Maybe we could put a constraint here, not to remove signature that represent more than 4 lines or more than 50% of the number of lines of the message to limit the number of false positives?