Introduction

Today, over 95% of all e-mail traffic on the Internet is spam. Spammers have grown increasingly sophisticated, using innovative methods to trick spam filters and penetrate email inboxes. The majority of spam and malware are sent by networks of compromised computers ("botnets") that launch millions of distributed attacks without the user's knowledge. To make matters worse, new classes of spam are extremely difficult to detect and harmful, containing spoofed addresses, rapidly-mutating images and embedded links to malware sites.

Traditional spam filters that rely on static rules, traffic patterns or heuristics have been ineffective against advanced messaging threats due to their slow response time and tendency towards high positives. In order to win the war against spam, businesses must use a real-time defense system that can instantly respond to evolving attack vectors.

Cloudmark accomplishes this through a combination of Advanced Message Fingerprinting™ and the world's largest threat detection network, the Global Threat Network. These components, together with automated analytical processes, drive the system's unsurpassed 98 percent spam filtering accuracy with near zero false positives.

Cloudmark Technology

The core of Cloudmark's solution is its Advanced Message Fingerprinting, which employs high performance fingerprinting algorithms to target different threat attributes embedded in a message. As each message comes in, Cloudmark uses these algorithms to generate a set of "fingerprints" to represent unique aspects of the message. Once a fingerprint has been determined to be associated with a spam, phishing or virus attack, future messages containing that same fingerprint will be automatically blocked. Through this method, Cloudmark is able to identify mutations and variants in real time.

For new outbreaks, Cloudmark provides extremely fast coverage through its Global Threat Network, consisting of over 300 million reporters in 200 countries. With Cloudmark, threat monitoring comes not from employees of an anti-spam company, but from a worldwide network of trusted users, enterprises, honeypots and system administrators. Feedback from these reporters enables Cloudmark to block the latest threats within minutes of attack origination, this approach contributes to faster threat detection and more accurate message classification.

All feedback by the Global Threat Network is corroborated and analyzed by the Trust Evaluation System. This system tracks the reporter's reputation and determines fingerprint classification based on the number of reports and reporter's reputation. Reputation or "trust" is earned over time by consistently reporting correct abuse feedback. Also, since feedback is continuously corroborated, any inaccuracies in message classification, such as false positives or false negatives, are corrected in near real time. No other system offers this kind of feedback review and seamless remediation.

Cloudmark Advantages

• Comprehensive protection against spam, phishing and viruses
• Language and content-agnostic analysis stops spam in all languages (including double-byte characters such as Chinese, Japanese and Cyrillic) and formats, including image spam, .pdf spam and virus executables
• Through 24 x 7 monitoring, the Global Threat Network ensures the fastest response to new spam outbreaks as well as highly-targeted phishing attacks and virus outbreaks
• Advanced Message Fingerprinting algorithms detect variants and rapidly mutating attacks before they reach e-mail inboxes
• Automatic remediation of false negatives or false positives through continuous administrator and user feedback
• Cache of threat fingerprints is updated every 60 seconds for protection against the latest attacks

Administrator and User Controls

• Email users can add senders, domains, and IPs to their safelist to ensure that email from these senders is never filtered as spam
• Email users can add senders, domains, and IPs to their blacklist to ensure that email from these senders is always filtered as spam
• Email users have several options for handling email once it is flagged as spam
• Email users can choose the exclusive setting, which allows them to block email from senders outside of their safelist
• Email administrators can also manage global spam preferences, safelists, and blacklists at the domain and the user level