The SenderBase Network

Cisco has acquired Ironport. Please visit our Cisco site for the latest re-branded Ironport products.

Take control with Cisco IronPort SenderBase®, the world’s largest email and web traffic monitoring network. With data on more than 30 percent of the world’s Internet traffic, the Cisco IronPort SenderBase Network:

• Delivers an exceptional real-time view into security threats from around the world
• Provides comprehensive data to differentiate legitimate senders from spammers and other attackers
• Gives email administrators visibility into who is sending them email

Cisco IronPort Email Security Appliances

Enterprise email security customers use the power of Cisco IronPort SenderBase through Cisco IronPort Reputation Filters and the SenderBase Reputation Score (SBRS). This score summarizes Cisco IronPort SenderBase data into a single method of indicating the threat level for each incoming message.

Early Virus Outbreak Protection

Cisco IronPort SenderBase data also powers Cisco IronPort Virus Outbreak Filters. This preventive security solution protects customers’ hours before traditional anti-virus vendors publish signatures.

Cisco IronPort Web Security Appliances

Enterprise web security customers employ the power of Cisco IronPort SenderBase through Cisco IronPort Web Reputation Filters and the Web Reputation Score (WBRS). This score summarizes Cisco IronPort SenderBase data into a single method of indicating the threat level for each URL.

Up-to-Date Web Protection

Cisco IronPort SenderBase data also powers Cisco IronPort Exploit Filters and Cisco IronPort URL Outbreak Detection. These preventive security services protect customers from the latest and most dangerous web threats.

The Cisco IronPort SenderBase Network comprises 120,000
contributing organizations and 5 billion daily queries for
exceptional visibility.

How Cisco IronPort SenderBase Works:

Identify Threats First

Cisco IronPort SenderBase collects data on more than 30 percent of the world’s email and web traffic. This network data is more than 10 times larger than that of other monitoring systems. The volume provides a statistically significant sample size, resulting in immediate and accurate detection of even low-volume email senders and URLs.

Immense Worldwide Information

A highly-diverse group of more than 120,000 organizations, including the largest networks in the world, contributes information to Cisco IronPort SenderBase on a remarkable 5 billion messages per day. The Cisco IronPort SenderBase Network gives email administrators exceptional real-time visibility into security threats from around the world.

Get the Whole Picture

Breadth of data is important in making accurate decisions about security threats. Looking at a narrow set of data can lead to high false-positive rates.

False-Positive Example

As an example, volume is one parameter often considered. High volumes of mail correlate very well with spam. But there are legitimate instances of high volumes, such as senders’ delivering breaking news alerts.

More Parameters for More Accuracy

In our example, therefore, if volume alone were the metric, many legitimate mail streams would be blocked. But when volume is examined along with other parameters, such as end-user complaint data, zombie characteristics, and country of origin, a much more accurate conclusion can be reached.

The Industry’s Most Comprehensive Set of Data

Cisco IronPort SenderBase examines the broadest set of data in the industry, currently examining more than 200 different parameters about email and web traffic. Parameters tracked include:

• Global sending volume
• Complaint levels
• Spam trap accounts
• Country of origin
• Blacklist information
• Open proxy status
• Valid and invalid recipients

Cisco IronPort SenderBase also evaluates whether a sender’s Domain Name System (DNS) resolves properly and accepts return mail. In addition, it determines the probability that URLs are appearing as part of a spam or virus attack, as well as the use of hijacked IP space.

Never before has it been so easy to distinguish safe from dangerous messages in one place.

Require the Highest Data Quality

The Cisco IronPort operational experience includes more than eight years of managing data quality and integrity. The Cisco IronPort Data Quality Engine:

• Assesses a given data feed by cross-correlating different data streams with known references or benchmarks
• Allows Cisco IronPort SenderBase to access even “dirty” data streams and still derive some value by properly weighting the data according to quality
• Conducts periodic data calibrations and manual spot checks

Documentation:

Download the IronPort SenderBase Network Overview Data Sheet (PDF).