ON THIS PAGE
Configure Machine Learning-Based Threat Detection
Let’s take a look at a typical enterprise network. An end user unknowingly visits a compromised website and downloads a malicious content. This action results in compromise of the endpoint. The harmful content on the endpoint also becomes a threat to other hosts within the network. It is important to prevent the download of the malicious content.
You can use an SRX Series Firewall with flow-based antivirus and ML-based threat detection to protect users from malware attacks and to prevent the spread of malware in your network.
The following configuration creates an ML-based antivirus policy with the following properties:
-
Firewall policy name is fw-ml-policy.
-
Machine learning policy name is ml-policy.
-
Block any file if its returned verdict is greater than or equal to 7 and create a log entry.
-
When there is an error condition, allow files to be downloaded and create a log entry.
Requirements
Before you begin
-
Configure security zones and security policies. For more information, see Example: Creating Security Zones in Security Policies User Guide for Security Devices.
-
Verify that you have a Juniper antivirus license. For more information about how to verify licenses on your device, see Software Licenses for SRX Series Firewalls. A sample license information is given below:
License identifier: JUNOSXXXXXXXX License version: 4 Valid for device: XXXXXXXXXXXX Features: Juniper AV - Juniper Anti-virus Scan Engine date-based, 2022-10-23 17:00:00 PDT - 2022-11-23 16:00:00 PST
-
SRX Series Firewall with Junos OS Release 24.2R1 or later.
-
Note:
-
IMAPS, SMTPS, HTTPS and SMB protocols are supported for the machine learning-based zero-day threat detection.
-
Currently only .exe and .dll file types are supported.
-
Configuration
Step-by-Step Procedure
The following configuration requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
-
Create the antivirus policy and block any file if its returned verdict is greater than or equal to 7.
set services anti-virus policy ml-policy action block set services anti-virus policy ml-policy default-notification log set services anti-virus policy ml-policy fallback-options notification log set services anti-virus policy ml-policy http-client-notify message "test message for machine-learning flow" set services anti-virus policy ml-policy notification log set services anti-virus policy ml-policy verdict-threshold 7 set services anti-virus policy ml-policy machine-learning-scan action block set services anti-virus policy ml-policy machine-learning-scan notification log
-
By default, your firewall downloads the signatures from the CDN server every week.
You can manually update the virus signature database by specifying the URL of the database server.
set services anti-virus update url https://signatures.juniper.net
-
Configure the firewall policy and apply the antivirus policy.
set security policies from-zone trust to-zone untrust policy fw-ml-policy match source-address any set security policies from-zone trust to-zone untrust policy fw-ml-policy match destination-address any set security policies from-zone trust to-zone untrust policy fw-ml-policy match application any set security policies from-zone trust to-zone untrust policy fw-ml-policy match dynamic-application any set security policies from-zone trust to-zone untrust policy fw-ml-policy then permit application-services anti-virus-policy ml-policy
-
Commit the configuration.
commit
Here are the possible completions for the ML scan:
set services anti-virus policy ml-policy machine-learning-scan ? Possible completions: action Action when malware is found by machine learning scan + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups > default-notification Notification action taken for action > notification Notification when malware is found by machine learning scan
set services anti-virus machine-learning-scan ? Possible completions: + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups max-concurrent Max files concurrent scanned by machine learning scan
Results
From configuration mode, confirm your configuration by entering the show services
anti-virus policy ml-policy and show configuration | display
set commands. If the output does not display the intended configuration, repeat
the configuration instructions to correct it.
Check the results of the configuration:
show services anti-virus
update {
url https://signatures.juniper.net;
}
policy ml-policy {
action block;
default-notification {
log;
}
fallback-options {
notification {
log;
}
}
http-client-notify {
message "test message for machine-learning flow";
}
notification {
log;
}
machine-learning-scan {
action block;
notification {
log;
}
}
verdict-threshold 7;
}
show security policies from-zone trust to-zone untrust
policy fw-ml-policy {
match {
source-address any;
destination-address any;
application any;
dynamic-application any;
}
then {
permit {
application-services {
anti-virus-policy ml-policy;
}
}
}
}
Verification
To verify the configuration is working properly, use the following steps:
Obtaining Information About ML Statistics
Purpose
After some traffic has passed through your SRX Series Firewall, check the statistics to see how many sessions were permitted, blocked, and so on according to your profile and policy settings.
Action
From operational mode, enter the show services anti-virus
machine-learning-scan-statistics command.
Sample Output
show services anti-virus machine-learning-scan-statistics
show services anti-virus machine-learning-scan-statistics
Anti-virus machine learning scan statistics:
Machine learning scan engine version: 1696526121
Machine learning scan engine update time: 2023-10-05 22:48:50 UTC
Total HTTP HTTPS SMTP SMTPS IMAP IMAPS SMB
File scanned: 359382 68947 154549 14367 24591 12494 20025 52309
Virus found: 187713 1417 146795 13840 24591 12494 20025 25165
Virus blocked: 187713 1417 146795 13840 24591 12494 20025 25165
Virus permitted: 0 0 0 0 0 0 0 0
Meaning
Shows statistics on viruses scanned, identified and blocked or permitted.