E-mail security appliance uses profiling to thwart spammers' tricks

Barracuda Networks enhances reputation analysis technology with behavior data

Barracuda Networks on Tuesday announced new features for its Spam Firewall e-mail security appliance that help detect spam even when senders attempt to hide their identity.

One new feature is predictive sender profiling, a technique that relies on Barracuda’s network of 40,000 customer in-boxes to analyze sender behavior and detect when a spammer is trying to evade reputation systems by hiding behind another sender’s identity, according to company officials.

The company says spammer-identity obfuscation will be as big a trend in 2007 as image spam was in 2006.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Barracuda Networks on Tuesday announced new features for its Spam Firewall e-mail security appliance that help detect spam even when senders attempt to hide their identity.

One new feature is predictive sender profiling, a technique that relies on Barracuda’s network of 40,000 customer in-boxes to analyze sender behavior and detect when a spammer is trying to evade reputation systems by hiding behind another sender’s identity, according to company officials.

The company says spammer-identity obfuscation will be as big a trend in 2007 as image spam was in 2006.

Spammers’ ability to forge the “from” aspect of an e-mail means that reputation analysis of a sender isn’t always effective. Barracuda’s new features augment reputation analysis with behavior profiling.

This profiling determines when a single network address is suddenly sending large volumes of e-mail, an event that usually signals the PC has been taken over by a botnet and turned into a spam server, officials say. It also automatically rejects SMTP connection attempts to send e-mails to a large number of invalid recipients; this could indicate a possible directory harvest attack where a spammer trolls for legitimate e-mail addresses by sending out message blasts to guessed-at e-mail addresses and noting which ones do not give an invalid address notice in response.

Barracuda’s predictive sender profiling also determines when e-mail blasts are coming from newly created domains -- another sign of spam -- by leveraging the company’s database of domain reputations. The company’s multilevel intent analysis can follow URL redirections from free Internet services and analyze the reputation of the location where the visitor is being sent, officials say.

The company combines these new services with the other filtering measures of its appliance – including reputation analysis, white- and blacklisting, sender authentication, Bayesian analysis, and a spam rules-scoring engine -- to block the most spam possible.

The new predictive sender profiling features are included with Barracuda’s Spam Firewall at no additional charge. The appliance starts at $1,500, with no additional per-user pricing. It is available in six models that can handle 1,000 to 30,000 users.

Read more about security in Network World's Security section.