Example: Bayesian training
In this example, Company X has set up a FortiMail unit to protect its email server. With over 1,000 email users, Company X plans to enable Bayesian scanning for incoming email. You, the system administrator, have been asked to configure Bayesian scanning, perform initial training of the Bayesian databases, and configure Bayesian control email addresses for ongoing training.
The local domain name of the FortiMail unit itself is example.com.
Company X has email users in two existing protected domains:
• example.net
• example.org
Each protected domains receives email with slightly different terminology, which could be considered spam to the other protected domain, and so will use separate per-domain Bayesian databases.
To facilitate initial training of each per-domain Bayesian database, you have used your email client software to collect samples of spam and non-spam email from each protected domain, and exported them into mailbox files:
• example-net-spam.mbox
• example-net-not-spam.mbox
• example-org-spam.mbox
• example-org-not-spam.mbox
After initial training, email users will use the default Bayesian control email addresses to perform any required ongoing training for each of their per-domain Bayesian databases.
To enable use of per-domain Bayesian databases
1. Go to Mail Settings > Domains > Domains.
2. Select the row corresponding to example.net and click Edit.
3. Click the arrow to expand Advanced AS/AV Settings.
4. Disable the option Use global Bayesian database.
5. Click OK.
Repeat the above steps for the protected domain example.org.
To initially train each per-domain Bayesian database using mailbox files
1. Go to AntiSpam > Bayesian > User.
2. From Select a domain, select a domain.
This example uses example.net and example.org.
3. In the Operations area, click Train group Bayesian database with email samples.
A dialog appears.
4. In Clean emails, click Browse and locate example-net-not-spam.mbox.
5. In Spam emails, click Browse and locate example-net-spam.mbox.
6. Click OK.
Repeat the above steps for the protected domain example.org and its sample Bayesian database files.
To enable Bayesian scanning
1. Go to Profile > AntiSpam .
2. In the row corresponding to an antispam profile that is selected in a policy that matches recipients in the protected domain example.net, click Edit.
3. Enable Bayesian.
4. Click the arrow to expand Bayesian.
5. Enable the option Accept training messages from users.
6. Click OK.
Repeat the above steps for all incoming antispam profiles that are selected in policies that match recipients in the protected domain example.org.
To perform ongoing training of each per-domain Bayesian database
1. Notify email users that they can train the Bayesian database for their protected domain by sending them an email similar to the following:
| This procedure assumes the default Bayesian control email addresses. To configure the Bayesian control email addresses, go to AntiSpam > Bayesian > Control Account. |
All employees,
We have enabled a new email system feature that can be trained to recognize the differences between spam and legitimate email. You can help to train this feature. This message describes how to train our email system.
If you have old email messages and spam...
• Forward the old spam to learn-is-spam@example.com from your company email account.
• Forward any old email messages that are not spam to learn-is-not-spam@example.com from your company email account.
If you receive any new spam, or if a legitimate email is mistakenly classified as spam...
• Forward spam that was not recognized to is‑spam@example.com from your company email account.
• Forward legitimate email that was incorrectly classified as spam to is‑not‑spam@example.com from your company email account.
2. Notify other FortiMail administrators that they can train the per-domain Bayesian databases for those protected domains by forwarding email to the Bayesian control accounts, described in the previous step. To do so, they must configure their email client software with the following sender addresses:
• default-grp@example.net
• default-grp@example.org
For example, when forwarding a training message from the sender (From:) email address default-grp@example.net, the FortiMail unit will apply the training message to the per-domain Bayesian database of example.net.