14
©
SOLIDA SYSTEMS INTERNATIONAL 2017
way it is possible to know in advance what domain names similar malwares will generate in the
wild at any given point in time. The threat feed contains on average 750,000 domain names,
covering a time window of UTC – 48 hours to UTC + 24 hours. This gives a 72-hour sliding
window that covers all time zones worldwide. These domain names are written to a blacklist in
the security appliances. All outgoing DNS queries and URLs are verified against this list and
dropped if a match is found.
4.3 List Updates
The reputation lists are constantly being updated through a cloud based threat feed offered by
Solida. The appliance automatically connects with this cloud service once every hour, to
download new updated versions of the lists. This guarantees that the appliance always contains
information about the latest threats seen in the wild.
To monitor the list update process and the list sizes, start the configuration application and
navigate to “Threat Intelligence – Threat Lists”. A similar page is available at the same location
in the monitoring application. The page looks as follows:
Figure 4.1 Threat lists overview.
In the top field named “Reputation List Control Center” the following information is provided:
Next cloud
update
– Shows the time at which the next list update will be performed.
DGA Ransomware Entries
– The number of DGA generated domain names in this list.
