Quality of Brightcloud URL categorisation or lack of.

[robert.b]

Hello

Has anyone else found that there are a large number of websites being classified as Job Search when they are blatantly not? We are finding this to be the case and in fact are generally finding the classifications to be a bit hit and miss in places. Our previous URL filtering solution used the Smartfilter database and we never really had any problems with that.

Any opinions??

Thanks

[a.klingauf]

Hi,

yes we had the same problem. Specially german websites are often categorized as "job search". At first we tried out to send the "false positives" to brightcloud to recategorize this, but this wasn't so funny. Finally we decided to disable brightcloud !!

greeds

Arne

[fredallee]

Thanks for your comments. We have indeed brought up this issue with BrightCloud and have asked them to review and make adjustments to their automated classification engine. As they work on this, please don't stop submitting miscategorization issues like this as it will help them to continue to train their engine to make it more accurate. If it makes it any easier, instead of submitting them one by one to BrightCloud, you can simply email support with a spreadsheet of URLs. Then, we can get them to BrightCloud for immediate re-categorization.

Thanks,

Alfred

[robert.b]

Arne

So what are you using for URL classification? Or are you not controlling access based on the URL anymore?

Thanks

Robert

[a.klingauf]

I don't wanna advertise other products in a PaloAlto forum....

But now we use another product for this matter. We take a "cloud based proxyserver" with dynamic URL classification and put it infront of the PAN.

Best Regards,

Arne

[djbisbey]

Yep got to agree, not actually with the 'job search' but we are ballet school in the UK and we find so many of the sites the students go to are classified as 'not-resolved'  which is really unhelpful, as we did block the 'not resolved' to protect the students from unknown sites etc.

Furthermore I submitted a URL definiation change, we also blocked uncatergorized and a banking site we were using kept being blocked, so I submitted the URL for reclassifcation as clearly its not uncatergorized its an internet banking site, this is what they replied with...

Hello again -

We have reviewed ibb.aibgb1.co.uk and determined that it does not need to be changed at this time based on BrightCloud’s classification criteria.

It is currently classified as Uncategorized in the BrightCloud Service and available in Database version 3.440.

You can read our Database Change FAQs for more information on the most common reasons why your suggestion may not have been implemented.

Thanks again for your suggestion!

As you can see they kept it as is, what is the point of submitting a URL when I actually know that it should be under financial and not classified as 'uncatergorzied'.

Smartfilter was so much better on our previous product and accurate...after all we pay for the license and if brightcloud are not prepared to alter their policy then maybe Palo need to look elsewhere for a URL filtering solution...

Darren

[James]

Hi Darren,

I would like to try and help, 1st of all generically - then with your items below:

Please - if you feel a submission to Brightcloud did not get the correct attention, log a call directly with us (Palo Alto Networks).  We will help you to get the desired outcome.

We expect all our customers to get good service - so we'll do what we can to resolve this.  Please log with our support.

The specific domain you mention ibb.aibgb1.co.uk - I could not get to this.  Maybe it is Unknown, or do you get there via logging into somthing else?

Looks like Allied Irish, I guess?

'Not-Resolved' - this is a technical issue and should be logged with Palo Alto Support.  This means you are not getting an answer from the Brightcloud Database within 5 seconds - so we'll need to check with you why that is.  We also have some code enhancements coming in this area in 3.1.6 - due to be released in November.  However, do not wait for that - I am sure we can help you now.

Thanks

James

[djbisbey]

James,

you are quite right it is from Allied Irish and actually went through from a link within their site, but once the user clicked on the link it did nothing, on investigation it was down to the item being categorized as 'not-resolved' so once I allowed the user to view not resolved category they could click through no problem.

I have raised a case 00023838.

I have now checked our logs and find that theses sites (just some examples) are being categorized as 'not-resolved' so I have attached an xls export to give some idea of the issues.

Thanks

Darren

[James]

Hi Darren,

Well, good and bad news

Not good that you have so many not-resolved sites.  But good news you have logged a case - I am sure we'll get you to a resolution soon!

Thanks

James

[dread]

Hi Darren, I have had good luck getting Brightcloud to recategorize URLs by doing a URL lookup at http://www.brightcloud.com/ and then using the Suggest a new Category link and plugging in Palo Alto Networks for the Integration field.  Brightcloud usually responds within 1 or 2 business days with a change (not always the category I suggest but usually an acceptable one).  However, I haven't had to do this with many foreign websites so your mileage may vary.

Also, if you are getting a lot of not-resolved definitely contact support.  We were having major issues with URL-filtering (we block unknown and not-resolved) and support helped us get the issue fixed.

Dave

[rodrigum]

We have had precision issues with Brightcloud as well; I brought it up to our SE.

In general I would say accuracy is lacking.

[fredallee]

Regarding the not-resolved issues, there's a known issue in 3.1 code surrounding not-resolved URLs. We anticipate a fix for the issue in 3.1.6. If you are seeing high numbers of not-resolved URLs, please contact support.

[djbisbey]

well, I have a ticket with them. Lets see if they can put this to bed...

as yet nothing back from them, sent our support logfile over to them yesterday afternoon.

[James]

In PANOS 3.1.6, we are getting good feedback with regards to fixing the error in getting unknown categories returned as "Not-Resolved".

In terms of the database in accuracies with regards to job-search category. Brightcloud are finalising the fine tuning of their engine in this area. The process and reclassification should be complete by the end of November 2010.

Best Regards

James

[CWillms]

Coming from another categorization db vendor that was very good I am finding BrightCloud far more inaccurate. Our problem on several occasions was sites being categorized as Religion (which we block) and yet the BrightCloud lookup was categorized correctly. Our PA device was wrong! So what am I supposed to do then?