Example: Bayesian training

In this example, Company X has set up a FortiMail unit to protect its email server. With over 1,000 email users, Company X plans to enable Bayesian scanning for incoming email. You, the system administrator, have been asked to configure Bayesian scanning, perform initial training of the Bayesian databases, and configure Bayesian control email addresses for ongoing training.

The local domain name of the FortiMail unit itself is example.com.

Company X has email users in two existing protected domains:

• net
• org

Each protected domains receives email with slightly different terminology, which could be considered spam to the other protected domain, and so will use separate per-domain Bayesian databases. Email users prefer not to maintain their own personal Bayesian databases, and so will instead together maintain the per-domain Bayesian databases.

To facilitate initial training of each per-domain Bayesian database, you have used your email client software to collect samples of spam and non-spam email from each protected domain, and exported them into mailbox files:

• example-net-spam.mbox
• example-net-not-spam.mbox
• example-org-spam.mbox
• example-org-not-spam.mbox

After initial training, email users will use the default Bayesian control email addresses to perform any required ongoing training for each of their per-domain Bayesian databases.

To enable use of per-domain Bayesian databases

1. Go to Mail Settings > Domains > Domains.
2. Select the row corresponding to example.net and click Edit.
3. Click the arrow to expand Advanced AS/AV Settings.
4. Disable the option Use global Bayesian database.
5. Click OK.

Repeat the above steps for the protected domain example.org.

To initially train each per-domain Bayesian database using mailbox files

1. Go to AntiSpam > Bayesian > User.

Figure 288:Bayesian user tab

2. From Select a domain, select a domain.

This example uses example.net and example.org.

3. In the Operations area, click Train group Bayesian database with mbox files.

A dialog appears:

Figure 289:Bayesian training using a mailbox

4. In Innocent Mailbox, click Browse and locate example-net-not-spam.mbox.
5. In Spam Mailbox, click Browse and locate example-net-spam.mbox.
6. Click OK.

Repeat the above steps for the protected domain example.org and its sample Bayesian database files.

To enable Bayesian scanning

1. Go to Profile > AntiSpam .
2. In the row corresponding to an antispam profile that is selected in a policy that matches recipients in the protected domain example.net, click Edit.
3. Enable Bayesian.
4. Click the arrow to expand Bayesian.
5. Disable the option Use personal database.
6. Enable the option Accept training messages from users.
7. Click OK.

Repeat the above steps for all incoming antispam profiles that are selected in policies that match recipients in the protected domain example.org.

To perform ongoing training of each per-domain Bayesian database

1. Notify email users that they can train the Bayesian database for their protected domain by sending them an email similar to the following:

All employees,

We have enabled a new email system feature that can be trained to recognize the differences between spam and legitimate email. You can help to train this feature. This message describes how to train our email system.

If you have old email messages and spam…

• Forward the old spam to learn-is-spam@example.com from your company email account.
• Forward any old email messages that are not spam to learn-is-not-spam@example.com from your company email account.

If you receive any new spam, or if a legitimate email is mistakenly classified as spam…

• Forward spam that was not recognized to is-spam@example.com from your company email account.
• Forward legitimate email that was incorrectly classified as spam to is-not-spam@example.com from your company email account.

2. Notify other FortiMail administrators that they can train the per-domain Bayesian databases for those protected domains by forwarding email to the Bayesian control accounts, described in the previous step. To do so, they must configure their email client software with the following sender addresses: • default-grp@example.net
   • default-grp@example.org

For example, when forwarding a training message from the sender (From:) email address default-grp@example.net, the FortiMail unit will apply the training message to the per-domain Bayesian database of example.net.