- play_arrow Overview
- play_arrow Juniper Advanced Threat Prevention Cloud Overview
- play_arrow Juniper Advanced Threat Cloud Prevention Setup
-
- play_arrow Juniper ATP Cloud Web Portal
- play_arrow Juniper ATP Cloud Web Portal Overview
-
- play_arrow Enroll SRX Series Firewalls in Juniper ATP Cloud Web Portal
- play_arrow Configure Juniper ATP Cloud Features
- play_arrow Allowlists and Blocklists
- play_arrow Email Scanning: Juniper ATP Cloud
- play_arrow File Inspection Profiles
- play_arrow Adaptive Threat Profiling
- play_arrow Feeds Configuration
- play_arrow Infected Hosts
- play_arrow Threat Intelligence Sharing
- play_arrow Misc Configurations
-
- play_arrow Administration
- play_arrow Juniper ATP Cloud Administration
- Modify My Profile
- Create and Edit User Profiles
- Set Password
- Application Tokens Overview
- Create Application Tokens
- Multi-Factor Authentication Overview
- Configure Multi-Factor Authentication for Administrators
- Set Up Single Sign-on with SAML 2.0 Identity Provider
- Configure SSO Settings
- View Audit Logs
-
- play_arrow More Documentation
- play_arrow ATP Cloud Tech Library Page Links
-
DNS DGA Detection Overview
Domain Name System (DNS) Domain Generation Algorithm (DGA) generates random domain names that are used as rendezvous points with potential C&C servers. DNS DGA detection uses machine learning (ML) models as well as known pre-computed DGA domain names and provides domain verdicts, which helps inline blocking and sinkholing of DNS queries on SRX Series Firewalls.
Juniper ATP Cloud provides an ML-based DGA detection model. SRX Series Firewall acts as a collector of security metadata and streams the metadata to Juniper ATP Cloud for DGA analysis. We use both ATP Cloud service and security-metadata-streaming framework to conduct DGA Inspection in the cloud.
DNS DGA detection is available only with Juniper ATP Cloud license. For feature specific licensing information, see Software Licenses for ATP Cloud
To view DNS DGA detections, log in to Juniper ATP Cloud Web portal and navigate to Monitor > DNS. The DGA detections are displayed as shown in Figure 1
To enable DNS DGA detections on SRX Series Firewalls, see Juniper Advanced Threat Prevention Cloud Administration Guide.
Domain Name System Security Extensions (DNSSEC) and Extension Mechanisms for DNS (EDNS) queries are dropped by default.
