WEB REPUTATION SERVICE
The Webroot Web Reputation Service helps network and security vendors add a critical layer of real-time security to their customers’ web defenses by accurately observing and predicting the risk from connecting to any URL.
This additional layer of proactive protection helps defend against rapidly emerging threats by assessing a site’s risk level totally independently of its classification.
With dynamically generated user content, mashups, and the rapid rate of website deployments now so common, the structure, information and links on websites change very quickly. This speed of change is fertile ground for malware authors and creates a serious gap in lesser classification intelligence services that don’t possess this extra layer of threat assessment.
OVERVIEW
The Webroot Reputation Service provides a much needed way to instantly classify the risks posed to a user on-the-fly and so help counter any malicious websites.
Just as a credit score predicts the risk of loans or investments, a reputation score forecasts the security risk of visiting a website.
| Webroot Reputation Index | |||
| 01-20 | High Risk |  |
These are high risk sites. There is a high probability that the user will be exposed to malicious links or payloads. |
| 21-40 | Suspicious |  |
These are suspicious sites. There is a higher than average probability that the user will be exposed to malicious links or payloads. |
| 41-60 | Moderate Risk |  |
There are generally benign sites, but have exhibited some characteristics that suggest security risks. There is some probability that the user will be exposed to malicious links or payloads. |
| 61-80 | Low Risk |  |
These are benign sites, and rarely exhibit characteristics that expose the user to security risks. There is a low probability that the user will be exposed to malicious links or payloads. |
| 81-100 | Trustworthy |  |
These are well known sites with strong security practices, and rarely exhibit characteristics that expose the user to security risks. There is a very low probability that the user will be exposed to malicious links or payloads. |
The Webroot Reputation Index (WRI) scores the reputation level of websites from metrics that include site history, age, rank, location, networks, links, and other contextual and behavioral trends. The WRI ranges from 1-100 with high-risk, suspicious, moderate risk, low risk, and trustworthy reputation levels. These Reputation Scores then enable enterprises to more finely tune their security settings and more proactively prevent malicious attacks before they occur.
An Incremental Layer
of Security beyond Legacy AV
With proliferation of malware threats, traditional signature-based AV is increasingly less effective. Webroot’s Web Reputation Service helps to fill this AV effectiveness void by delivering an additional real-time security check of the websites users are visiting. It also provides much richer web filtering policy controls that help limit users risk and exposure to inappropriate or malicious web content.
Refined Data-Driven Probability Heuristics
Historical data, real-time performance and behavioral characteristics are all cataloged and analyzed to create the Webroot Reputation Index (WRI), which delivers the ‘probability’ of a website posing a risk.
Dynamic Updating
Around-the-clock real-time updates are being continuously created on all known and new sites to keep Webroot’s web site security intelligence as current as possible. When uncategorized sites are visited by any user then these requests are dynamically crawled and scored in real-time, so each web site’s score is continuously checked and auto-adjusted over time.
Richer Web Security Policies
Integrating the Webroot Web Reputation Service into network solutions not only provides an added layer of web filtering protection from low reputation sites that are known to host malware or spyware, but if integrated as part of the policy interface offers enterprises far more granular security management.
For example, it is a common web filtering policy to enable access to websites in the “Financial” category. Enterprise end users have many reasons to visit such sites for productivity reasons like conducting banking transactions online, buying insurance, and checking balances. Integration of the Webroot Reputation Service enables enterprises to allow their users to access reputable financial sites, but prevents them from accessing low reputation financial sites. The financial sites that are far more likely to host malware, or be phishing websites.
IN USE
- Powers a new cloud- based IP Intelligence service that detects and stops IP addresses associated with malicious activities from accessing a Partner’s customers’ networks.
- Powers a Partners network security products to increase real-time protection against known malicious threats, unauthorized network access and Denial of Service (DoS) attacks.
Flexible Integration Options
The Webroot Web Reputation Service integrates with existing security solutions through the Webroot Software Development Kit (SDK), and the Web Reputation Service may be integrated in three modes, enabling our Partners to select the integration and deployment type best suited to their needs, the options are:
- Hosted - All URL queries are sent over the Internet to the Webroot Intelligence Network
- Local Database - A database is downloaded to the endpoint, and no queries are sent to the Webroot Intelligent Network and the database is updated once, daily.
- Hybrid Model - A local database is downloaded, and a URL query first looks into the locally cached database, and if the URL’s category and WRI are not stored there, then the query is forwarded to the Webroot Intelligence Network for classification.
Platform Compatibility
The Webroot Software Development Kit includes source code, and is compliant with the following platforms:
- Linux® (Redhat®, Fedora®, Debian®)
- Microsoft® Windows™ Server 2003
- Microsoft Windows XP/Vista™
