T_PDS_TO_EQ_FROM_NAME',
'URI_ONLY_MSGID_MALF',
'ZMIde_OutlookExpress',
'MANGLED_TIME',
'HELO_NO_DOMAIN',
'FORGED_OUTLOOK_HTML',
'URIBL_DBL_ABUSE_PHISH',
'ADVANCE_FEE_3',
'ADVANCE_FEE_4',
'TO_EQ_FM_DIRECT_MX',
'BASE64_LENGTH_79_INF',
'HK_NAME_DRUGS',
'URIBL_CR_SURBL',
'XM_PHPMAILER_FORGED',
'ZMIvirSobY_SUB39',
'DOS_OUTLOOK_TO_MX',
'PGPSIGNATURE',
'URIBL_DBL_ABUSE_MALW',
'MANGLED_MRTG',
'SPOOFED_FREEM_REPTO',
'TW_XL',
'SPF_HELO_SOFTFAIL',
'TW_DG',
'TW_RV',
'TW_WG',
'T_URIBL_BLACK_OVERLAP',
'FROM_DOMAIN_NOVOWEL',
'RCVD_IN_MSPIKE_ZBI',
'URI_WP_HACKED',
'FROM_MISSP_SPF_FAIL',
'MANGLED_TAKE',
'T_DOS_OUTLOOK_TO_MX_IMAGE',
'BODY_ENHANCEMENT2',
'TW_MM',
'UPPERCASE_25_50',
'MANGLED_SMALL',
'TW_WU',
'TW_TG',
'MANGLED_MONEY',
'TW_WK',
'FRT_LEVITRA',
'SHORT_TERM_PRICE',
'AXB_XMAILER_MIMEOLE_OL_1ECD5',
'NSL_RCVD_HELO_USER',
'TO_NO_BRKTS_MSFT',
'T_OBFU_ATTACH_MISSP',
'ZMIde_LOTTERYHARD1',
'ZMIde_LOTTERY_OL',
'CK_HELO_DYNAMIC_SPLIT_IP',
'HELO_DYNAMIC_IPADDR2',
'ADVANCE_FEE_5_NEW_FRM_MNY',
'AXB_XMAILER_MIMEOLE_OL_024C2',
'DEAR_BENEFICIARY',
'FILL_THIS_FORM_LOAN',
'FILL_THIS_FORM_LONG',
'MONEY_FORM',
'MONEY_FRAUD_8',
'T_OBFU_HTML_ATTACH',
'DATE_IN_FUTURE_24_48',
'URI_WP_HACKED_2',
'STATIC_XPRIO_OLE',
'URI_WP_DIRINDEX',
'MANGLED_ONLINE',
'MONEY_FRAUD_3',
'MSOE_MID_WRONG_CASE',
'ADVANCE_FEE_5_NEW_MONEY',
'URI_NO_WWW_INFO_CGI',
'SUBJECT_DRUG_GAP_L',
'PUMPDUMP',
'DATE_IN_FUTURE_96_Q',
'MANGLED_BACK',
'MANGLED_BELOW',
'MANGLED_PLEASE',
'MANGLED_REFUND',
'MANGLED_YOUR',
'BUG6152_INVALID_DATE_TZ_ABSURD',
'STOX_REPLY_TYPE_WITHOUT_QUOTES',
'GR_DOMAIN_CAMN12',
'GR_DOMAIN_CAMN13',
'GR_DOMAIN_CAMN14',
'GR_DOMAIN_EMVCOM3',
'GR_DOMAIN_EMVCOM4',
'GR_DOMAIN_XECODE1',
'MIME_BOUND_DIGITS_15',
'MSGID_SPAM_CAPS',
'DEAR_WINNER',
'HK_LOTTO',
'LOTTO_AGENT',
'LOTTO_DEPT',
'MONEY_FRAUD_5',
'HK_SCAM_N2',
'COMPENSATION',
'FORM_FRAUD_5',
'MONEY_FORM_SHORT',
'GR_DOMAIN_CAMN2',
'GUARANTEED_100_PERCENT',
'FSL_BOTSPAM_1',
...]}
In [4]:
(data['labels'][:,np.newaxis]).shape
Out[4]:
(97215, 1)
In [5]:
class SALearner:
def __init__(self, data, learning_rate):
# extract data
# TODO rename filename to filenames
self.filenames = data['filename']
# TODO rename messageid to messageids
self.messageids = data['messageid']
# TODO check the names hot-ones
self.dataset = data['hot-ones'].astype(np.float32)
# TODO return a real column vector on importer
self.labels = data['labels'][:,np.newaxis].astype(np.float32)
# description variables
self.nb_ind = data['hot-ones'].shape[0]
self.ind_size = data['hot-ones'].shape[1]
# Variables learned
self.tf_weights = None
self.tf_bias = None
# Hyperparameters
self.learning_rate = learning_rate
# Training stats
self.cost_data = utils.MAAcumulator(1)
self.accuracy_data = utils.MAAcumulator(1)
# Results
self.__weights = None
self.__bias = None
def init_graph(self):
tf.reset_default_graph()
# data
tf_data = tf.placeholder(tf.float32, name='data')
tf_labels = tf.placeholder(tf.float32, name='labels')
# weights and bias
self.tf_weights = tf.Variable(tf.truncated_normal([self.ind_size, 1]))
self.tf_bias = tf.Variable(tf.zeros([1,1]))
# Compute the unit unit
tf_z = tf.matmul(tf_data, self.tf_weights) + self.tf_bias #z.shape -> [ind_size,1]
tf_h = tf.sigmoid(tf_z)
self.tf_regu = tf.reduce_mean(tf.multiply(self.tf_weights, self.tf_weights)) * 1e-7
self.tf_cost_function = tf.reduce_mean(tf_labels * -tf.log(tf.clip_by_value(tf_h,1e-10, 1)) + \
(1 - tf_labels) * -tf.log(tf.clip_by_value(1 - tf_h, 1e-10, 1))) + \
self.tf_regu
# accuracy & details
tf_decision_vector = tf.round(tf_h)
tf_correct_prediction = tf.equal(tf_labels, tf_decision_vector)
self.tf_accuracy = tf.reduce_mean(tf.cast(tf_correct_prediction, tf.float32)) * 100
# True positive
self.tf_tp = tf.reduce_mean(tf.cast(tf.logical_and(tf.cast(tf_decision_vector, tf.bool),
tf.cast(tf_labels, tf.bool)), tf.float32)) * 100
# True negative
self.tf_tn = tf.reduce_mean(tf.cast(tf.logical_not(tf.logical_or(tf.cast(tf_decision_vector, tf.bool),
tf.cast(tf_labels, tf.bool))), tf.float32)) * 100
# false negative
self.tf_fn = tf.reduce_mean(tf.cast(tf.logical_and(tf.cast(tf_decision_vector, tf.bool),
tf.logical_not(tf.cast(tf_labels, tf.bool))),
tf.float32)) * 100
# false positive (baad)
self.tf_fp = tf.reduce_mean(tf.cast(tf.logical_and(tf.logical_not(tf.cast(tf_decision_vector, tf.bool)),
tf.cast(tf_labels, tf.bool)),
tf.float32)) * 100
# GD
self.tf_train_step = tf.train.GradientDescentOptimizer(self.learning_rate).minimize(self.tf_cost_function)
self.tf_init = tf.global_variables_initializer()
def learn(self, nb_cycle, info_every_cycle, quiet=False):
sess = tf.Session()
sess.run(self.tf_init)
# reset accumulators
self.cost_data.reset()
self.accuracy_data.reset()
# get placeholders
tf_data = tf.get_default_graph().get_tensor_by_name('data:0')
tf_labels = tf.get_default_graph().get_tensor_by_name('labels:0')
for cycle in range(nb_cycle):
_, cost, acc, weights, bias, tp, tn, fp, fn, regu = sess.run([self.tf_train_step, self.tf_cost_function,
self.tf_accuracy, self.tf_weights,
self.tf_bias,
self.tf_tp, self.tf_tn,
self.tf_fp, self.tf_fn,self.tf_regu],
feed_dict={tf_data: self.dataset,
tf_labels: self.labels})
# data accumulation
self.cost_data.add(cost)
self.accuracy_data.add(acc)
# results
self.__weights = weights
self.__bias = bias
# Console printing
if (cycle+1) % info_every_cycle == 0 and not quiet:
print('-' * 10)
print('cycle: {}'.format(cycle))
print('cost: {}'.format(cost))
print('regu: {}'.format(regu))
print('accuracy: {}%'.format(acc))
print('true positive: {}%'.format(tp))
print('true negative: {}%'.format(tn))
print('false positive: {}%'.format(fp))
print('false negative: {}%'.format(fn))
sys.stdout.flush()
@property
def results(self):
return {'weights': self.__weights,
'bias': self.__bias}
In [6]:
sa_learner = SALearner(data, 30)
In [7]:
begin = time.time()
sa_learner.init_graph()
sa_learner.learn(24800,20,True)
print("{:.2f} seconds".format(time.time() - begin))
26541.90 seconds
In [19]:
%matplotlib inline
mpl.rcParams['figure.figsize'] = (20.0, 8.0)
f, axarr = plt.subplots(1,2)
# cost
axarr[0].plot(sa_learner.cost_data.data)
axarr[0].set_title('cost evolution during training')
axarr[0].set_ylim(0.040,0.065)
# accuracy
axarr[1].plot(sa_learner.accuracy_data.data)
axarr[1].set_title('accuracy evolution during training')
axarr[1].set_ylim(98.0,98.8)
plt.show()
In [9]:
res = sa_learner.results
In [10]:
cg = saconfig.ConfigGenerator(data['rules'], res['weights'], res['bias'][0,0])
In [11]:
conf = cg.get_config()
In [12]:
with open('/tmp/sa-score.conf', 'w')as a:
a.write(conf)
In [13]:
print(conf)
required_score 2.36
score AWL -1.44
score BAYES_00 -8.34
score DCC_CHECK 0.94
score HTML_FONT_FACE_BAD -0.51
score HTML_FONT_LOW_CONTRAST -0.33
score HTML_IMAGE_RATIO_04 0.92
score HTML_MESSAGE 0.15
score MIME_HTML_ONLY 1.85
score MIME_HTML_ONLY_MULTI -2.70
score MPART_ALT_DIFF 1.56
score RCVD_IN_DNSWL_NONE -0.08
score URIBL_GREY -0.60
score T_RP_MATCHES_RCVD -0.89
score FREEMAIL_FORGED_REPLYTO 1.04
score HEADER_FROM_DIFFERENT_DOMAINS 0.44
score HTML_IMAGE_ONLY_12 1.79
score HTML_SHORT_LINK_IMG_1 -3.84
score RCVD_IN_DNSWL_LOW -2.40
score RCVD_IN_MSPIKE_H3 0.19
score RCVD_IN_MSPIKE_WL -0.21
score FREEMAIL_FORGED_FROMDOMAIN -2.35
score FREEMAIL_FROM -1.45
score MANGLED_SEX -1.05
score MIME_HTML_MOSTLY 0.95
score NIX_SPAM 1.65
score T_KAM_HTML_FONT_INVALID -2.62
score LOTS_OF_MONEY -1.05
score US_DOLLARS_3 0.80
score DKIM_SIGNED 2.41
score DKIM_VALID -2.02
score DKIM_VALID_AU 1.24
score RCVD_IN_MSPIKE_H2 0.06
score SPF_PASS -0.60
score MIME_BAD_LINEBREAK -0.09
score MIME_QP_LONG_LINE 0.18
score RCVD_IN_MSPIKE_H4 0.11
score HTML_IMAGE_RATIO_02 1.40
score URIBL_SBL 0.19
score URIBL_SBL_A -0.15
score HTML_FONT_SIZE_HUGE 1.24
score ALL_TRUSTED -1.40
score DATE_IN_PAST_12_24 1.14
score T_TVD_MIME_NO_HEADERS -0.47
score J_CHICKENPOX_12 0.55
score TW_FT -0.53
score BAYES_50 -4.58
score DATE_IN_FUTURE_03_06 2.40
score RCVD_IN_BL_SPAMCOP_NET 2.27
score URIBL_BLACK 2.53
score HTML_IMAGE_RATIO_06 0.62
score HTML_TITLE_SUBJ_DIFF -2.48
score RCVD_IN_DNSWL_MED -3.34
score T_REMOTE_IMAGE -0.52
score RCVD_IN_SORBS_DUL -0.74
score FH_DATE_PAST_20XX -2.19
score DIGEST_MULTIPLE 0.41
score PYZOR_CHECK 1.30
score URI_HEX 0.10
score J_CHICKENPOX_16 0.62
score BAYES_60 -2.61
score DNS_FROM_OPENWHOIS 0.02
score HTML_MIME_NO_HTML_TAG -0.41
score SUBJ_ALL_CAPS 1.59
score EMPTY_TO_OR_FROM_OR_CC -0.07
score HTML_IMAGE_ONLY_24 1.62
score RCVD_IN_IADB_DK 2.52
score RCVD_IN_IADB_DOPTIN -1.67
score RCVD_IN_IADB_LISTED -1.92
score RCVD_IN_IADB_RDNS -0.53
score RCVD_IN_IADB_SENDERID -0.08
score RCVD_IN_IADB_SPF 0.39
score RCVD_IN_IADB_VOUCHED 0.02
score TW_CX -0.23
score TW_DC 0.65
score TW_JT -1.74
score TW_KX 1.37
score TW_MZ 0.89
score TW_XD 0.13
score TW_XZ -0.88
score TW_ZN 0.77
score MIME_BASE64_TEXT -1.35
score HTML_FONT_SIZE_LARGE 2.41
score RAZOR2_CHECK 4.48
score MIME_8BIT_HEADER -0.45
score HK_RANDOM_ENVFROM -1.58
score J_CHICKENPOX_52 0.53
score RCVD_IN_RP_CERTIFIED 0.32
score RCVD_IN_RP_SAFE -3.21
score USER_IN_DEF_DKIM_WL -5.30
score NO_RELAYS -6.94
score MIME_BASE64_BLANKS -1.61
score MANGLED_CREDIT 0.15
score MISSING_MID 3.12
score BAYES_99 -4.72
score RCVD_IN_PBL 0.63
score FUZZY_AMBIEN -0.24
score BAD_CREDIT -1.17
score RP_MATCHES_RCVD -1.74
score RCVD_IN_PSBL 2.24
score HTML_IMAGE_ONLY_32 2.05
score T_OBFU_PDF_ATTACH -0.85
score HTML_IMAGE_ONLY_20 0.21
score HTML_SHORT_LINK_IMG_3 2.76
score SPF_HELO_PASS 1.14
score TVD_PH_BODY_ACCOUNTS_PRE -3.89
score MANGLED_VIDEO -0.10
score FUZZY_REFINANCE 0.05
score J_CHICKENPOX_22 -0.79
score TW_FL 0.45
score HTML_TAG_BALANCE_BODY 0.30
score TW_NQ 0.10
score URI_NOVOWEL -1.56
score URI_TRY_3LD -1.68
score TW_WD -1.50
score HK_LOTTO_NAME 2.55
score J_BACKHAIR_31 -1.76
score J_BACKHAIR_55 -2.41
score BAYES_40 -5.29
score TVD_SPACE_RATIO 1.91
score J_CHICKENPOX_14 1.73
score DRUGS_MUSCLE -0.40
score HTML_TAG_BALANCE_HEAD -0.39
score J_BACKHAIR_37 -0.07
score RCVD_IN_DNSWL_HI -2.51
score TO_NO_BRKTS_FROM_MSSP -0.93
score UNPARSEABLE_RELAY -1.49
score J_CHICKENPOX_18 -1.77
score J_BACKHAIR_33 -4.20
score RAZOR2_CF_RANGE_51_100 -0.37
score RAZOR2_CF_RANGE_E8_51_100 1.02
score EXTRA_MPART_TYPE -0.79
score HTML_IMAGE_ONLY_04 1.10
score MANGLED_MEDS 1.77
score RDNS_NONE 0.57
score T_FREEMAIL_DOC_PDF 3.51
score J_CHICKENPOX_31 0.52
score J_CHICKENPOX_42 -2.10
score J_CHICKENPOX_61 -0.20
score RCVD_IN_BRBL_LASTEXT 1.93
score TW_FK -0.56
score TW_FS -3.90
score HTML_IMAGE_ONLY_16 0.54
score ANY_BOUNCE_MESSAGE -0.30
score CRBOUNCE_MESSAGE -2.41
score RCVD_IN_IADB_DOPTIN_LT50 -1.22
score DKIM_ADSP_CUSTOM_MED -0.69
score T_DKIM_INVALID -1.67
score ADVANCE_FEE_2 -0.41
score MISSING_SUBJECT -0.00
score FROM_STARTS_WITH_NUMS -1.74
score HTML_IMAGE_RATIO_08 0.24
score T_END_FUTURE_EMAILS -1.75
score FROM_EXCESS_BASE64 -0.87
score MISSING_HEADERS 0.75
score J_CHICKENPOX_35 1.29
score J_CHICKENPOX_51 0.02
score TW_SX -0.77
score FUZZY_CREDIT -3.03
score DATE_IN_PAST_06_12 0.14
score MANGLED_LOW 1.95
score MANGLED_SPCALS 3.20
score LONG_IMG_URI 1.97
score PLING_QUERY 0.38
score MANGLED_MEN 0.47
score HTML_NONELEMENT_30_40 0.71
score T_FILL_THIS_FORM_SHORT 1.43
score RDNS_DYNAMIC -1.61
score TW_XI -0.26
score HTML_IMAGE_ONLY_28 1.52
score J_CHICKENPOX_65 -1.20
score TW_PG 1.78
score RCVD_IN_BSP_OTHER 0.41
score HELO_DYNAMIC_IPADDR 1.19
score BAD_ENC_HEADER -3.81
score DATE_IN_PAST_24_48 1.02
score MANGLED_SIDE -0.89
score URIBL_BLOCKED 1.96
score RCVD_IN_BSP_TRUSTED -1.20
score TW_CM -1.95
score NORMAL_HTTP_TO_IP -1.67
score DIET_1 -3.21
score TW_FX 0.40
score TW_JX 0.92
score TW_VZ 0.54
score SUBJECT_NEEDS_ENCODING -2.71
score SUBJ_ILLEGAL_CHARS 1.03
score SPF_SOFTFAIL -0.16
score MANGLED_SAVELE -2.22
score FREEMAIL_ENVFROM_END_DIGIT 1.93
score TW_JR -0.13
score J_CHICKENPOX_54 -0.15
score MSGID_FROM_MTA_HEADER 0.90
score SPF_FAIL 1.51
score RCVD_IN_SORBS_WEB 1.26
score TW_TM -0.01
score URIBL_DBL_ABUSE_REDIR -0.78
score DRUGS_ERECTILE 2.14
score TW_OK -1.79
score TW_QC -1.40
score TW_QQ -0.38
score HTML_IMAGE_ONLY_08 -1.60
score MPART_ALT_DIFF_COUNT -2.10
score TW_QJ -0.68
score RCVD_IN_IADB_OPTIN -0.67
score BAYES_20 -8.74
score FREEMAIL_REPLY 0.50
score J_CHICKENPOX_62 -1.71
score J_CHICKENPOX_17 -0.89
score T_FROM_12LTRDOM -0.04
score HTML_OBFUSCATE_20_30 1.49
score J_BACKHAIR_11 -0.76
score OBFUSCATING_COMMENT -1.51
score TW_BF -0.85
score HK_RANDOM_FROM 1.44
score FOURLA -2.81
score LDOSUBSCRIBER -1.59
score LDO_WHITELIST 0.18
score WWWRO 0.11
score TW_HK -1.57
score TW_LH -1.83
score TW_UU -2.49
score HTML_COMMENT_SAVED_URL -0.40
score STYLE_GIBBERISH -1.29
score TW_HX -0.09
score TW_JC 0.45
score TW_LP -1.27
score TW_MN 1.35
score TW_WH -0.41
score HTTPS_HTTP_MISMATCH -0.18
score TO_EQ_FM_DOM_SPF_FAIL -1.55
score J_CHICKENPOX_15 -1.02
score SUBJ_OBFU_LOW_CNTRST -2.88
score TW_BH 0.39
score TW_MF -1.85
score TW_QG -1.10
score DC_PNG_UNO_LARGO -2.39
score HTML_SHORT_LINK_IMG_2 -1.92
score DOS_HIGHBIT_HDRS_BODY -0.57
score MALFORMED_FREEMAIL 3.93
score RCVD_IN_MSPIKE_H5 -0.17
score BAYES_05 -6.73
score TW_MV 0.89
score RCVD_IN_XBL 2.03
score FH_HELO_EQ_D_D_D_D -2.70
score TW_XU 0.90
score TW_ZS -0.54
score TW_GT 0.33
score TW_MH -0.16
score TW_UX 0.56
score T_HEADER_FROM_DIFFERENT_DOMAINS 0.95
score J_CHICKENPOX_45 -1.67
score MSGID_MULTIPLE_AT 2.24
score MANGLED_LIMITD -0.63
score RCVD_IN_IADB_OPTIN_GT50 -2.58
score MIME_HEADER_CTYPE_ONLY -0.07
score BODY_URI_ONLY 1.91
score DC_IMAGE_SPAM_TEXT -0.21
score TRACKER_ID 1.09
score T_MONEY_PERCENT -0.05
score J_BACKHAIR_41 -0.07
score FUZZY_ANDROID -0.96
score MANGLED_MEDICL 0.66
score TW_XX -1.49
score TW_EV -0.64
score TW_JL -0.75
score WEIRD_PORT 1.50
score DATE_IN_PAST_03_06 -0.20
score RCVD_IN_SBL 1.49
score FREEMAIL_REPLYTO_END_DIGIT 2.95
score SORTED_RECIPS -0.60
score DNS_FROM_RFC_DSN -1.50
score URIBL_WS_SURBL 1.14
score J_CHICKENPOX_92 -2.23
score HK_NAME_FREE -0.97
score MANGLED_LOAN 1.86
score URIBL_RHS_DOB 1.13
score TW_QF -0.54
score XPRIO 1.61
score J_CHICKENPOX_55 0.34
score HTML_EXTRA_CLOSE 1.15
score BAYES_80 -3.13
score TW_XH -0.29
score J_CHICKENPOX_21 -0.50
score FUZZY_CPILL -0.21
score DYN_RDNS_AND_INLINE_IMAGE 2.24
score DYN_RDNS_SHORT_HELO_HTML 0.84
score DYN_RDNS_SHORT_HELO_IMAGE -0.04
score SHORT_HELO_AND_INLINE_IMAGE -0.84
score URIBL_AB_SURBL -1.14
score FORGED_MUA_EUDORA -0.12
score LONGWORDS -0.08
score REPTO_QUOTE_QUALCOMM -0.19
score NO_RDNS_DOTCOM_HELO 0.40
score TW_HF -1.65
score TW_HH -0.15
score TW_QS -0.76
score TW_XF -1.83
score TW_XM -2.06
score URIBL_JP_SURBL 2.24
score INVESTMENT_ADVICE -7.36
score TW_DB -1.91
score TW_PW -0.65
score TO_MALFORMED 1.43
score HABEAS_ACCREDITED_SOI 0.89
score J_CHICKENPOX_82 -0.60
score MANGLED_PENIS -1.57
score TW_FM -0.96
score TW_KU -0.88
score TW_HZ 0.09
score TW_KD -0.33
score TW_QM 0.57
score TW_RR 1.37
score TW_VK 0.14
score TW_YC -0.03
score TW_ZQ 0.33
score TW_QO -1.02
score FORGED_HOTMAIL_RCVD2 4.65
score HTML_OBFUSCATE_05_10 0.65
score NA_DOLLARS 0.01
score AD_PREFS -1.04
score TW_BQ -0.35
score TW_WB 0.61
score TW_NW -0.85
score J_BACKHAIR_36 -3.35
score MANGLED_DEALS 0.03
score FRT_REFINANCE1 -1.19
score HTML_OBFUSCATE_10_20 1.24
score TO_NO_BRKTS_HTML_IMG -2.24
score GR_DOMAIN_SENDGR1 -1.81
score FM_SCHOOLING 0.75
score TW_DQ -1.43
score HEAD_LONG -0.02
score SUSPICIOUS_RECIPS 2.67
score RAZOR2_CF_RANGE_E4_51_100 -2.86
score INVALID_MSGID 1.48
score MSGID_SHORT 0.03
score MANGLED_CAMERA 1.99
score AC_DIV_BONANZA -1.94
score PP_MIME_FAKE_ASCII_TEXT -2.90
score UPPERCASE_75_100 2.51
score FRT_PENIS1 0.19
score MANGLED_EQUIV -0.41
score J_CHICKENPOX_41 -0.44
score J_CHICKENPOX_19 1.91
score HTTP_ESCAPED_HOST 2.11
score T_LOTS_OF_MONEY -1.36
score MANGLED_FREE -1.36
score HTML_SHORT_CENTER -2.15
score GR_DOMAIN_CAMN10 0.53
score GR_DOMAIN_CHIMP1 -1.12
score GR_DOMAIN_CHIMP2 0.10
score GR_DOMAIN_CHIMP3 0.47
score GR_DOMAIN_CHIMP4 -1.08
score SB_GIF_AND_NO_URIS 0.58
score J_CHICKENPOX_64 1.89
score TW_IB -0.29
score T_FSL_HELO_BARE_IP_2 0.14
score TW_IK 0.02
score TW_CF 0.19
score TW_DP -0.74
score TW_QE 0.01
score TW_YM -3.44
score TW_MJ -1.20
score BANG_GUAR -0.18
score RCVD_IN_MSPIKE_BL 0.95
score RCVD_IN_MSPIKE_L3 -1.39
score TVD_PH_SEC -2.17
score DATE_IN_PAST_96_XX 3.58
score J_CHICKENPOX_32 -1.11
score J_CHICKENPOX_66 -0.31
score T_TO_NO_BRKTS_FREEMAIL -2.24
score FREEMAIL_REPLYTO 2.77
score NML_ADSP_CUSTOM_MED 0.25
score J_BACKHAIR_14 0.74
score URI_ONLY_LOW_CONTRAST 1.37
score J_CHICKENPOX_34 0.41
score TW_AV -0.38
score TW_BX -0.66
score TW_DW -3.07
score TW_HP -0.85
score TW_KR -1.27
score TW_KV -0.29
score TW_PM 2.97
score TW_QL 1.06
score TW_TJ -1.04
score TW_VP 0.47
score TW_WT -0.15
score ACT_NOW_CAPS -1.25
score URI_OBFU_WWW 1.03
score TW_XW -0.12
score TVD_FW_GRAPHIC_NAME_LONG 1.12
score LONG_HEX_URI -0.79
score TW_JZ 0.55
score FRT_APPROV -1.42
score FRT_OFFER2 -0.39
score LOW_PRICE -2.62
score GR_DOMAIN_ACEMML1 -1.86
score GR_DOMAIN_ACEMML2 -0.98
score J_CHICKENPOX_25 -0.20
score TW_CS -2.22
score MISSING_MIME_HB_SEP 0.52
score J_CHICKENPOX_46 1.10
score TW_DH -0.08
score FROM_WORDY -0.30
score FH_FROMEML_NOTLD 1.58
score FROM_BLANK_NAME 1.04
score NULL_IN_BODY -1.40
score DATE_IN_FUTURE_06_12 5.85
score MISSING_DATE 0.40
score T_BIG_HEADERS_2K -0.11
score T_FSL_HELO_NON_FQDN_2 0.43
score T_NOT_A_PERSON 0.66
score T_SINGLE_HEADER_1K -1.03
score T_THREAD_INDEX_BAD -0.17
score TW_NP -1.43
score TW_VU -1.55
score MANGLED_DIET 3.06
score FUZZY_VLIUM -1.35
score GAPPY_SUBJECT 2.56
score CK_HELO_GENERIC 1.35
score HK_NAME_MR_MRS 1.54
score MONEY_FROM_41 0.18
score MONEY_FROM_MISSP -3.56
score TW_VF -0.45
score DC_GIF_UNO_LARGO 2.27
score DC_IMAGE_SPAM_HTML -0.96
score TW_QA -0.53
score TW_WP 0.57
score URIBL_RED 1.29
score TW_CL -0.71
score DNS_FROM_RFC_BOGUSMX 0.38
score TW_MB 0.94
score TW_NV -2.23
score MANGLED_ACTION -0.14
score X_IP 0.77
score RCVD_IN_NJABL_SPAM -1.38
score TW_VL 0.51
score TW_VB -1.43
score RCVD_ILLEGAL_IP -0.78
score ROUND_THE_WORLD_LOCAL 0.16
score TW_IY -0.76
score TW_OZ 0.71
score TW_VN 0.02
score TW_YF -0.53
score TW_ZJ -1.17
score TW_BG 0.05
score TW_CB -0.82
score TW_GL -0.02
score NO_DNS_FOR_FROM 0.33
score TW_TK -1.35
score J_CHICKENPOX_56 -2.07
score J_CHICKENPOX_27 -1.15
score J_CHICKENPOX_71 0.86
score TW_RB -1.77
score TW_TB 0.37
score J_CHICKENPOX_38 -0.48
score TW_IJ 1.45
score TW_KJ -0.30
score TW_WQ 1.14
score SPF_NEUTRAL 1.97
score STOCK_IMG_OUTLOOK -1.02
score TVD_STOCK1 -0.43
score TW_NX 0.00
score URIBL_DBL_SPAM 3.26
score GR_DOMAIN_CHIMP6 -2.25
score TW_MG -0.12
score GR_DOMAIN_AMAZON1 -1.49
score TW_OC -2.50
score MANGLED_CABLE 0.52
score J_CHICKENPOX_57 -1.37
score REPLYTO_WITHOUT_TO_CC 1.84
score NAME_EMAIL_DIFF -1.53
score UPPERCASE_50_75 0.52
score J_CHICKENPOX_72 -0.48
score TW_TF 1.20
score TW_DF -0.40
score INVALID_TZ_EST 0.23
score TW_BN -0.99
score TW_FW 0.55
score TW_HL -1.70
score TW_HR -0.00
score TW_JH -0.46
score TW_RZ 0.44
score TW_SJ 1.44
score TW_UJ -0.83
score TW_WJ 0.69
score TW_WW 0.99
score TW_XC 0.76
score TW_YJ 1.53
score TW_YK 0.43
score TW_ZT -0.37
score TVD_RCVD_SPACE_BRACKET 0.16
score MANGLED_SPAM 0.82
score TW_ZM -0.60
score TW_KB -0.53
score TW_ZB 0.09
score TW_HW 0.69
score TW_UZ 0.36
score SUBJ_BUY 0.56
score FROM_LOCAL_NOVOWEL 0.44
score J_CHICKENPOX_37 0.37
score TVD_SUBJ_ACC_NUM 1.35
score J_CHICKENPOX_102 2.89
score TW_FP 0.06
score J_BACKHAIR_52 -0.85
score J_CHICKENPOX_36 -1.08
score T_TVD_FW_GRAPHIC_ID1 -1.26
score GR_DOMAIN_SENDGR3 1.78
score TW_FC -1.11
score TW_RJ 4.84
score FU_COMMON_SUBS2 0.23
score FROM_ILLEGAL_CHARS -1.13
score TW_DL 2.87
score TW_VD 2.15
score TW_HQ 0.10
score MONEY 0.47
score STOCKLIKE 0.03
score TVD_FUZZY_FINANCE -1.00
score T_HTML_ATTACH 2.13
score T_KHOP_FOREIGN_CLICK -1.12
score J_CHICKENPOX_75 1.60
score TW_TD -1.02
score TW_UQ -1.38
score URI_GOOGLE_PROXY -0.76
score TW_QX -1.24
score TW_LV 0.28
score REMOVE_BEFORE_LINK 3.05
score TW_ZC 0.45
score AXB_X_FF_SEZ_S 0.54
score EMPTY_MESSAGE -1.92
score TW_KM -0.35
score SPAMMY_XMAILER 1.47
score MANGLED_NAIL 1.01
score TW_NR -0.92
score TW_SV -1.12
score TW_TP -0.65
score TW_XV 0.06
score TW_KC -0.09
score TW_PH 0.73
score TO_IN_SUBJ 2.72
score HTML_FONT_TINY -1.95
score DSN_NO_MIMEVERSION 5.39
score TW_OV -4.83
score TW_QD -1.94
score TW_VJ 1.60
score TW_WX -0.82
score TW_YV -0.13
score HELO_DYNAMIC_DHCP -0.21
score HTML_NONELEMENT_40_50 -0.16
score RATWARE_GECKO_BUILD -0.95
score CTYPE_8SPACE_GIF 1.00
score J_CHICKENPOX_91 3.04
score TW_KY 0.36
score RCVD_NUMERIC_HELO 0.44
score TW_BD 0.16
score TW_BV -0.28
score TW_JS 0.05
score TW_RQ 0.96
score T_OBFU_DOC_ATTACH 3.76
score MANGLED_RVRSES 0.20
score HTML_EMBEDS 1.47
score SINGLE_HEADER_1K 0.70
score TW_HG 0.21
score MANGLED_GIRL -0.49
score WEIRD_QUOTING -0.46
score INVALID_DATE 1.55
score TW_YB -0.71
score URIBL_PH_SURBL 2.19
score FORGED_YAHOO_RCVD -3.60
score MANGLED_HERE 1.36
score TW_GV 0.78
score TW_LC -0.83
score TW_JQ 0.47
score TW_JW -0.09
score TW_PQ -1.18
score TW_QP -0.48
score LOTTERY_PH_004470 0.74
score DIGITS_LETTERS -0.61
score HS_INDEX_PARAM -1.49
score TW_FD -0.32
score GR_DOMAIN_CAMN17 0.51
score TVD_FROM_1 2.51
score J_CHICKENPOX_81 -0.23
score TW_BP -1.16
score TW_JM -0.79
score TW_WF -0.33
score TW_PX -1.13
score TW_DK 0.10
score TW_UW 1.59
score DEAR_FRIEND 1.55
score UNRESOLVED_TEMPLATE 1.99
score TW_AQ -0.87
score TW_DT -1.47
score TW_IH -1.88
score TW_KZ 0.63
score TW_MD 0.17
score TW_RG 1.44
score GR_DOMAIN_CHIMP5 1.76
score J_BACKHAIR_45 0.58
score TW_FV 0.45
score TW_IF 0.58
score MISSING_MIMEOLE -1.32
score TW_CD -0.16
score TW_WC -0.01
score TW_YD 0.36
score TW_YY 0.77
score T_HTML_TAG_BALANCE_CENTER 0.16
score FSL_HELO_NON_FQDN_1 2.21
score J_CHICKENPOX_47 -0.30
score TW_GD 0.24
score TW_KQ 0.17
score TW_LX 1.38
score DEAR_SOMETHING -0.06
score TW_WR -0.06
score TVD_RCVD_IP 3.51
score TVD_RCVD_IP4 -0.43
score T_TVD_FUZZY_SECURITIES 0.61
score ACCT_PHISHING 0.68
score T_HDRS_LCASE 2.00
score J_BACKHAIR_32 -0.26
score URI_TRUNCATED 0.59
score MANGLED_LIST 1.02
score MANGLED_ACTVTY 0.35
score URIBL_DBL_REDIR -0.69
score TW_FZ 1.71
score TW_HJ 0.97
score TW_WL 0.22
score TW_ZH 0.40
score T_TVD_MIME_EPI 1.71
score TVD_PH_SUBJ_ACCOUNTS_POST 0.62
score FROM_MISSPACED -0.53
score FROM_MISSP_EH_MATCH -2.78
score FROM_MISSP_FREEMAIL -0.12
score FROM_MISSP_MSFT -0.75
score FROM_MISSP_REPLYTO 0.07
score FROM_MISSP_TO_UNDISC -1.14
score FROM_MISSP_USER 0.43
score FROM_MISSP_XPRIO 0.08
score FSL_CTYPE_WIN1251 0.26
score FSL_NEW_HELO_USER -0.76
score NSL_RCVD_FROM_USER -0.22
score TW_OY -1.52
score ADVANCE_FEE_2_NEW_MONEY 2.04
score TW_CN -1.34
score TW_EP -1.41
score TW_GJ 1.55
score TW_GX 0.11
score TW_XB -0.35
score J_BACKHAIR_16 -1.03
score TW_OQ -1.48
score TW_KW -0.62
score RCVD_IN_MSPIKE_L5 0.40
score TW_CZ -1.03
score TW_MQ 1.12
score TW_QK -0.54
score TW_ZR -0.18
score TW_FN -0.38
score J_BACKHAIR_21 -0.37
score T_FRT_ADULT2 0.13
score T_FREEMAIL_FORGED_FROMDOMAIN -2.52
score MANGLED_SPICE -1.20
score BAYES_95 -3.43
score TW_DZ 1.44
score TW_LQ 0.05
score TW_OJ -0.34
score TW_PK -0.67
score TW_PZ 0.70
score TW_QW -0.42
score TW_QY 0.41
score TW_SD 1.44
score TW_LZ 0.92
score TW_QT 0.63
score TW_XK -0.43
score TW_ZP 1.38
score RCVD_IN_IADB_UT_CPR_MAT -0.35
score TW_SR 0.53
score TW_ZL 0.10
score TW_LG -0.36
score TW_KG 0.61
score TW_VH -0.71
score GR_DOMAIN_GRES1 1.83
score GR_DOMAIN_GRES2 -0.27
score DRUG_ED_CAPS 0.59
score TW_LB 2.14
score TW_GW -0.52
score SUBJECT_DRUG_GAP_C 2.05
score TW_GK -0.93
score J_CHICKENPOX_48 2.30
score TW_SF -3.17
score TW_GZ 1.13
score TW_SN -0.55
score TOTAL_SCORE 9.93
score HELO_LOCALHOST -0.90
score TW_EG 0.17
score TW_GC 1.47
score TW_XY 1.34
score RCVD_IN_NJABL_PROXY 0.84
score TW_ZD 1.49
score OBSCURED_EMAIL -0.98
score TW_ZU 0.23
score TW_DJ -0.31
score MIME_ASCII0 1.08
score TW_QH -0.43
score TW_KT -1.32
score MIME_BOUND_DD_DIGITS 0.23
score TW_WV 0.88
score TW_BJ -1.20
score TW_IW -1.09
score TW_CQ 2.13
score TW_VR -0.00
score TW_GF -0.58
score TW_QU -0.21
score TW_ZF -1.76
score FVGT_m_MULTI_ODD -2.79
score LONGLINEURL -0.60
score DKIM_ADSP_NXDOMAIN 2.40
score J_CHICKENPOX_110 0.82
score TW_GQ 0.76
score GR_DOMAIN_CMAIL4 1.62
score GR_DOMAIN_CMAIL7 -0.58
score TW_LR 2.48
score TW_CC -1.32
score TW_VT -0.55
score TW_CR 0.06
score TW_KN -0.54
score IP_LINK_PLUS -0.38
score J_CHICKENPOX_101 -0.30
score TW_FQ 1.82
score TW_JD 1.01
score TW_RX 1.02
score J_BACKHAIR_54 -0.91
score TW_JJ -0.26
score TW_JP -0.35
score TW_XN -0.08
score HK_RANDOM_REPLYTO -1.90
score J_CHICKENPOX_29 -0.93
score TW_VG -0.31
score TW_WM 0.37
score GR_DOMAIN_MAILJE1 0.18
score GR_DOMAIN_MAILJE3 -1.89
score GR_DOMAIN_MAILJE4 0.45
score TW_KP -0.67
score TW_TR 0.69
score TW_YG -0.03
score TW_RK 0.78
score TW_GG 0.40
score SUBJECT_DIET 0.99
score TW_XJ 0.18
score TW_BZ 0.13
score TW_PD -1.82
score FORGED_MUA_OUTLOOK 1.35
score TW_MX 0.31
score TW_KL 3.32
score TW_EQ -0.47
score TW_UH 1.69
score SUBJECT_FUZZY_TION 0.22
score TW_BW 5.30
score TW_DN 1.26
score TW_IX -0.38
score TW_JF -1.75
score TW_ZZ 0.14
score TW_BL 0.32
score TW_XQ 0.61
score TW_YQ -0.09
score TW_XT -1.02
score TW_PC -0.40
score TW_IQ -0.38
score MANGLED_EMAIL -0.19
score RCVD_IN_MSPIKE_L4 0.84
score MANGLED_TRNFER 0.97
score TW_NM 0.40
score TW_YH -0.33
score MANGLED_OFF 1.72
score TW_KH -0.45
score URIBL_ABUSE_SURBL 3.52
score TW_QZ -0.97
score MANGLED_STOP 1.31
score TW_TN 0.09
score MANGLED_RX 2.73
score TW_VV 0.31
score TW_YW 1.40
score RISK_FREE -1.34
score FORGED_OUTLOOK_TAGS -2.14
score TW_JV -0.79
score FROM_LOCAL_DIGITS -2.16
score FROM_LOCAL_HEX -1.06
score SUBJ_DOLLARS 1.49
score J_BACKHAIR_27 -2.57
score J_BACKHAIR_42 1.33
score MANGLED_DELETE -0.67
score LOCALPART_IN_SUBJECT -0.28
score T_FRT_PROFIT1 0.51
score TW_OH 0.32
score FILL_THIS_FORM 2.35
score ADMITS_SPAM -1.85
score STOX_REPLY_TYPE 1.42
score TVD_FINGER_02 -0.35
score HTML_30_40 0.94
score TW_FJ 1.62
score TW_YI -1.24
score J_CHICKENPOX_26 -2.13
score TO_NO_BRKTS_HTML_ONLY 1.65
score J_CHICKENPOX_210 -0.98
score GREYLIST_ISWHITE -1.85
score TW_SG -1.08
score TW_JB 0.69
score TW_XS -0.02
score TW_SM -0.77
score TW_II -0.85
score TW_DR -0.20
score TW_GP -0.50
score TW_MK 0.65
score MIME_NO_TEXT -1.91
score TW_TQ -0.41
score TW_PR -0.75
score TW_NH -0.25
score TW_NL 0.73
score TW_QR -0.21
score TW_XG -0.72
score JOIN_MILLIONS -1.44
score TW_ZG 0.25
score APOSTROPHE_FROM -1.41
score TW_XP 1.29
score TW_XR -0.12
score TW_YT 1.18
score TW_VM 0.48
score TW_WZ 0.03
score TW_DX 1.61
score TW_VW -1.27
score MANGLED_AVOID 0.44
score BASE64_LENGTH_78_79 -1.48
score MANGLED_RVLUTN 1.78
score TW_BT 0.39
score BODY_ENHANCEMENT 0.49
score TW_ZV 0.41
score HIDE_WIN_STATUS -1.30
score HELO_DYNAMIC_SPLIT_IP 0.70
score DOS_RCVD_IP_TWICE_C 0.34
score ZMIvirSobY_SUB51 0.25
score FAKE_REPLY_C 1.88
score TW_VS -0.54
score TW_BK 0.56
score REPTO_QUOTE_YAHOO 0.80
score URIBL_SC_SURBL 1.45
score FB_WORD1_END_DOLLAR -0.76
score URIBL_OB_SURBL -0.63
score RCVD_IN_SBL_CSS 4.05
score TW_SW -0.80
score TW_DM -0.83
score TW_QN 0.59
score FM_VIAGRA_SPAM1114 -1.99
score J_CHICKENPOX_111 1.48
score USER_IN_WHITELIST 5.43
score NO_RECEIVED 0.20
score MATTA_HAS_PGP_SIGNATURE 1.20
score TO_NO_BRKTS_NORDNS -1.05
score MANGLED_VIAGRA -1.07
score TW_YZ -1.66
score MANGLED_PRICE -1.38
score MANGLED_COST 1.65
score J_CHICKENPOX_74 0.30
score MANGLED_GAME -1.77
score MANGLED_RATES -1.22
score TW_NB -1.14
score MANGLED_SOMA 0.58
score MANGLED_HOME -0.76
score J_CHICKENPOX_24 1.65
score MANGLED_DOSE -0.38
score MANGLED_TEXT 4.46
score MANGLED_PREMTR 0.09
score T_SHARE_50_50 -2.16
score URIBL_DBL_ABUSE_BOTCC 6.45
score SHORTENED_URL_SRC 2.70
score URIBL_DBL_ABUSE_SPAM 4.88
score HELO_MISC_IP 5.27
score URIBL_MW_SURBL 2.63
score T_MANY_HDRS_LCASE 2.10
score FSL_HELO_BARE_IP_2 1.10
score TBIRD_SUSP_MIME_BDRY 0.60
score MILLION_USD 0.92
score T_HK_NAME_FM_MR_MRS 2.17
score MANGLED_LSBIAN 3.65
score THIS_AD 1.96
score J_BACKHAIR_57 4.87
score SYSADMIN 2.41
score TW_JN -0.53
score T_HK_NAME_DR -0.18
score TW_TX 0.51
score HK_SCAM_N15 3.37
score FROM_OFFERS 0.49
score T_CDISP_SZ_MANY 2.51
score RCVD_HELO_IP_MISMATCH 1.67
score MARKETING_PARTNERS 2.80
score J_CHICKENPOX_39 0.14
score TW_JG 2.26
score TO_NO_BRKTS_NORDNS_HTML 2.74
score RCVD_IN_RP_RNBL 5.45
score CURR_PRICE 1.08
score LONG_TERM_PRICE 0.62
score DKIM_ADSP_ALL -1.95
score DOS_OE_TO_MX 0.91
score HELO_DYNAMIC_HCC 1.49
score PDS_FROM_2_EMAILS -0.70
score T_PDS_TO_EQ_FROM_NAME 0.20
score URI_ONLY_MSGID_MALF -0.95
score ZMIde_OutlookExpress 3.59
score MANGLED_TIME 3.17
score HELO_NO_DOMAIN 1.40
score FORGED_OUTLOOK_HTML 2.88
score URIBL_DBL_ABUSE_PHISH 4.64
score ADVANCE_FEE_3 1.45
score ADVANCE_FEE_4 -0.09
score TO_EQ_FM_DIRECT_MX 2.42
score BASE64_LENGTH_79_INF 2.47
score HK_NAME_DRUGS 0.75
score URIBL_CR_SURBL 0.84
score XM_PHPMAILER_FORGED 0.81
score ZMIvirSobY_SUB39 1.38
score DOS_OUTLOOK_TO_MX 1.99
score PGPSIGNATURE 3.64
score URIBL_DBL_ABUSE_MALW 3.13
score MANGLED_MRTG 2.43
score SPOOFED_FREEM_REPTO 0.96
score TW_XL 1.70
score SPF_HELO_SOFTFAIL 1.95
score TW_DG 2.72
score TW_RV 1.59
score TW_WG 2.48
score T_URIBL_BLACK_OVERLAP 0.16
score FROM_DOMAIN_NOVOWEL 2.57
score RCVD_IN_MSPIKE_ZBI 1.68
score URI_WP_HACKED 1.25
score FROM_MISSP_SPF_FAIL 1.17
score MANGLED_TAKE 3.85
score T_DOS_OUTLOOK_TO_MX_IMAGE 0.41
score BODY_ENHANCEMENT2 3.23
score TW_MM 1.74
score UPPERCASE_25_50 0.37
score MANGLED_SMALL -1.08
score TW_WU 1.26
score TW_TG 0.13
score MANGLED_MONEY -0.54
score TW_WK 0.67
score FRT_LEVITRA -1.59
score SHORT_TERM_PRICE 0.04
score AXB_XMAILER_MIMEOLE_OL_1ECD5 1.19
score NSL_RCVD_HELO_USER 1.02
score TO_NO_BRKTS_MSFT 0.77
score T_OBFU_ATTACH_MISSP -0.40
score ZMIde_LOTTERYHARD1 0.44
score ZMIde_LOTTERY_OL -0.15
score CK_HELO_DYNAMIC_SPLIT_IP 2.49
score HELO_DYNAMIC_IPADDR2 2.28
score ADVANCE_FEE_5_NEW_FRM_MNY 0.97
score AXB_XMAILER_MIMEOLE_OL_024C2 1.22
score DEAR_BENEFICIARY -0.06
score FILL_THIS_FORM_LOAN 0.68
score FILL_THIS_FORM_LONG 2.67
score MONEY_FORM 1.28
score MONEY_FRAUD_8 2.69
score T_OBFU_HTML_ATTACH -0.30
score DATE_IN_FUTURE_24_48 -0.01
score URI_WP_HACKED_2 -0.73
score STATIC_XPRIO_OLE 0.61
score URI_WP_DIRINDEX 0.04
score MANGLED_ONLINE 1.17
score MONEY_FRAUD_3 0.04
score MSOE_MID_WRONG_CASE -0.78
score ADVANCE_FEE_5_NEW_MONEY 2.53
score URI_NO_WWW_INFO_CGI 3.54
score SUBJECT_DRUG_GAP_L 2.75
score PUMPDUMP 0.58
score DATE_IN_FUTURE_96_Q -0.85
score MANGLED_BACK -1.44
score MANGLED_BELOW 1.70
score MANGLED_PLEASE 0.60
score MANGLED_REFUND -1.28
score MANGLED_YOUR 1.15
score BUG6152_INVALID_DATE_TZ_ABSURD -0.87
score STOX_REPLY_TYPE_WITHOUT_QUOTES 0.77
score GR_DOMAIN_CAMN12 0.10
score GR_DOMAIN_CAMN13 1.91
score GR_DOMAIN_CAMN14 0.46
score GR_DOMAIN_EMVCOM3 -0.03
score GR_DOMAIN_EMVCOM4 -0.10
score GR_DOMAIN_XECODE1 1.16
score MIME_BOUND_DIGITS_15 -0.65
score MSGID_SPAM_CAPS -0.01
score DEAR_WINNER 0.68
score HK_LOTTO -0.97
score LOTTO_AGENT -0.46
score LOTTO_DEPT 1.50
score MONEY_FRAUD_5 -0.19
score HK_SCAM_N2 0.08
score COMPENSATION 3.10
score FORM_FRAUD_5 -0.41
score MONEY_FORM_SHORT 2.62
score GR_DOMAIN_CAMN2 1.84
score GUARANTEED_100_PERCENT -0.90
score FSL_BOTSPAM_1 -0.44
score ADVANCE_FEE_3_NEW 0.43
score URI_DQ_UNSUB -0.73
score ADVANCE_FEE_3_NEW_MONEY 2.69
score HK_SCAM_N1 -0.59
score ADVANCE_FEE_4_NEW_MONEY 0.70
score TVD_PH_BODY_META 0.24
score FSL_HELO_BARE_IP_1 -1.44
score URG_BIZ 1.33
score MANGLED_CASH -0.17
score URI_NO_WWW_BIZ_CGI -0.40
score SERGIO_SUBJECT_VIAGRA01 0.41
score FIN_FREE -0.12
score TVD_QUAL_MEDS 1.02
score PHP_ORIG_SCRIPT 2.58
score FILL_THIS_FORM_FRAUD_PHISH -0.42
score EXCUSE_REMOVE 2.49
score TVD_APPROVED 0.39
score TW_JK 2.51
score FUZZY_PHARMACY 0.80
score LOCAL_UNDIS 2.71
score TW_CY 0.26
score TW_FR -0.32
score TW_GM 0.62
score TW_HB 1.48
score TW_HD -1.12
score TW_HV 0.32
score TW_KF -0.36
score TW_MW 0.77
score TW_NZ 0.70
score TW_PL -0.81
score TW_PV 0.72
score TW_QB 0.46
score TW_RH -0.64
score TW_RW -0.09
score TW_SB 0.73
score TW_SQ 0.38
score TW_SY 1.41
score TW_TV 0.49
score TW_TZ 0.70
score TW_ZK 0.48
score BLANK_LINES_70_80 8.23
score ZMIde_Mahnung1 -1.07
score STOCK_TIP 1.77
score J_WEEDS_A 0.11
score J_WEEDS_D -1.09
score J_WEEDS_E -0.92
score J_WEEDS_F 1.17
score J_WEEDS_G -0.43
score J_WEEDS_H -0.82
score J_WEEDS_I -0.72
score J_WEEDS_L 0.20
score J_WEEDS_M 0.52
score J_WEEDS_N -0.62
score J_WEEDS_O 0.75
score J_WEEDS_R -0.71
score J_WEEDS_S 0.99
score J_WEEDS_T 0.94
score J_WEEDS_U 0.39
score J_WEEDS_V -0.29
score J_WEEDS_Y 0.58
score T_MIME_NO_TEXT 0.71
score SERGIO_SUBJECT_PORN014 -0.79
score TW_GB 0.72
score TW_KS 0.67
score TW_LW -0.47
score TW_MR 0.40
score TW_NF 0.50
score TW_PN 0.15
score TW_RL -1.09
score TW_SZ -0.74
score TW_UK -0.32
score TW_XA 1.26
score TW_ZW 1.14
score FSL_HELO_FAKE 0.72
score MANGLED_FROM 0.17
score J_CHICKENPOX_44 -0.55
score T_FUZZY_OPTOUT -0.54
score EXCUSE_4 0.74
score FROM_MISSP_DYNIP 1.00
score ADVANCE_FEE_4_NEW 0.49
score ADVANCE_FEE_5_NEW 0.11
score AXB_RCVD_NS1GOO -0.52
score T_FROM_MISSP_DKIM 1.46
score GR_DOMAIN_CAMN20 1.79
score GR_DOMAIN_EMARKE3 -0.35
score GR_DOMAIN_EMARKE4 0.10
score GOOG_REDIR_SHORT -0.63
score HTTP_EXCESSIVE_ESCAPES -0.12
score FORM_FRAUD 0.74
score NUMERIC_HTTP_ADDR 0.29
score HK_NAME_FM_MR_MRS 0.53
score TEQF_USR_POLITE 0.38
score DRUGS_ERECTILE_OBFU 1.25
score IMPOTENCE 0.29
score MANGLED_BREAS 0.40
score MANGLED_CIALIS -0.87
score ONLINE_PHARMACY 0.87
score PERCENT_RANDOM -0.98
score TVD_VISIT_PHARMA -0.88
score T_MANY_PILL_PRICE -1.50
score rantext17 -1.08
score rantext33 0.47
score TVD_RCVD_SINGLE -0.24
score URI_WPADMIN 0.71
score RCVD_DOUBLE_IP_SPAM 1.43
score TVD_SPACE_RATIO_MINFP 1.00
score DRUG_ED_SILD 0.79
score AC_BR_BONANZA -0.43
score RCVD_IN_SORBS_HTTP 0.57
score RCVD_IN_SORBS_SOCKS 0.73
score FORGED_MUA_IMS 0.90
score SUBJECT_FUZZY_CHEAP -1.05
score DRUG_ED_ONLINE 0.45
score MALE_ENHANCE -1.62
score ZMIde_LOTTERY1 -0.29
score ZMIde_LOTTERY2 0.79
score ZMIde_LOTTERY3 -1.30
score ZMIde_LOTTERY4 0.67
score DKIM_ADSP_DISCARD -0.54
score HK_SCAM_N8 0.21
score BOGUS_MSM_HDRS 0.46
score DATE_IN_FUTURE_12_24 -0.59
score FUZZY_PRICES 3.15
score FORM_FRAUD_3 -0.54
score URI_PHISH -0.17
score MANGLED_PHRMCY 1.53
score LUCRATIVE -0.43
score MANGLED_EXTNSN 0.23
score MANGLED_INITAL 2.57
score MANGLED_LOOK -1.14
score MANGLED_TOOL 0.20
score TW_BM -0.34
score TW_AJ -0.22
score TW_FG 1.42
score TW_FH -2.62
score TW_GY 0.66
score TW_HC 1.42
score TW_TL 0.07
score TW_VC -0.46
score TW_VQ 1.84
score TW_YP -0.53
score TW_AZ -0.57
score TW_CG 1.38
score TW_CV -0.45
score TW_DV -0.21
score TW_NK 1.98
score TW_UV -0.68
score TW_ZX -1.38
score MANGLED_THOUS 0.11
score MONEY_LOTTERY 0.60
score AC_HTML_NONSENSE_TAGS -1.06
score FUZZY_VPILL -0.38
score MANGLED_LVITRA -0.68
score FBI_MONEY 0.70
score FBI_SPOOF -1.50
score VIRUS_CLEANED_SOBIG_F1 1.81
score HDRS_LCASE -0.32
score MANGLED_FULL 0.42
score FUZZY_XPILL 0.73
score MSGID_RANDY 3.38
score TW_EJ -0.23
score TW_FY -1.43
score TW_PB 0.56
score TW_TC 0.66
score TW_UY 1.65
score TW_YX -0.32
score TW_ZY -0.34
score T_HK_NAME_FM_DR 0.23
score J_CHICKENPOX_28 -0.66
score TO_NO_BRKTS_PCNT 2.22
score MANGLED_CHEAP -0.04
score TVD_FW_GRAPHIC_NAME_MID 1.31
score MANGLED_GOOD 1.97
score TW_GU -0.07
score TW_JY 0.24
score TW_VX -0.85
score TW_WY 0.71
score BILLION_DOLLARS 0.28
score MANGLED_MEDCTN 0.20
score FUZZY_ERECT 3.73
score MANGLED_ERECTN 3.09
score MONEY_ATM_CARD 0.27
score UC_GIBBERISH_OBFU -0.59
score FROM_MISSP_PHISH 1.61
score T_DATE_IN_FUTURE_96_Q -0.92
score FORGED_MUA_THEBAT_BOUN 1.41
score FOUND_YOU 1.03
score GR_DOMAIN_ASPNET1 0.54
score J_BACKHAIR_22 -0.30
score FROM_NO_USER 1.25
score MONEY_BACK -0.20
score J_CHICKENPOX_84 -1.13
score ADVANCE_FEE_3_NEW_FORM 0.80
score ADVANCE_FEE_3_NEW_FRM_MNY 1.05
score ADVANCE_FEE_4_NEW_FORM -0.91
score ADVANCE_FEE_4_NEW_FRM_MNY 0.01
score ADVANCE_FEE_5_NEW_FORM 0.53
score UNCLAIMED_MONEY -0.19
score MISSING_FROM 1.50
score DOS_OE_TO_MX_IMAGE -0.20
score STOCK_IMG_CTYPE 0.27
score J_WEEDS_B 0.90
score J_WEEDS_C 1.16
score J_WEEDS_P 1.18
score J_WEEDS_W 0.10
score J_WEEDS_K -0.61
score J_WEEDS_Q 0.31
score J_WEEDS_X -1.05
score MANGLED_ADULT 3.62
score URI_DOTDOT_LOW_CNTRST -0.63
score T_FRT_SLUT 2.89
score TW_CP -0.83
score TW_GR -0.29
score TW_HN 0.37
score TW_IU -0.72
score TW_ML -0.27
score TW_QI -1.20
score TW_QV 0.10
score TW_SL 1.38
score HK_SCAM_N3 -1.33
score T_HK_NAME_FROM 0.88
score TW_GN -1.23
score TW_IV -0.64
score TW_LK -0.86
score T_HK_NAME_FM_FROM 1.24
score FUZZY_MILLION 0.88
score MANGLED_SHOP 1.25
score RATWARE_MS_HASH 1.19
score RATWARE_OUTLOOK_NONAME 0.60
score ZMIfish_PayPal01 1.13
score MONEY_BARRISTER 0.38
score T_HK_SPAMMY_FILENAME -0.69
score SUBJ_YOUR_FAMILY 0.18
score ADVANCE_FEE_2_NEW_FORM 0.19
score HELO_DYNAMIC_CHELLO_NL 1.05
score ADVANCE_FEE_2_NEW_FRM_MNY -0.52
score SPOOF_COM2COM -0.21
score SPOOF_COM2OTH -0.27
score HELO_LH_HOME 2.81
score DATE_IN_FUTURE_48_96 0.56
score FORGED_TELESP_RCVD 1.57
score T_DATE_IN_FUTURE_Q_PLUS -0.15
score MANGLED_BCH -0.75
score YOU_INHERIT -1.40
score SUBJ_AS_SEEN 0.21
score FSL_HELO_DEVICE 4.18
score HTML_OFF_PAGE 0.32
score ZMIde_URIWEBBOX 0.03
score MANGLED_VISIT 0.23
score TW_HM 0.39
score T_EMRCP 1.42
score TW_HS -1.68
score TW_KK 0.86
score LOTTO_AGENT_RPLY -0.65
score URIBL_DBL_PHISH 1.21
score T_FILL_THIS_FORM_FRAUD_PHISH 1.60
score CANT_SEE_AD -0.31
score MANGLED_DRUGS 0.43
score FROM_12LTRDOM 0.40
score TW_PP -1.27
score TW_EH -0.19
score TW_EK 0.79
score TW_PT 1.08
score TW_RP 0.68
score TW_TW 0.25
score TW_YR 0.93
score SPF_HELO_NEUTRAL 0.49
score FM_LOTTO_MONEY -1.51
score FSL_MISSP_REPLYTO 0.15
score MANGLED_CLICK 0.44
score TW_SK -1.19
score TW_UC 0.50
score SPF_HELO_FAIL 0.75
score TW_LN -1.05
score URIBL_DBL_MALWARE 0.63
score TW_DY -0.51
score TW_EB -0.52
score TW_UF -1.41
score J_BACKHAIR_13 -0.44
score MANGLED_FORM 0.05
score MANGLED_SONATA 0.49
score T_CTYPE_NULL -0.29
score MANGLED_SRGERY 0.20
score J_BACKHAIR_23 1.91
score MANGLED_GRNTEE 0.72
score MSM_PRIO_REPTO 0.21
score GR_DOMAIN_EMVCOM1 -0.82
score VIRUS_WARNING401 -0.69
score TO_EQ_FM_SPF_FAIL 1.07
score T_WON_MONEY_ATTACH -0.33
score TW_DD 0.10
score PHP_SCRIPT_MUA 1.50
score MANGLED_ACCNT -0.99
score RCVD_DOUBLE_IP_LOOSE -1.10
score FORGED_MUA_MOZILLA 0.30
score ZMIde_SuperShopURI 3.71
score MANGLED_FQ -0.98
score TouchWARE_IPAUTHMX11B 1.42
score J_BACKHAIR_51 0.84
score T_RCVD_IN_SEMBLACK -2.32
score FS_LARGE_PERCENT2 0.74
score FB_CIALIS_LEO3 -0.25
score T_FRT_FOLLOW1 -0.49
score MANGLED_PAXIL -1.01
score MANGLED_BEST -1.58
score MANGLED_DEBT -1.33
score MANGLED_PRIOR 1.12
score MANGLED_ENLARG -1.27
score DRUGS_ANXIETY -0.44
score MANGLED_WHILE -1.25
score TW_PF -0.64
score INVALID_DATE_TZ_ABSURD 0.68
score L_SPAM_TOOL_13 0.77
score J_BACKHAIR_53 0.06
score MANGLED_SPORT 1.08
score MANGLED_PAIN -0.89
score MANGLED_LIPS -1.41
score MANGLED_BEEF 1.83
score MANGLED_SIZE -0.28
score MANGLED_WORKNG -0.32
score MANGLED_WORKS 1.07
score TW_MT -0.86
score ONE_TIME -0.85
score J_BACKHAIR_12 -0.01
score MANGLED_PILL -1.67
score MANGLED_WANT -0.24
score BIGNUM_EMAILS -0.09
score FORGED_MSGID_YAHOO -0.59
score CN_BODY_2 -1.63
score PRICES_ARE_AFFORDABLE -0.08
score URIBL_DBL_BOTNETCC -1.45
score MANGLED_MARKET 0.66
score MANGLED_TENAGE -0.51
score MANGLED_REFNCE 0.01
score FUZZY_ROLEX 0.87
score CUM_SHOT 1.39
score USER_IN_DEF_SPF_WL -3.24
score TW_VY 0.37
score T_FUZZY_SPRM 0.11
score T_TVD_FUZZY_SECTOR 0.91
score MANGLED_REGSTR -0.95
score OUR_MTA_MSGID -2.40
score WORD_WITHOUT_VOWELS -1.25
score TO_NO_BRKTS_DYNIP -1.69
score MURPHY_DRUGS_REL8 0.45
score PUSSY -1.11
score SARE_RMML_Stock1 0.64
score SARE_ADLTOBFU -0.00
score SARE_RMML_Stock9 -0.88
score PHONENUMBER -0.64
score HEADER_SPAM -2.97
score SARE_HEAD_HDR_APPROV -1.30
score IMPRONONCABLE_1 -0.26
score IMPRONONCABLE_2 -0.85
score MURPHY_WRONG_WORD1 1.41
score MURPHY_WRONG_WORD2 -1.77
score MURPHY_FINANCE6 -1.46
score CAPINIT -0.38
In [ ]:
Content source: Gaasmann/sa-learner
Similar notebooks: