About WRS Safety Pattern mode

The WRS Safety Pattern mode enables both the Web Safety Pattern and the New Web Domain Pattern.

The Web Safety Pattern is the full version of the Web Blocking Pattern. It contains all URL indicators, as well as website categories, that the Global WRS has collected and verified. Compared to the default Web Blocking Pattern, it has a much higher coverage of website ratings because it allows WRS to respond to non-malicious ratings along with website and/or webpage categories for the user’s reference. Using the Web Safety Pattern provides the full Web Threat Protection (WTP) score range:

 

 

WTP Score	Web Blocking Pattern	Web Safety Pattern	Description
81 ~ 100 (Safe)		*	No known or potential threats
51 ~ 80 (Suspicious)		*	Spam or compromised sites or possibly a potential source of malware/spyware
71 (Unrated)		*	Unrated page
0 ~ 50 (Dangerous)	*	*	Verified to be a phishing page or a source of malware/spyware

For category support, Web Blocking Pattern only provides a category record for malicious URLs since the pattern entries contain malicious URLs only. With Web Safety Pattern, the full rating database resource provides all collected URL entries and categories.

	Web Blocking Pattern	Web Safety Pattern
Category	(Only for Malicious URLs)	ALL
WTP Score	< 50 (Malicious)	ALL

 

The New Web Domain Pattern is a new concept in the WRS rating process. It provides SPS a public suffix list and a new domain service to detect whether a URL's domain is new or old. This could cover and identify new domain names, which lets the user or query flow take the necessary actions. If new domains are related with advanced persistent threats (APT) or have potentially malicious behaviors, the user will have a chance to collect or process these URLs. URLs from a new domain will be rated with a score of 71 (Unrated) and a new category 93.
 

How to enable WRS Safety Pattern mode

To switch to the WRS Safety Pattern mode:

1. Log in to the SPS console with the root account.
2. Enter the following commands in succession:

   $> clish
   $> enable
   $> enable web-reputation-patterns

After executing these commands, SPS will stop WRS and download Web Safety Pattern. The whole process will take a while since the Web Safety Pattern's file size is larger than the Web Blocking Pattern's. WRS will launch automatically once the WRS switching process is complete. Meanwhile, the last Web Blocking Pattern database will be preserved.

 Currently, it is recommended that only customers using Deep Discovery (DD) and/or InterScan Messaging Security Virtual Appliance (IMSVA) should switch from the SPS Web Blocking Pattern to the Web Safety Pattern due to performance considerations.

How to disable WRS Safety Pattern mode

To disable the WRS Safety Pattern mode:

1. Log in to the SPS console with the root account.
2. Enter the following commands in succession:

   $> clish
   $> enable
   $> disable web-reputation-patterns

After executing these commands, SPS will restart WRS and re-use the preserved Web Blocking Pattern database.