Barracuda Networks' Use of Machine Learning on Databricks Lakehouse for Phishing Attack Prevention

Barracuda Networks is a global leader in security, application delivery, and data protection solutions. The company is dedicated to detecting phishing attacks and providing comprehensive email security protection to its customers. They work on top of Microsoft Office 365 and analyze the email stream for any possible threats. One of the key products that Barracuda offers is impersonation protection, which is focused on deterring targeted phishing attacks. The company serves thousands of customers, protecting millions of mailboxes from tens of thousands of malicious emails daily.

Barracuda Networks, a global leader in security, application delivery, and data protection solutions, was faced with the challenge of handling sophisticated phishing emails. The company had built a powerful artificial intelligence engine that uses behavioral analysis to detect attacks and keep malicious actors at bay. However, the sophistication of attackers in creating malicious emails posed a significant challenge. The company needed to assess and identify malicious messages to protect their customers. Additionally, Barracuda Networks offered impersonation protection, a service that prevents malicious actors from disguising their messages as coming from an official source. However, these targeted phishing attacks required the attacker to have personal details about the recipient, making them harder to detect and block. Furthermore, Barracuda faced difficulties with feature engineering. They needed to utilize the right data and do feature engineering on top of that data, which included email text and statistical data. Before the Databricks integration, building features was more difficult with the labeled data spread over multiple months, particularly with the statistical features. Also, keeping track of the features when the data set grew in size was challenging.

Barracuda Networks leveraged machine learning on the Databricks Lakehouse Platform, specifically using the Databricks Feature Store and Managed MLflow, to improve the ML process and deploy better quality models faster. The Databricks Feature Store served as the single repository for all of the features used by the Barracuda team. It allowed them to create and maintain statistical features that are constantly updated with fresh batches of incoming emails. The Feature Store is built on top of Delta, which eliminated extra processing required to convert labeled data to features, and the features remained current. Features were kept in an offline repository, and snapshots of this information were then released online for use in online inferencing. By integrating Databricks Feature Store with MLflow, these features could be readily called from the models in MLflow, and the model could obtain the feature concurrently with the feature retrieval when the e-mail comes through for inferencing. With MLflow, the team could move all the code inside the model, making it simpler and faster to infer. This capability greatly reduced the time the team spent developing ML models.

• The integration of Databricks Lakehouse Platform into Barracuda Networks' operations has resulted in a more efficient and effective phishing attack detection and prevention system. The use of the Databricks Feature Store and Managed MLflow has simplified the process of feature engineering and model deployment, allowing the team to move faster and block more malicious emails. The system's improved efficiency has also resulted in a higher detection rate, leading to improved customer protection and satisfaction. The team is now able to publish a new table frequently in Delta, update the features every day, and use these to determine whether an incoming email is an attack or not. The team is looking forward to continuing to implement new Databricks features to enhance their customers' experience further.

• Barracuda is now blocking tens of thousands of malicious emails daily from reaching millions of mailboxes across thousands of customers.
• The team can now move much faster with the help of Databricks Lakehouse Platform.
• The use of Databricks Feature Store and Managed MLflow has greatly reduced the time the team spends developing ML models.