Cisco Cisco Web Security Appliance S170 사용자 가이드
12-5
AsyncOS 8.1 for Cisco Web Security User Guide
Chapter 12 Configuring Security Services
Overview of Anti-Malware Scanning
Understanding How the DVS Engine Works
The DVS engine performs anti-malware scanning on URL transactions that are forwarded from the Web
Reputation Filters. Web Reputation Filters calculate the probability that a particular URL contains
malware, and assign a URL score that is associated with an action to block, scan, or allow the transaction.
Reputation Filters. Web Reputation Filters calculate the probability that a particular URL contains
malware, and assign a URL score that is associated with an action to block, scan, or allow the transaction.
When the assigned web reputation score indicates to scan the transaction, the DVS engine receives the
URL request and server response content. The DVS engine, in combination with the Webroot and/or
Sophos or McAfee scanning engines, returns a malware scanning verdict. The DVS engine uses
information from the malware scanning verdicts and Access Policy settings to determine whether to
block or deliver the content to the client.
URL request and server response content. The DVS engine, in combination with the Webroot and/or
Sophos or McAfee scanning engines, returns a malware scanning verdict. The DVS engine uses
information from the malware scanning verdicts and Access Policy settings to determine whether to
block or deliver the content to the client.
Working with Multiple Malware Verdicts
The DVS engine might determine multiple malware verdicts for a single URL. Multiple verdicts can
come from one or both enabled scanning engines:
come from one or both enabled scanning engines:
•
Different verdicts from different scanning engines. When you enable both Webroot and either
Sophos or McAfee, each scanning engine might return different malware verdicts for the same
object. When a URL causes multiple verdicts from both enabled scanning engines, the appliance
performs the most restrictive action. For example, if one scanning engine returns a block verdict and
the other a monitor verdict, the DVS engine always blocks the request.
Sophos or McAfee, each scanning engine might return different malware verdicts for the same
object. When a URL causes multiple verdicts from both enabled scanning engines, the appliance
performs the most restrictive action. For example, if one scanning engine returns a block verdict and
the other a monitor verdict, the DVS engine always blocks the request.
•
Different verdicts from the same scanning engine. A scanning engine might return multiple
verdicts for a single object when the object contains multiple infections. When a URL causes
multiple verdicts from the same scanning engine, the appliance takes action according to the verdict
with the highest priority. The following text lists the possible malware scanning verdicts from the
highest to the lowest priority.
verdicts for a single object when the object contains multiple infections. When a URL causes
multiple verdicts from the same scanning engine, the appliance takes action according to the verdict
with the highest priority. The following text lists the possible malware scanning verdicts from the
highest to the lowest priority.
•
Virus
•
Trojan Downloader
•
Trojan Horse
•
Trojan Phisher
•
Hijacker
•
System monitor
•
Commercial System Monitor
•
Dialer
•
Worm
•
Browser Helper Object
•
Phishing URL
•
Adware
•
Encrypted file
•
Unscannable
•
Other Malware