`
`Exhibit Q
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case 3:17-cv-05659-WHA Document 390-20 Filed 03/14/19 Page 2 of 5
`
`
`
`
`abcdefÿhdidejklbdimdÿaj
`zticbcb{ztpÿ|l}
`~cjÿtee
`W
`nopÿqrbcsetu
`vtlfrmdjÿwÿhlxrylbj
`hrssltd
`U
`)
`
`'04/'
`ÿÿÿ ÿ ÿ!"#" $
`K#MXYZHAGÿIJÿ [# ÿKM"ÿL[\ÿ]KL^ÿZ
`HAGÿIJÿ [# ÿKM"ÿL[\ÿ F"\ÿ_A ÿ`Z
` ÿ
`%&'(
`ÿ)*ÿ+ ,ÿ&-
`-ÿÿ((
`.'
`ÿ((/
`0
`4'2ÿ5.6
`7ÿ89ÿ'ÿ'.--
`
`:
`.-ÿ0
`ÿ;.
`ÿ-ÿ-/.&0
`.ÿ5.6
`<ÿ0ÿ-ÿ'/0ÿ'
`
`--ÿ0/ÿ/'4'&
`ÿ0
`ÿ((
`.'
`ÿ0/ÿ9&0
`
`
`
`=5'
`ÿ0
`ÿ5.6
`7ÿ)
`
`ÿ>2&
`ÿ 7
`?@AÿBCÿDEFGÿHAGÿIJÿKLÿLGÿGG#MÿNÿ@ÿ
`O
`
`ÿ
`0
`-ÿÿ:
`30ÿ'&5
`<ÿ6
`3ÿ0/ÿ
`0
`ÿÿ;'.ÿ:
`30
`'&5
`ÿ
`06
`
`'ÿ ÿ'3ÿ Q7ÿ+ÿ:
`30ÿ'&5
`ÿ-ÿÿ-/
`ÿ/ÿ0
`0ÿ.
`:
`.7ÿ
`ÿ
`ÿ0
`ÿ'&5
`<ÿ0
`
`
`
`ÿ0
`ÿ5.6
`ÿ0
`07ÿ
`ÿ)RSÿ)
`
`-ÿ3
`:
`ÿ/5(
`-ÿ0
`30ÿ'&5
`ÿ0/ÿ0
`ÿ(/.
`-
`T'2-ÿ'3ÿ
`0
`ÿ(
`50-ÿ/ÿ3
`'
`-ÿ0
`ÿ-
`--/'7ÿ89ÿ0
`ÿ-
`--/'ÿ-ÿ3
`'
`3<ÿÿ
`-
`0ÿ(*
`0ÿ-ÿ-
`'0ÿ0/
`0
`ÿ.
`'0ÿ'3ÿ0
`ÿ(*
`0-ÿ
`ÿ3/((
`3ÿ9/5ÿ0
`ÿ-
`:
`7
`
`
`
`When a file is analyzed, a file hash is generated, and the results of the analysis are stored ina
`
`database. When a file is uploaded to the Juniper Sky ATP cloud, the first step is to check whether
`
`this file has been looked at before.If it has, the stored verdict is returned to the SRX Series device
`
`and there is no need to re-analyzethe file. In addition to files scanned by Juniper Sky ATP,
`
`information about common malwarefiles is also stored to provide faster response.
`
`Cache lookup is performedin real time. All other techniques are done offline. This means thatif
`
`the cache lookup doesnotreturn a verdict, the file is sent to the client system while the Juniper
`
`Sky ATP cloud continues to examine the file using the remaining pipeline techniques.If a later
`
`analysis returns a malware verdict, then the file and hostare flagged.
`
`Antivirus Scan
`
`Case 3:17-cv-05659-WHA Document 390-20 Filed 03/14/19 Page 3 of 5
`Case 3:17-cv-05659-WHA Document 390-20 Filed 03/14/19 Page 3of5
`Cache Lookup
`
` ÿ
`
`
` ÿ
`
`ÿ
`0/ÿÿ(00ÿ0) ÿ ÿÿÿ ÿÿ!+ ÿ ÿ !
`1(
`
`6789:; <ÿ= 7
`#$ÿ%&'ÿ(ÿ(/ ÿÿ 40 ÿ
`ÿ ÿÿ0) ÿ+ (ÿ
`&
`(
`
` ( ÿ%/+ÿÿ @ ÿÿ ÿ0ÿ
`"! ÿ#$ÿ%&'ÿ/ ÿ0/! ÿ/+ÿ>) ÿ!($ ÿÿ?ÿ ÿÿ ÿÿ ÿ&
` /+ =A 8ÿ67 BC<:<
` ÿ ÿ
`#/(ÿÿ 40 ÿ ÿ)
`ÿÿ!(ÿÿFGÿ ( ÿ&
`I ÿ0/JK0 ÿÿ
`
`1 ÿÿ(/ÿ J*ÿ
`*MNÿ%'*L
`O ÿ !JP)ÿ0ÿÿ
`
`ÿ
` ÿÿ0)
`&
`(((
`
`The advantageof antivirus softwareis its protection against a large numberof potential threats,
`
`such as viruses, trojans, worms, spyware,and rootkits. The disadvantage of antivirus softwareis
`
`thatit is always behind the malware.The virus comesfirst and the patch to the virus comes
`
`second. Antivirus is better at defending familiar threats and known malware than zero-day threats.
`
`Juniper Sky ATP utilizes multiple antivirus software packages, not just one, to analyzea file. The
`
`results are then fed into the machine learning algorithm to overcome false positives and false
`
`negatives.
`
`Static Analysis
`
`Static analysis examinesfiles without actually running them. Basic static analysis is straightforward
`
`and fast, typically around 30 seconds.The following are examples of areas static analysis inspects:
`
`¢« Metadata information—Name ofthe file, the vendor or creator of this file, and the original data
`
`the file was compiled on.
`
`¢ Categories of instructions used—Is the file modifying the Windowsregistry?Is it touching disk
`
`I/O APIs?.
`
`e File entropy—Howrandomis the file? A common technique for malwareis to encrypt portions
`
`of the code and then decryptit during runtime. A lot of encryptionis a strong indication a this
`
`file is malware.
`
`The output of the static analysis is fed into the machine learning algorithm to improve the verdict
`
`accuracy.
`
`
`
`Case 3:17-cv-05659-WHA Document 390-20 Filed 03/14/19 Page 4 of 5
`
` ÿ
`
`
`
`
` ÿ%&'()*+,'-#ÿÿ ÿÿ. ÿÿÿÿ / . ÿÿÿ . ÿ 0 !ÿ1.ÿ
`ÿ ÿ ÿ 0 ÿÿ ÿ.#ÿÿÿÿ0.ÿ
`ÿÿ0!ÿ
`. !ÿ3 ÿ
`
`5
`.
`2 ÿÿ ÿ
`E ÿÿ ÿ4 ÿÿ. ÿ ÿ.
`7 7 #ÿ ÿÿ ÿ.
`F ÿ7 ÿ
` 27ÿ2
`F ÿ0. 6 ÿ ÿÿ
`1 ÿ
`0 !ÿ
`J KLÿML NOÿ OPNQK
`
` ÿ
` ÿ2
`8. ÿ57ÿ9:ÿ. ÿÿ2ÿ ÿ ÿÿ
`R
`
`TKNL QÿMLUL
`
`
`ÿ ÿ ÿÿ
`8. ÿ57ÿ9:ÿÿÿ.6 ÿ6 2 ÿVGWVÿÿ ÿ
`2 ÿ ÿ
`6 ÿWDÿ
`
`
`
`Case 3:17-cv-05659-WHA Document 390-20 Filed 03/14/19 Page 5 of 5
`
`<=>?@AÿC?D?E
`F?GHIJKH
`L
`M Nÿ ÿ .
` ÿÿO-
`PÿQÿR
`2 1ÿ
`SÿQÿT
`U-ÿ
`VÿQPL
`W8
` ÿ ÿ
` ÿ ÿ
`
` !"# $ÿ&'()* +#",'+
`ÿÿ- .-ÿ
`
`/
`ÿÿ- .-ÿ
` ÿ2.ÿ
`34567ÿ ÿ 8ÿ
`ÿÿ9:ÿ 8ÿ;
`XYZ[\]^
`_`abcÿef
`ghijjifgaikaihcjÿljfkamfn`noncp
`qmrjfcaiÿljohsamf
`tjufiaav
`gamchwcÿef
`qvhxjÿyn`ihip
`z\{|]}{~
`
`