Blue Coat WebFilter Service Sub-domain Classification

Products

• Symantec WebFilter (formerly Blue Coat WebFilter - BCWF)
• ProxySG Software - SGOS

Issue/Introduction

Some subdomains are rated differently by the Blue Coat WebFilter (BCWF) service than their parent top-level domains. This article describes how and when the BCWF service makes the distinction to rate each domain and subdomain appropriately.

Cause

When the Blue Coat WebFilter (BCWF) service analyzes a sub-domain, (subdomain1.example.org) it typically assigns the same category as the top-level domain, (example.org). However, if the subdomain has significantly unique content, it will be rated differently than the top-level domain. 

BCWF uses a method called Rating Types to determine how to classify a URLS and their subsequent directories. Whenever it assigns a rating to the URL, the BCWF service considers four rating elements:

• File: A single page rating that applies to a single file, where the contents and details of that file are different than those of the root domain. 
• Directory: Rates a single URL path. This rating type only covers the specific directory where it was applied, and is not often used. For example, while example.org is rated, example.org/dir1/ might appear as unrated.
• Cascaded Directory: Rates multiple directories under a domain as different categories. As BCWF scans the directories on a given domain, it assigns categories to the content as appropriate. To use a real-world example, www.reddit.com is rated as Newsgroups/Forums, www.redd.com/r/funny is rated as Humor/Jokes. Pretty much every directory under that domain represents a different category; some of which are typically blocked by most web filter policies. 
• Trusted Domain:  If contents in all subfolders match the content category on the domain as a whole, the entire site can be classified with the same category using the Trusted Domain rating type.