Interesting, but would be nice to hear why they're writing rules to catch this, rather than (or on top of) taking the Bayesian route (as in pg's 'Plan for Spam'[1]).
But any time we get good enough at catching an attack on a given channel, the attackers will switch to a different one - often times one where we haven't seen abuse before, and maybe don't have much good training data. In this case, it takes time to gather the right data and train new models, whereas analysts and engineers can do a reasonable job of stopping the attack in a faster timeframe.
Though interesting, all of this is somewhat orthogonal to what this article is about, though. FXL is the way we define features that are fed into classifiers, and its engine does all the data-fetching necessary to get the values of those features for classification. It also works for just putting rules on top of or next to the ML.
You can find more details in http://research.microsoft.com/en-us/projects/ldg/a10-stein.p...