Proofpoint Spam Detection

Features:

Multilayered spam prevention for maximum effectiveness
Proofpoint Spam Detection provides robust, yet simple to manage, protection from spam by combining the most effective spam prevention technologies into one cohesive, easy-to-manage system. Proofpoint's multilayered spam defense combines connection analysis, local and global reputation, and advanced statistical content analysis techniques. Proofpoint Spam Detection inspects hundreds of thousands of attributes in incoming email messages-including sender IP addresses, message envelope headers and structure, image attributes, and sender reputation data as well as unstructured content in the body of messages-to accurately classify spam with extremely high confidence.

Proofpoint Spam Detection provides protection across multiple layers to eliminate traffic spikes caused by spam attacks and to ensure that end-user mailboxes stay spam free:

• Connection Level Analysis
  The Proofpoint Email Firewall™ provides a stateful, first line of defense against spam by testing numerous connection-level data points including DNS, MX record verification, SPF, recipient verification, Dynamic Reputation™ information and optional netMLX data. Proofpoint Dynamic Reputation technology constantly monitors SMTP connections at the IP address level, looking for suspect or malicious activity. Based on this analysis, SMTP rate control is used to automatically block or throttle malicious connections, providing outstanding protection against directory harvest and denial-of-service attacks while shedding 30% to more than 80% of inbound connection load.
   
• Contextual, Lexical and Image-based Analysis
  Proofpoint MLX technology examines the content and context of messages using structural tests, English and foreign language inspection, pornography detection, malicious (spyware/phishing/pharming) URL detection, targeted rules for detecting phish attacks, image analysis, reputation analysis and any custom policies you have defined. Proofpoint's machine learning technology is uniquely suited to recognizing and filtering spam across many different languages. With full support for double-byte languages, Proofpoint MLX provides outstanding protection against even hard-to-detect Asian language spam. Proprietary image analysis techniques included in Proofpoint MLX identify image-based spam that other solutions fail to catch.
   
• Bounce Management
  Backscatter—the barrage of non-delivery report messages (NDRs) and auto-responses caused by spammers spoofing an organization’s email addresses—has become an increasingly serious problem for most organizations. Proofpoint supports the latest BATV (Bounce Address Tag Validation) specification to tag outbound messages and to validate incoming NDRs against those tags to block backscatter. In addition, Proofpoint MLX techniques block invalid NDRs in cases where BATV isn't or can't be used (e.g., in the case of email forwarded from external domains). Proofpoint's bounce management features block 100% of "backscatter" spam.
   
• End-user Configuration
  Checks personal safe and blocked lists for valid and invalid senders.
   
• Administrator Customization
  Checks global safe and blocked lists and any custom-created spam rules; global lists override end-user lists.

Technology:

Proofpoint MLX provides complete confidence in defeating spammers
Proofpoint MLX technology goes far beyond the capabilities of competing anti-spam solutions. MLX is far superior to simple statistical techniques such as Bayesian filters—and it doesn't rely on signatures or fingerprinting techniques, which are easily fooled by spammers. It turbocharges traditional techniques with advanced machine learning technologies such as logistic regression and information gain analysis. The result is the highest spam detection rates in the industry.

How MLX works for spam detection

• The process begins at the Proofpoint Attack Response Center, where tools developed by Proofpoint scientists and engineers analyze millions of spam messages and distill them into hundreds of thousands of spam attributes-exposing the underlying characteristics and emerging techniques of current and future spam.
   
• These attributes are fed into sophisticated, machine learning algorithms such as logistic regression and information gain analysis. The attributes are dynamically balanced so the system understands how important any particular attribute is during the final message classification process.
   
• This information is then packaged in the form of the Proofpoint MLX Engine and automatically delivered to Proofpoint customers.
   
• Locally, the Spam Detection module examines multiple structural and content layers, extracting attributes from each incoming email. Then advanced machine learning algorithms compute a final spam score that dictates what action to take.
   
• Proofpoint's Attack Response Center continually trains the MLX Engine based on new attacks and feedback from deployed Proofpoint systems, constantly retuning for maximum accuracy.

Proofpoint MLX technology can also be enhanced with advanced connection management features, powered by Proofpoint's netMLX global reputation database. See the Dynamic Reputation and netMLX page for more information

Compare:

Enterprise Spam Detection
Only Proofpoint's Spam Detection module addresses the unique needs of large enterprise customers. Unlike repurposed hosted or consumer solutions-or hard-to-manage, client-side software deployments-Proofpoint's solution:

Proofpoint Spam Detection:

• Eliminates spam at the gateway
• Is flexible and adaptable to corporate characteristics and industry terms
• Meets your enterprise's messaging strategy and scaling requirements
• Allows you to easily administer and enforce global, group, and individual spam policies to meet the unique needs of different email users in your organization
• Delivers extremely low false positive rates and extensive end-user controls ensure that your mission-critical business communications are always available
• Is continually and automatically updated to provide maximum protection against even the newest and most evasive forms of spam, including image-based and foreign-language spam

Outstanding End-user Control
Proofpoint provides end-users with easy, "self service" control over their personal anti-spam preferences through features including:

• Personalized quarantines and quarantine digest reports
• Personalized safelists and blocklists
• Web-based quarantine and profile administration
• Ability to opt in and out of different spam policies (as permitted by administrator configurable settings)

Multiple language support makes Proofpoint ideal for today's global enterprise. End-user interfaces for message digests, and web-based quarantine are available in Chinese, Dutch, English, German, Finnish, French, Italian, Japanese, Portuguese, Russian, Spanish and Swedish.

Diagram:

How Proofpoint Spam Detection Works

Chart:

The chart below shows actual anti-spam effectiveness for Proofpoint Spam Detection over the last 190 days

Proofpoint MLXTM Machine Learning Technology

Proofpoint Spam Effectiveness for the last 190 days
Percent Spam Effectivess
Dates

What does this chart show?

This chart shows the daily effectiveness of Proofpoint Spam Detection, measured against Proofpoint’s global network of spam “honeypots,” which collect millions of unique spam messages per day. For each day, the value shown represents the percentage of messages in Proofpoint’s honeypots that are correctly identified as spam. So, a data point at 99.8 indicates that, on that day, Proofpoint MLX technology correctly identified 99.8% of spam messages, almost spam-free!

The chart shows the general level of effectiveness that Proofpoint delivers to customers in actual deployments. While the volumes and types of spam that hit each customer system are unique, Proofpoint MLX technology delivers extremely accurate defense against all types of spam and all customers experience very similar levels of protection to those shown above.

In many real-world deployments, Proofpoint provides even higher effectiveness against spam. The effectiveness data above considers only the content scanning accuracy of the Proofpoint MLX spam detection engine. In real-world deployments, the additional spam protection afforded by Proofpoint Dynamic Reputation and netMLX can boost effectiveness even higher.

Is your current anti-spam solution providing this level of protection?

If your organization’s current email security solution doesn’t provide this high level of protection, contact Proofpoint for a free spam audit, which will help you understand the volume of spam that your existing anti-spam solution is failing to detect and provide you with valuable information to help build the business case for moving to Proofpoint.

Documentation:

Download the Proofpoint Spam Detection Datasheet (PDF).