What factors identify a message as particularly “spammy”?
DSPAM identifies a message as spam if a lot of the mail received in the past with similar tokens has been spam (as verfied by training). It tags messages as spam based on whether similar messages have been identified by U-M users as spam or innocent. If, for example, spammers start inserting Outlook-like headers in the spam they send, to make it look legitimate, and people report these messages as spam, then DSPAM will start to identify messages with tokens representing Outlook-like headers as spam. This would also be balanced by innocent mail, however. If a great deal of innocent mail with similar tokens is received here at the University, DSPAM is far less likely to consider those tokens indicative of spam and to look to other tokens in the message to make its decisions. DSPAM is very good at making fine distinctions once it is trained, because Bayesian filtering sorts out the relevant and irrelevant data. Mail with images, certain words, HTML formatting, lots of links, and so on has
