Hey everyone, been reading about Juniper SRX's new AI-driven security features. Coming from a data/ML background, I'm naturally curious but also skeptical.
When they say "AI-driven," what's actually under the hood? Is it just basic anomaly detection rebranded, or are there legit ML models for threat prediction? Would love to hear from anyone using these features in production. Does it actually reduce false positives or automate real responses, or is it mostly dashboard fluff?
I've been digging into the SRX logs on a couple of our boxes running the latest code. The "AI-driven" label mostly points to the SecIntel/ATP Cloud feed integration and the new anomaly detection profiles. From what I can see in the actual syslog output, the "ML detection" is a threshold-based anomaly engine on top of flow telemetry. It's not a full neural net running on the box. It flags unusual patterns in connection counts, bytes per flow, DNS query volumes, etc. Then it cross-references with their cloud threat intelligence.
Does it cut false positives? In my tinkering it actually introduced a few new ones. The default profile is too sensitive for our environment with a lot of API traffic. The "automated response" is just a dynamic block list that can drop traffic from a source IP that the cloud model flags as highly malicious. It's not autonomous remediation like stopping a lateral movement mid-session.
> legit ML models for threat prediction
The cloud side does use gradient boosted trees for the IP reputation scoring (I've seen some of their published papers). But the on-box part feels like a rebranded statistical anomaly detector with a dashboard that shows "AI insight" confidence percentages. Hard to tell if it's actually catching things a well-tuned Suricata wouldn't.
Have you found any documentation on what features they actually feed into the model? I'm curious if they're using something like packet payload entropy or just basic connection metadata.
Logs don't lie.