Method of Work of AMRES Proxy Devices

Equipment manufacturer determines reputation of web-page based on existence of malicious software. Web-pages are graded by specific grade based on assigned reputation, which is periodically (every five minutes) downloaded by proxy devices. Grading is within the range from -10 to +10, where -10 is the worst reputation, i.e. indicator that the web-page is the source of malicious attacks, while +10 is the best reputation, i.e. indicator that web-page is completely safe. Reputation range is divided into three zones on AMRES proxy devices:

  • Bad reputation (from -10 to -7.9) – web-sites are automatically blocked.
  • Average reputation (from -7.8 to 5.9) – web-site content is scanned by Webroot antivirus solution installed on the proxy devices. If it does not detect presence of malicious code, access to web-content is allowed.
  • Good reputation (from 6.0 to 10) – web-site content is not scanned and access is automatically allowed.

Proxy devices additionally classify web-pages on the Internet into specific categories based on web page contents. Categorization itself is not performed by AMRES in any way. Cisco IronPort  devices download classification automatically, every five minutes. There are approximately 60 predefined categories from which web-sites having the following contents are filtered:

  • Child Abuse Content – contents related to child abuse,
  • Gambling – betting on the Internet, casino games, betting advice and sports,
  • Hate Speech – promotion of hatred, non-tolerance or discrimination based on skin color, religion, sexual orientation, class, origin, nationality, age, gender or disability,
  • Illegal Drugs – promotion of use, consumption, purchase or production of illegal drugs and opioids,
  • Pornography – promotion of sexually explicit contents, including animated contents,
  • Filter Avoidance – web-sites that provide support for anonymous and secret use of web-space including the sites with anonymous proxy servers.

Wrong Categorization

Taking into consideration high number of web-pages on the Internet, errors sometimes happen during categorization process and determination of reputation which may result in some web-pages being unduly blocked (for example, web-pages of importance for research in the field of chemistry were classified as Illegal Drugs and prohibited as such).

If a certain web-page is blocked, a notification which contains information about why that particular web page is blocked is shown to end users. In case that end user thinks that the web page in question was unduly categorized, it is necessary to submit a report, with following information:

  • If contact information of users’ hone institution is shown on the notification page, report needs to be sent to the institution’s technical contact,
  • Otherwise, report is sent to AMRES Helpdesk. If it is determined that a web page was unduly categorized, AMRES will enable access to web-page by direct intervention on the device as soon as possible and at the same time a report will be sent to equipment manufacturer’s support.