`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 1of5
`
`EXHIBIT 16
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 2 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 2 of 5
`
`oky Advanced Threat Prevention Architecture:
`Sky components are divided between the SRX, embeddedin Junos,
`and the cloud
`
`¢ Components in Junos:
`— Secintel Service
`
`* Receives feeds from the cloud
`
`— GeolP
`
`— Command and Control
`
`— Infected Hosts
`— Sky ATP Service
`¢ Passes incoming files to the Cloud for analysis
`¢ Enforces policies based on Cloud verdicts
`
`Copyright © 2016 Juniper Networks, Inc
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 3 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 3 of5
`
`as
`
`J
`
`4)
`©oO
`a4
`
`pelaPPCIE
`ile]
`eyteMakedTN
`
`o=“
`
`J
`
`Verdict
`
`Copyright © 2016 Juniper Networks, Inc
`
`Static Analysis: Pulling apart the code
`
`¢ Break file down into features
`
`¢ File structure
`* Meta info (file name, vendor, etc...)
`* Categories of instructions used
`* File entropy
`© Be.
`
`* Feed features into machine learning algo
`* First teach it what malwarelookslike
`
`* Then ask if something is malware
`
`Static analysis is traditionally done with rules. Argon extends
`this by adding machine learning to improve verdict accuracy.
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 4 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 4 of 5
`
`sandboxing: Behavioral Analysis
`
`Behavior analysis gives us a better understanding of what a suspect
`file is trying to do. Some behaviors are usually considered benign,
`while others may be benign, but are also seen in malicious programs.
`Still others are usually associated with attack behaviors. Some
`examples:
`
`
`
`OftesuMBhBinusIGIaUS beanOKs:sS
`
`° Ex@ateltoeGloienGrd esplog directory
`
`SepataMtedsackANGraist
`
`Copyright © 2016 Juniper Networks, Inc
`
`
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 5 of 5
`
`Case 3:17-cv-05659-WHA Document 98-19 Filed 06/07/18 Page 5of5
`
`How is Sky ATP Different?
`
`¢ High Efficacy, Scalable and Tightly integrated solution
`¢ Distributed sensing and enforcement on SRX (no additional sensors)
`¢ Actionable Intelligence
`¢
`In-line blocking to prevent zero-day infections from getting in
`¢ Unique deception & provocation techniques to counter evasive threats
`¢ Advanced machine learning
`¢ Support for different types of analysis targets
`¢ Multi-platform executable and application support
`¢ Exploits and malicious content embedded in documents (MS Office, PDF)
`¢ Dangerous web applications (Java, Flash) — future
`¢ Cost-effective, non-intrusive solution with full network coverage
`
`Copyright © 2016 Juniper Networks, Inc
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
