Advanced Threat Prevention now supports
Local Deep Learning, which provides a
mechanism to perform fast, local deep learning-based analysis of zero-day and other
evasive threats, as a complementary feature to the
cloud-based Inline Cloud Analysis component of
Advanced Threat Prevention. With an Advanced Threat Prevention license,
known malicious traffic that matches against Palo Alto Networks published signature
set are dropped (or have another user-defined action applied to them); however,
certain traffic that matches the criteria for suspicious content are rerouted for
analysis using the Deep Leaning Analysis detection module. If further analysis is
necessary, the traffic is sent to the Advanced Threat Prevention cloud for
additional analysis, as well as the requisite false-positive and false-negative
checks. The Deep Learning detection module is based on the proven detection modules
operating in the Advanced Threat Prevention cloud, and as such, have the same
zero-day and advanced threat detection capabilities. However, they also have the
added advantage of processing a much higher volume of traffic, without the lag
associated with cloud queries. This enables you to inspect more traffic and receive
verdicts in a shorter span of time. This is especially beneficial when faced with
challenging network conditions.
