Proofpoint Dynamic Reputation and netMLX

Features:

High-performance Email Reputation and Connection Management

Unlike reactive, static reputation services that are forced to make critical trade-offs between connection shed rates, detection accuracy and response time, Proofpoint Dynamic Reputation delivers the highest performance in all three areas at once:

• Rapid response times: The Proofpoint Attack Response Center collects information on millions of IP addresses, using data collected from Proofpoint honeypots, customer sites and other sources. Proofpoint netMLX machine learning algorithms continually parse hundreds of data points for all IP addresses in real-time to generate extremely timely, accurate network reputation scores. Because scores are updated every minute, Proofpoint Dynamic Reputation reacts to new spam sources, such as botnets, up to an order of magnitude faster than competing email reputation solutions.
   
• Highest connection management and anti-spam accuracy: Proofpoint netMLX processing of hundreds of reputation-related attributes at the global level ensures that Proofpoint Dynamic Reputation always has access to the most comprehensive, accurate assessment of IP address reputation. False positive rates are less than one in one million. Proofpoint Dynamic Reputation delivers maximum load shedding and advanced connection management in front of Proofpoint's formidable 99%+ accuracy anti-spam features. Proofpoint Machine Learning Technology(MLX™) correctly identifies 99.8% of spam messages. View chart that shows the general level of effectiveness that Proofpoint delivers to customers in actual deployments. While the volumes and types of spam that hit each customer system are unique, Proofpoint MLX technology delivers extremely accurate defense against all types of spam and all customers experience very similar levels of protection to those shown in the chart.
   
• Anti-spam performance and efficiency gains: Proofpoint Dynamic Reputation and netMLX can block more than 80% of all inbound connections, radically reducing inbound email volumes and protecting organizations against rapidly-rising spam volumes-without installing additional hardware.

Technology:

Combines the Best of Local and Global IP Reputation

All Proofpoint appliances and software deployments provide built-in, predictive, behavioral analysis of local IP traffic that responds in real-time to eliminate email traffic spikes and block or throttle malicious connections from botnets.

Customers with high email volumes can add enhanced protection to their Proofpoint deployments to further reduce connection volumes at the network edge. This protection is provided by Proofpoint netMLX reputation analysis technology, a global machine learning fabric built over and extending the machine learning technology that powers each Proofpoint customer deployment.

Proofpoint netMLX creates the industry's most accurate and up-to-date database of reputation for IP addresses sending email across the Internet, allowing each customer site to benefit from the network effect provided by Proofpoint's real-time, machine learning analysis of global sender behavior.

Each minute, hundreds of data points for all IP addresses are parsed with advanced machine learning algorithms to generate a score that represents the sender's reputation, whether positive or negative. Proofpoint Dynamic Reputation then uses these scores, combined with local behavioral data, to make intelligent decisions about accepting, throttling or rejecting incoming email connections.

Most accurate IP reputation
Proofpoint Dynamic Reputation analyzes a wide array of reputation related attributes, including:

• SPF (standard, best guess)
• Percentage of spam, virus, phish and invalid recipients associated with IP
• URL and domain block lists
• DHCP addresses (zombies, botnets)
• Image history (fuzzy matching)
• Recipient list sizes
• Hundreds more

Compare:

Why Choose Proofpoint Dynamic Reputation?

Proofpoint Dynamic Reputation is a connection management solution that is the industry's most:

• Innovative: The world's first dynamic, machine learning-based global email reputation solution.
• Unique: Combines local, predictive behavioral data and globally-observed reputation for maximum protection against malicious IP addresses.
• High-performance: Capable of blocking more than 80% of connections with less than 1 in 1 million false positive rate.
• Rapid response: One minute refresh rate ensures fastest response to new botnets or spam IPs; rapid, "self-annealing" behavior once IP addresses return to non-malicious behavior.
• Accurate: netMLX machine learning technology analyzes hundreds of reputation-related attributes for each connection, providing maximum accuracy. Boosts the 99%+ anti-spam accuracy of Proofpoint MLX to even higher levels.
• Flexible: Customize rate control and traffic shaping policies based on your organization's unique needs.

Add the Power of Proofpoint Dynamic Reputation to Any Appliance
The advanced connection management and IP reputation features of Proofpoint Dynamic Reputation are also available "in the cloud." Proofpoint Shield is a SaaS solution that works in conjunction with any email security appliance—making it easy to realize the advantages of a “hybrid” on-demand/on-premises email security deployment. It reduces the volume of email reaching your organization’s on-premises appliances by up to 90%, moving connection management and front-line anti-spam features into the cloud.

Diagram:

Proofpoint's unique approach to reputation and connection management

Screenshots:

Documentation:

Download the Proofpoint Dynamic Reputation Datasheet (PDF).