Cisco Cisco Web Security Appliance S690 User Guide
W E B R E P U T A T I O N S C O R E S
C H A P T E R 1 4 : W E B R E P U T A T I O N F I L T E R S
311
WE B R E P U T A T I O N S C O R E S
Web Reputation Filters use statistically significant data to assess the reliability of Internet
domains and score the reputation of URLs. Data such as how long a specific domain has been
registered, or where a web site is hosted, or whether a web server is using a dynamic IP
address is used to judge the trustworthiness of a given URL.
domains and score the reputation of URLs. Data such as how long a specific domain has been
registered, or where a web site is hosted, or whether a web server is using a dynamic IP
address is used to judge the trustworthiness of a given URL.
The web reputation calculation associates a URL with network parameters to determine the
probability that malware exists. The aggregate probability that malware exists is then mapped
to a Web Reputation Score between -10 and +10, with +10 being the least likely to contain
malware.
probability that malware exists. The aggregate probability that malware exists is then mapped
to a Web Reputation Score between -10 and +10, with +10 being the least likely to contain
malware.
Example parameters include the following:
• URL categorization data
• Presence of downloadable code
• Presence of long, obfuscated End-User License Agreements (EULAs)
• Global volume and changes in volume
• Network owner information
• History of a URL
• Age of a URL
• Presence on any block lists
• Presence on any allow lists
• URL typos of popular domains
• Domain registrar information
• IP address information
Note — IronPort does not collect personally identifiable information such as usernames,
passwords, or client IP addresses.
passwords, or client IP addresses.