Why do Symantec Site Review and the ProxySG appliance sometimes return different categories for websites?

book

Article ID: 168432

calendar_today

Updated On:

Products

Advanced Secure Gateway Software - ASG ProxySG Software - SGOS

Issue/Introduction

Symantec Site Review (sitereview.bluecoat.com) returns a different category for a URL than when tested on the ProxySG appliance (Management Console > Configuration > Content Filtering > General > Diagnostics).

For example, testing the URL www.capitaltowercanberra.com.au on the ProxySG appliance results in "none", but testing from sitereview.bluecoat.com gives a different result:

The page you want reviewed is http://www.capitaltowercanberra.com.au/    (Check another site)
This page is currently categorized as Travel This page was rated by our WebPulse system

Cause

This behavior is expected.

The message"This page was rated by our WebPulse system" means that categorization was done dynamically and the Blue Coat WebFilter (BCWF) database does not contain this URL. 

When you request a URL that has not already been categorized by the BCWF database (for example, a new Web site), the WebPulse dynamic categorization service queries the target Web site and retrieves the page’s content. WebPulse analyzes the page’s content and context in search of malicious content. If malicious content is found, an appropriate category (for example, Spyware/Malware sources or Phishing) is returned. If no malicious content is found, WebPulse’s dynamic real time rating (DRTR) service determines the language of the page, a category for the page, and a confidence factor that the category is correct. If the confidence factor is high, the calculated category is returned. 

In situations where the dynamic categorization service cannot categorize a URL with enough confidence to dynamically return a category with a high confidence level, the category rating request for the particular page is labeled none. 

All URLs received by WebPulse that are not categorized in the BCWF database are logged and forwarded to Blue Coat’s centralized processing center, where they are prioritized for rating by a series of automated URL analysis tools and/or human analysis. These ratings are then used to update the master BCWF database, and the automatic database update feature then refreshes the local BCWF database on the ProxySG appliance. 

 

Resolution

Workaround

If you encounter this issue again, the workaround is to manually submit the URL to the Symantec Site Review website, so that human raters will look at it rather than waiting for the queue in the system to be rated.