Cisco Cisco Email Security Appliance C160 Mode D'Emploi
6-3
Cisco AsyncOS 8.0.1 for Email User Guide
Chapter 6 Reputation Filtering
SenderBase Reputation Service
Figure 6-1
The SenderBase Reputation Service
1.
SenderBase affiliates send real-time, global data
2.
Sending MTA opens connection with the Cisco appliance
3.
Cisco appliance checks global data for the connecting IP address
4.
SenderBase Reputation Service calculates the probability this message is spam and assigns a
SenderBase Reputations Score
SenderBase Reputations Score
5.
Cisco returns the response based on the SenderBase Reputation Score
How SenderBase Reputation Filters Work
Cisco Reputation Filter technology aims to shunt as much mail as possible from the remaining security
services processing that is available on the Cisco appliance. (See
services processing that is available on the Cisco appliance. (See
.)
When enabling reputation filtering, mail from known bad senders is simply refused. Known good mail
from global 2000 companies is automatically routed around the spam filters, reducing the chance of false
positives. Unknown, or “grey” email is routed to the anti-spam scanning engine. Using this approach,
reputation filters can reduce the load on the content filters by as much as 50%.
from global 2000 companies is automatically routed around the spam filters, reducing the chance of false
positives. Unknown, or “grey” email is routed to the anti-spam scanning engine. Using this approach,
reputation filters can reduce the load on the content filters by as much as 50%.
Sending MTA
SBRS Scoring Engine
•Global complaint data
•Global volume data
SenderBase Affiliate Network
1
5
3
4
2
1.2.3.4
HELO
1.2.3.4
Rule hits
SBRS =
x.x
250-Recipient Accepted
or
452-Too many recipients this hour
or
554-Access Denied
for
1.2.3.4
IronPort appliance