snf_engine.xml

<node/> - <gbudb/>

<regions/>

The regions section defines how IP reputation statistics will be interpreted by GBUdb. This interpretation is based on the concept of a two dimensional graph with a set of envelopes ploted on it - each envelope describing the limits of a region. All of the IPs whose statistics fall in a particular region are considered to be the same "kind" of IP for the purposes of filtering messages.

There are three primary regions defined for GBUdb, and two secondary regions. The primary regions are:

• White - IPs that fall in the white region are expected to provide only good messages.
• Caution - IPs that fall in the caution region are suspicious. There is little information about these IPs, they are relatively new or rare, and they appear to deliver mostly bad messages. By and large the IPs that fall in this region belong to new spam sources.
• Black - IPs that fall in the black region are notorious (and relatively well known). These IPs consistently deliver messages that are spam.

The two secondary regions are:

• Normal - IPs that don't fall in any other region fall in the normal region by default. These IPs are unremarkable. They may deliver some spam but not enough that we can be sure they are bad message sources. They may deliver some good messages too but not so many that we can be certain they are good sources. These IPs are "ordinary" - normal.
• Truncate - A slice of the black region is defined as the truncate region. IPs that fall in this region are so consistently bad that it is safe to reject or delete their messages without looking at the content.

The GBUdb regions can be described graphically by plotting the probability figure across the top along the X axis and the confidence figure down the side on the Y axis.

Please email support@armresearch.com with any questions.