`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 1of5
`
`EXHIBIT 16
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 2 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 2 of 5
`
`oky Advanced Threat Prevention Architecture:
`Sky components are divided between the SRX, embeddedin Junos,
`and the cloud
`
`¢ Components in Junos:
`— Secintel Service
`
`* Receives feeds from the cloud
`
`— GeolP
`
`— Command and Control
`
`— Infected Hosts
`— Sky ATP Service
`¢ Passes incoming files to the Cloud for analysis
`¢ Enforces policies based on Cloud verdicts
`
`Copyright © 2016 Juniper Networks, Inc
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 3 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 3 of5
`
`as
`
`J
`
`4)
`©oO
`a4
`
`pelaPPCIE
`ile]
`eyteMakedTN
`
`o=“
`
`J
`
`Verdict
`
`Copyright © 2016 Juniper Networks, Inc
`
`Static Analysis: Pulling apart the code
`
`¢ Break file down into features
`
`¢ File structure
`* Meta info (file name, vendor, etc...)
`* Categories of instructions used
`* File entropy
`© Be.
`
`* Feed features into machine learning algo
`* First teach it what malwarelookslike
`
`* Then ask if something is malware
`
`Static analysis is traditionally done with rules. Argon extends
`this by adding machine learning to improve verdict accuracy.
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 4 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 4 of 5
`
`sandboxing: Behavioral Analysis
`
`Behavior analysis gives us a better understanding of what a suspect
`file is trying to do. Some behaviors are usually considered benign,
`while others may be benign, but are also seen in malicious programs.
`Still others are usually associated with attack behaviors. Some
`examples:
`
`
`
`OftesuMBhBinusIGIaUS beanOKs:sS
`
`° Ex@ateltoeGloienGrd esplog directory
`
`SepataMtedsackANGraist
`
`Copyright © 2016 Juniper Networks, Inc
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 5 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 5of5
`
`How is Sky ATP Different?
`
`¢ High Efficacy, Scalable and Tightly integrated solution
`¢ Distributed sensing and enforcement on SRX (no additional sensors)
`¢ Actionable Intelligence
`¢
`In-line blocking to prevent zero-day infections from getting in
`¢ Unique deception & provocation techniques to counter evasive threats
`¢ Advanced machine learning
`¢ Support for different types of analysis targets
`¢ Multi-platform executable and application support
`¢ Exploits and malicious content embedded in documents (MS Office, PDF)
`¢ Dangerous web applications (Java, Flash) — future
`¢ Cost-effective, non-intrusive solution with full network coverage
`
`Copyright © 2016 Juniper Networks, Inc
`
`