What is the difference between Intent, Real-time,Multi-level, and ZeroHour Intent filtering on the Barracuda Spam Firewall?

Solution #00004872

Scope:

Applies to all Barracuda Spam Firewalls.

Answer:

Unlike traditional antivirus solutions, which perform analysis against data stored on a single system, Barracuda Real-Time Protection is based on data collected from thousands of global honeypots and Barracuda Spam Firewalls across the Internet. This data consists of binary signatures, or ‘fingerprints,’ for message components such as message bodies, email attachments and inline images. Zero-Hour Intent matches URIs in message bodies. When unknown fingerprints are detected, the Barracuda Spam Firewall submits these fingerprints in real-time to Barracuda Central. When these fingerprints are growing in a viral or otherwise spam-like pattern, your barracuda blocks these Messages for Zero Hour Intent.

After identifying these URIs as spam outbreaks, Barracuda Central updates the spam definitions downloaded by the Barracuda Spam Firewall through Energize Updates. Upon the next Energize Update, the Barracuda Spam Firewall can block the spam variants associated with the new outbreak via the Barracuda Spam Firewall’s traditional protection layers.

The Intent Analysis layer of the Barracuda Spam Firewall performs analysis for all domains and URLs inside of email messages to identify links pointing to spam websites.

The Barracuda Spam Firewall stores a local database of these spam patterns as part of the energize update process. The local database is updated several times per hour.

Unfortunately, spam attacks are frequently launched using new domains that have never been associated with spam. Due to this dynamic nature of spam, there is a small window of opportunity for spam to get through in between the energize updates.

Enter the Real-time Intent analysis. This analysis step on the Barracuda Spam Firewall checks a real-time server at Barracuda Central. The Real-time Intent analysis allows the identification of any new domains that have been identified in emerging spam campaigns. Real-time Intent focuses on the name servers that belong to the domains in question. It will analyze them for known spam tactics and ensure they are not malicious. This provides Barracuda Networks customers continuous coverage from the activities of spammers.

Link to this page:

https://campus.barracuda.com/solution/50160000000IH6cAAG