17
©
SOLIDA SYSTEMS INTERNATIONAL
2016
any given point in time. The threat feed contains in average 750,000
domain names, covering a time window of UTC – 48 hours to UTC + 24 hours. This gives a 72-hour
sliding window that covers all time zones worldwide. These domain names are written to a
blacklist in the security appliances. All outgoing DNS queries and URLs are verified against this list
and dropped if a match is found.
5.3 List Updates
The reputation lists are constantly being updated through a cloud based threat feed offered by
Solida. The appliance automatically connects with this cloud service once every hour, to download
new updated versions of the lists. This guarantees that the appliance always contains information,
about the latest threats seen in the wild.
To monitor the list update process and the list sizes, start the configuration application and
navigate to “Threat Intelligence – Threat Lists”. A similar page is available at the same location in
the monitoring application. The page will look as follows:
Figure 5.1 Threat lists overview
In the box named “Reputation List Control Center” the following information is provided:
Next cloud
update
– Shows the time at which the next list update will be performed.
DGA Ransomware Entries
– The number of DGA generated domain names in this list.
