MX Logic EDS Technology - Comprehensive Filtering
Managed Email Security, Message Archiving & Web Security Services

MX Logic ensures industry-leading filtering accuracy using a multilayered strategy that combines more than 20 forms of spam, virus, content, attachment, and email attack filtering technology.

Primary to the effectiveness of the MX Logic® Email Defense Service is our Stacked Classification Framework® spam detection system, which is powered by patented technology and combines the most effective spam-fighting filters and techniques in the industry.

Through an aggregation and analysis of spam-likelihood scores, our solution blocks over 99 percent of spam while maintaining industry-leading low false positive rates (legitimate email misidentified as spam). As new techniques and filters are developed, we add them to the Framework, further ensuring spam-filtering effectiveness.

The MX Logic Email Defense Service received five stars, the highest available rating, in the VeriTest Anti-Spam Benchmark Service™ Summer 2005 Report. The high rating was a result of the solution’s performance in the vendor-tuned portion of the independent test, in which it posted a 99.76 percent Spam Capture Rate. MX Logic posted a Spam Capture Rate of 99.71 in the "out-of-the-box" configuration.

Filtering specifically for spam, our layers include:

• IP Reputation Connection Manager: This filter operates at the front of the Stacked Classification Framework and rates the reputation of every incoming message, based on IP reputation data collected on an on-going basis by MX Logic. Connections are dropped for all messages which originate from IP addresses that are determined to carry a reputation for sending spam.
• Deep Content Analysis: This filtering module enables MX Logic to protect customers from increasing volume of messages that carry infected attachments. The filter blocks the most prevalent attachment-based spam, PDF spam, but has also been developed with the infrastructure necessary to address any future attachment spam variations. PDF spam specifically is the latest generation of image spam using graphics instead of other masking techniques to conceal an unsolicited advertisement's call to action. With PDF Spam, the images are embedded within attached .pdf documents instead of within the body copy of the message. The Deep Content Analysis filter enables MX Logic to analyze the content of the attachment to determine if it contains spam or malware before the message can reach the customer’s network.
• Premium Anti-Spam Multi-Language: This filter provides MX Logic with a global view of spam traffic, which enables us to defend against real-time spam attacks and rapidly identify zero-hour spam, regardless of language. The filter is also effective at identifying image-based spam and phishing emails, and is continually updated based on real-time feedback provided by a global network of users.
• Statistical Filtering: MX Logic's probabilistic filtering utilizes a statistical Bayesian algorithm to determine the probability that an email message is spam based on how often elements in that message have appeared in other spam emails.
• Sender Policy Framework (SPF)/Sender ID: For inbound messages, MX Logic can check if the message has an associated SPF/Sender ID record. If there is an SPF/Sender ID record, it can help determine if the email sender’s domain is from a list of IP addresses authorized to send email from that domain.
• Proprietary Heuristics: MX Logic experts write and update thousands of proprietary rules to block spam using real-time data from the MX Logic® Threat Center.
• Reputation Analysis: Reputation analysis votes on the probability that the message is spam based on comprehensive information about the source of the message - rating the reputation of the sender based upon the percentage of spam messages sent from that IP address in the past.
• URL filtering: URL filtering works by comparing embedded links found in email messages with URLs associated with identified spam.
• Reputation-based RBL filtering: Within the Stacked Classification Framework, MX Logic compares a message’s sending IP address against those on key real-time blackhole lists (RBLs), which are associated with known spammers and are considered fraudulent.

MX Logic also integrates the following domain-level allow and deny lists and distributed deny lists into its comprehensive service to fight spam and other email threats:

• Distributed blackhole lists: Providing exceptional protection against spam, distributed blackhole lists comprise a number of real-time subscription services and MX Logic global deny lists, which include multiple lists of known spammers and their IP addresses.
• Recipient deny lists (Address): This type of filtering is designed specifically to filter for content and relieve network servers from attempting repeatedly to deliver mail to invalid addresses.
• Domain-level allow and deny lists: Specifically designed to protect against spam, inappropriate content, and email attacks, domain-level allow and deny lists filter and block unsolicited messages.
• User-level allow and deny lists: Through regularly-delivered MX Logic Spam Quarantine Reports, end users have the flexibility to develop their own, personal allow and deny lists.

Virus and Worm Filtering Layers MX Logic's virus and worm detection technology leverages the combination of a proprietary worm analysis engine along with three industry-leading anti-virus engines to provide defense-with-diversity protection.

• Proprietary worm filtering: Through sophisticated content behavior analysis, our proprietary WormTraq® worm detection technology rapidly identifies and intercepts zero-hour mass mailing worms before they enter or leave a corporate network.
• Leading signature-based virus scanning engines: MX Logic leverages leading signature-based virus scanning engines with a combination of protection from Authentium®, McAfee® and Sophos®. Our technology detects, quarantines, blocks and strips viruses and worms at the network perimeter before they can enter and damage a customer's corporate messaging infrastructure.

Email Attack Protection Layers
To protect businesses against spammer intrusion, MX Logic incorporates sophisticated email attack protection into its filtering layers.

• Denial of Service (DoS) Attack Protection: Using Email Attack Protection, MX Logic defends business networks from unplanned outages associated with DoS attacks. This feature detects the excessive SMTP "chatter" associated with these machine-generated, large scale attacks and blocks them from attempting to overwhelm unprotected networks.
• Directory Harvest Attack (DHA) Protection: This feature defends networks against DHAs, which run through possible alphanumeric combinations or predefined dictionaries to identify valid email addresses on a target domain.

Content and Attachment Filtering Layers
MX Logic incorporates the following filtering techniques to control unwanted email content and attachments, in order to protect your business integrity and reduce legal liability:

• Keyword filtering: Content filtering technology evaluates the content of all messages based on the policies and associated actions configured by the enterprise.
• Attachment filtering: Attachment filtering blocks unwanted attachments by size, by MIME media type (.exe, .vbs, .mp3, etc.), and by binary content before they enter or exit the corporate network.
• Archive and compressed file integrity filtering: Protecting businesses from the bandwidth-draining effect of dangerously-sized malicious archive files (e.g., .zip) that can lock up messaging servers, MX Logic detects suspicious compression ratios or suspected nested archives in attachments and strips the file to prevent possible network outages.
• Spam beacon and web bug detection and blocking: This technique protects networks from intrusive, almost imperceptible tags embedded in HTML that give spammers confirmation and information about targeted end users.
• Multi-level HTML content protection: Because malware can now take many forms, MX Logic protects its business clients with multi-level HTML content protection. This feature filters suspect HTML, JavaScript, ActiveX and applets based on defined policies.
• Fraud protection: Using a combination of industry-leading spam-fighting methods, phishing emails are identified and filtered before they reach the business email network and dupe unsuspecting recipients into releasing personal or business-related information