Read without ads and support Scribd by becoming a Scribd Premium Reader.

Language:

Download

Go BackAdd Note

Link

Embed

Save for later

Problem Description

How does Blue Coat WebPulse work with Blue Coat WebFilter?What happens behind the scenes for a web site to be categorizeddynamically?

Resolution

The Dynamice Real time Rating Service (DRTR) is only one part of WebPulse that includes many foreground and background processes.

SGOS first checks the current webfilter database for a categoryrating. If this operation does not return a result then theWebPulse service ( The Dynamic real time Rating - DRTR) is used toattempt a rating. The WebPulse service then checks if it has a cachedentry of the requested URL. If this is a positive hit then the rating isreturned and no other activity takes place.

NOTE:

Both the above operations are conducted on the local (customer owned) ProxySG.

Here's what happens in the Web pulse cloud:

Once no rating can be found, WebPulse seeks one in the four datacenters situated at strategic locations around the world. (Please seeKB3381for the IP addresses of these four data centers.)

Once this request is received in the datacenter, the receivingProxySG also checks it's own Webpulse cache, to see if this website hasalready been rated. If the answer is still "NO", then it contacts theWebPulse rating service point IP address.

Note:

This service point IP address, is not advertised in any ProxySG; itis part of the Webpulse cloud service.

The service point then checks its database for a rating and returnsone immediately, if possible. If it does not have a rating for this site, it

then asks for a rating to occur dynamically. In all, at least threeappliances, running the Webpulse service ( DRTR) have checked theircached ratings database, before a dynamic rating takes place.

Note:

Due to the large number of WebPulse rating requests receivedfrom all ProxySG appliances deployed throughout the world, thedatabase that the rating server keeps is usually slightly more up-to-date than the database on each ProxySG. As you might have realized,both the service point and the WebPulse servers are different serversthat operate together to deliver categories to the ProxySG.

Once a successful rating has been conducted, the service point andthe ProxySG store the category in cache and serve it out to any otherProxySG that asks. The main WebFilter database is not updated withevery dynamically rated URL. What does get updated to the mainratingsr database is based upon the URL's popularity and BlueCoat's ability to correctly rate them.

Note:

In the cases where a dynamic rating cannot occur a request ismade for a manual rating. The most popular requests for manualrattings are downloaded to our hand raters (manual, humanintervention) every day, for analysis.

NOTE:

With the K9 and ProxySG clients the behind-the-scenes actionsare the same. Both the ProxySG and the K9 clients are told to keepthe ratings for 24 hours.

Highlights of Webpulse:

WebPulse has the primary focus on web threat detection usingbackground processes. Uniting 62M users together into acollaborative defense with tremendous awareness to new web