Process for Categorizing a Site:
Cymphonix uses three tools in parallel to manage its Web-filtering task. The first tool is a database of disallowed sites. It's simple and powerful but the problem with using this tool by itself as the main method of Web filtering is obvious: sites change on a daily or even hourly basis. A static defense against a dynamic threat will fail over time. Though this type of tool is simple, fast and excellent at defending against known threats, it's only as good as the last update.
Ironically, many vendors go to great lengths to cite the size of their databases as a measure of their product's Web-filtering strength. We think numbers are important, but focusing on just one dimension is misleading. A more important number to consider is how many tools are working together to do the job. We use three. The database is just the first one.
The second tool we use is our Keyword Analysis Engine, which scans the URL for text strings that suggest an inappropriate site. This tool is dynamic and can help keep up with the changing environment of the Web.
As you know, the limitation of only using keywords for Web filtering is the risk of false positives and false negatives. For example, someone going to visit Essex, Connecticut might want to visit the city's Web site at www.essexct.com beforehand to get information on attractions. It's too bad, but filters using only keywords as their primary defense would block the site. On the other hand, if someone put up a site about the city that included offensive content and named the Web site something innocuous like www.bland.com, keyword filtering would not flag that site.
Solutions that rely too heavily on keyword analysis run into a lot of false positives that end up blocking legitimate sites. Lots of appliances use keyword analysis because it is efficient and has a small footprint. That's great if there isn't enough space to create a more sophisticated database with processor-intensive tools. Cymphonix Network Composers have plenty of room and processing power to run multiple tools.
That's why we add our third tool, the Real-Time Analysis Engine. This part of the XLi OS scans the actual content of the Web page, as well as the structure, the text, and other content. The Real-Time Analysis Engine then runs a set of heuristics to deduce whether a site that sounds naughty is actually innocent or an innocent site is really the naughty one.
Finally, because no single solution, or even the best-engineered trio of solutions, can be a hundred percent tailored to your organization a hundred percent of the time, we also provide an easy way to add, delete, or reclassify sites. And because we know building and maintaining a site list is a lot of work, XLi keeps the list intact when you upgrade or change appliances.
Percentage of Category Decisions Reviewed by Human:
Description of Each Content Category with Example URLs:
The Network Composer's database currently lists over 66 million URLs classified into over 90 categories including Pornography, Child Pornography, Mature Content, Drug, Hate, Criminal Skills, Hacking, and Weapons just to name a few. Additionally, because of the dynmaic nature of the Internet, Network Composer provides real time content and keywork analysis of web pages to prevent access to new or changing sites with inappropriate content (in 20 international languages).
Categories Vendor Recommends for CIPA Compliance:
pornography, child pornography, mature content, drugs, hate, criminal skills, hacking, weapons, etc.
Granularity of Your Block List:
Block by IP address
Block by hostname
Block by top level domain
Block to page level
Examples of Each Item Selected Above (Granularity):
The Network Composer enables organizations to get down to granular Internet optimization for elimintating threats while monitoring traffic down to the exact type of content going through the company's pipeline. The appliance can actually give you "deep packet inspection" from layers 3 to 7, along with a real-time HTTPS scan, so you can look into encrypted sessions to make sure they're not security risks.
You can choose to filter by active directory group, IP address, MAC address, URL, host, all the way down to filtering the specific content within a webpage.
Frequency of Updates to Blocked Site List:
Description of How Updates are Applied:
Software, firmware, content filter, and anti-virus definitions are automatically updated daily. Filter avoidance definitions are completed hourly.
Block Page Displayed or Blocking Transparent to User:
Additional Comments on Blocking:
Network Composer can be configured to display a block page or leave it transparent. Additionally, Network Composer allows you to go beyond traditionaly block/allow rule sets for your network. You can shape and prioritize your traffic the way you see fit.
For example, say that you don't want to completely block access to a site such as YouTube.com; however, you want to limit the amount of resources it uses. You simply set up the URL YouTube.com to never use i.e. more than 20% of your bandwidth at any given moment and give it a low priority. This insures that other information in your pipe (such as education and research categories) are given a higher priority and thus, more bandwidth.
Items that Can Be Included on Block Page (if applicable):
Category causing the block
Customizable message
Password override
Does filter provide dynamic filtering of pages as they are accessed?:
Does content filtering work on a weighted system controlled by administrator:
Describe how dynamic content filter can be changed by administrator, if applicable.:
Can filter by file type:
Can block by extension--applies to all categories
Can block by extension within a category
Can block by MIME type--applies to all categories
Can block by MIME type within a category
Can block by protocol--applies to all categories
Can block by protocol within a category
