Cloudmark Re-Launches Innovative Service

Cloudmark's recently announced ActiveFilter service fights spam in a way that, as far as we know, is unique.

by Alex Goldman ISP-Planet Managing Editor [July 14, 2008]

Botnets can infect the world in fifteen minutes, and these days, that's about all the time they have. After those fifteen minutes, anti-spam companies put the filters and signatures in place to stop the spread of the infection.

There are many, many anti-spam companies out there. ISP-Planet's Anti-Spam Directory lists the 43 companies that we know offer services to ISPs, but there are over 200 companies in the anti-spam space, and we don't know all of them. That said, we think that Cloudmark's Active Filter service is unique.

In its release of Cloudmark 2.0 last year, the San Francisco-based company took what might seem an obvious next step and re-scanned mail stores after an outbreak. It was a good idea, but ISPs did not like the toll it took on the MTA.

Filter 2.0
Jamie de Guerre, Cloudmark CTO, notes that most users check e-mail a few times each day, but not every 15 minutes. "The big battle in this space has been all about speed," he says. "The attackers try to get the message through before being blocked by the service providers. Spammers have a new weapon. Spammers now have huge bot networks that can deliver a short, bursty attack on an operator."

"Active Rescan was more efficient than pulling the whole message from the message store, but it still had performance issues. Our customers told us we needed to be more efficient. What we came up with is what we're calling Active Filter. Instead of a pulling mechanism, we've changed to a push mechanism."

When those new signatures arrive, they tell the ISP that a message received recently with specific characteristics is the latest spam or phishing attack. The Cloudmark software sends that note to a special out of band index that Cloudmark has already created. The software scans the index, using the new signature, and finds spam messages that are in the mail store but have not yet been read. Scanning the index, instead of scanning the mail store, allows Cloudmark to avoid slowing down e-mail delivery.

Cloudmark has chosen not to delete any messages that have already been read, but de Guerre notes that the company is considering doing that, or allowing the ISP to notify their own customer that they received a bad message. "We want to focus on delivering a positive user experience," he says. "This is our initial, conservative launch. We do not want to confuse or upset the user, so we're only touching messages the user has not had the opportunity to see."

ISPs have told Cloudmark that the service must not effect regular e-mail. Cloudmark's index holds data on the most recent six hours of e-mail. Since most attacks are defeated in 15 minutes, that's a lot more than the company needs to store, but the extra capacity is there in case anything unusual happens. "Six hours," de Guerre says, "is a lifetime for internet attacks."

Results
The results are good, he adds. He says that Active Filter catches about 70 to 80 percent of what Cloudmark misses. The company claims 98 percent accuracy without Active Filter, and simple math tells you that the company gets 99.4 to 99.6 percent accuracy with Active Filter.

The difference between 98 percent accuracy and 99.4 percent may not sound like much, but think of it this way: it's the difference between 2 percent of spam getting though and 0.6 percent of spam getting through. With Active Filter, Cloudmark's effectiveness triples—at the very least.

de Guerre says that besides the obvious customer satisfaction improvement, reducing spam saves the ISP money by shrinking the mail store. "It's estimated that more than 15 percent of the typical ISP's mail store is consumed by spam messages alone."

— End