Bringing Precision AI to the network layer to block attacker internet infrastructure with Advanced IP Defense

[davchen]

As adversaries deploy increasingly automated, machine-speed evasion tactics, traditional security models are hitting a critical bottleneck. Historically, network perimeters have relied on Layer 7 payload analysis, domain reputations, and URL filters to block threats. While highly effective at inspecting traditional traffic, these L7 controls have a blindspot when malware bypasses name resolution and web based URL and connects to the attacker infrastructure directly using IP address.

According to Unit 42 telemetry, 23% of all modern malware command-and-control (C2) connections bypass DNS completely, establishing outbound socket connections directly to hardcoded IP addresses. At the same time, adversaries are weaponizing automated scanning across vast residential proxy networks, hopping rapidly between IP addresses in fractions of a second to evade rate limits and static blocklists. A recent Wall Street Journal investigation laid out the immense scale of this tactic, exposing a cyber campaign that used a network with over 750,000 consumer routers and smart devices.

This blog post explores how Palo Alto Networks is closing this evasion vector by extending Precision AI directly to the network layer with Advanced IP Defense—denying access at the network layer by blocking attacker internet infrastructure outright.

 

The Breakdown of Legacy IP Feeds and Custom Scripting

To protect perimeters, many organizations have historically relied on commercial third-party threat feeds or open-source intelligence (OSINT) blocklists, operationalized as External Dynamic Lists (EDLs) on their edge firewalls. While conceptually straightforward, this architecture introduces massive operational friction:

1. The 20-Day Exposure Gap: Legacy threat intelligence feeds are fundamentally reactive. They rely on isolated honeypots and post-incident forensic blogs, resulting in an average delay of 20 days before a newly spun-up malicious host is identified and pushed to your firewall.
2. Administrative Scripting Burden: Network operations teams spend significant bandwidth writing, testing, and troubleshooting custom Python or Bash scripts to scrape, deduplicate, and host raw IP lists. In fact, 30% of surveyed network administrators report that manually managing dynamic blocklists and chasing down stale entries is their most painful operational burden.
3. Physical Capacity Constraints: Physical next-generation firewalls (NGFWs) have hard memory limits that restrict predefined dynamic lists to fewer entries. When threat feeds scale into millions of active IPs, the firewall is forced to truncate lists, creating dangerous blind spots.
4. Binary "All-or-Nothing" Outages: Legacy blocklists are binary—they either block or allow an IP address entirely. If an attacker hosts a temporary C2 node inside a shared hosting environment or public cloud (like AWS, Azure, GCP, or a CDN), blocking that IP outright causes catastrophic self-inflicted outages, breaking legitimate business traffic accessing the same shared platforms.

 

Introducing Advanced IP Defense: Real-Time, Context-Aware Network Security

To close these critical security and operational gaps, Palo Alto Networks is introducing Advanced IP Defense, a new Cloud-Delivered Security Service (CDSS) that extends Precision AI directly to the network layer. Rather than relying on reactive, payload-based signature matching or static blocklists, Advanced IP Defense continuously monitors, scores, and categorizes the entire publicly routable IP address space of over 8 million active threat hosts in real time.

Operating inline at the security zone boundary, Advanced IP Defense evaluates traffic—prior to Layer 7 session establishment and without requiring resource-heavy SSL/TLS decryption. By acting as an authoritative front-door guard, it proactively blocks malicious scanning, exploit delivery, and command-and-control (C2) callback attempts at the network edge before they can ever reach your assets or execute payloads.

 

Under the Hood: Key Pillars of Advanced IP Defense

Operating inline and cloud-delivered, Advanced IP Defense addresses these structural weaknesses at the network layer, requiring zero SSL/TLS decryption to evaluate and enforce security verdicts. It achieves this through three core technical capabilities:

1. Real-Time Cloud-Scale Intelligence

Advanced IP Defense abandons slow-moving, static lists in favor of an active, cloud-delivered scoring database. Translating global telemetry from over 75,000 enterprise customers and 1,600 research sources, the engine dynamically monitors and maps the entire publicly routable IP address space across 40+ security attributes (including malware_c2, tor_exit, open_proxy, and bulletproof_hosting).

2. Zero-Trust IP (ZT-IP)

Zero-Trust IP is a major paradigm shift that moves beyond static reputation lookups to evaluate a client’s behavioral intent. Under a Zero-Trust IP policy, the firewall dynamically tracks local client DNS traffic. If an endpoint attempts to connect outbound to a public cloud IP address, the firewall verifies if that connection was preceded by a valid, benign DNS resolution.

If a legitimate user opens an application, a DNS request is made, cached, and the connection is allowed. However, if an evasive malware script attempts to phone home direct-to-IP to a hardcoded host in AWS or GCP, Zero-Trust IP identifies the complete lack of a preceding DNS query. It instantly identifies the connection as direct-to-IP, and allows the admin to choose an action — (allow or drop), even if that shared cloud IP is explicitly allowed for business traffic.

3. Granular Context & Attributes

Rather than treating IP addresses as binary "allow or deny" blocklists, Advanced IP Defense continuously profiles and categorizes every publicly routable IPv4 address across over 40 rich, dynamic security attributes. These attributes are organized into seven primary, content-delivered categories:

• Anonymizers: Identifying Tor Exit Nodes, Open Proxies, Private Proxies, and Commercial VPN endpoints.
• Malware-C2: Flagging active Malware C2 infrastructure, Malware Downloads, Shellcode injection targets, Malware-communicated nodes, and IPs hardcoded directly inside binaries.
• Abuse: Tracking malicious actors actively conducting automated port scanning and credential brute-force campaigns.
• High Risk: Preemptively mapping Bulletproof Hosting providers that intentionally shelter adversaries and ignore takedown requests.
• Vulnerable Services: Identifying exposed internet-facing systems vulnerable to active, critical CVEs or exploit scanning.
• Association: Classifying infrastructure based on Content Delivery Networks (CDNs), major cloud providers (AWS, GCP, Azure, OCI), and residential ISPs.
• Direct-to-IP: Flagging sessions initiating socket connections without name resolution.
  
  

4. The Patented "Indicator of Benignity" Pipeline

Because blocking at the IP layer carries high false-positive risks, Palo Alto Networks engineered a patented pipeline called the Indicator of Benignity. Standard threat feeds only look for signs of compromise. The Indicator of Benignity engine actively searches for positive indicators of clean, legitimate usage to counterprove and immediately suppress malicious classifications. This rigorous filtering maintains an exceptionally high standard of precision, keeping false positives to an absolute minimum so network teams can sleep at night.

 

Example Deployment Use Cases

Operating inline and cloud-delivered, Advanced IP Defense addresses these structural weaknesses at the network layer, requiring zero SSL/TLS decryption to evaluate and enforce security verdicts. It achieves this through three core technical capabilities:

Outbound Protection: Stopping Direct-to-IP Malware & Exfiltration

• The Threat: Ransomware droppers, P2P botnets, and malware scripts attempting to connect to hardcoded IPs to bypass existing network defenses such as domain or URL inspections.
• The Solution: An outbound Advanced IP Defense profile evaluates the destination IP. The firewall blocks known threat attributes inline (such as malware-c2 or malware-download). For shared CDN or cloud ranges, the firewall triggers Zero-Trust IP behavioral matching to drop any direct-to-IP socket connections that bypass local name resolution.
  
  

Inbound Protection: Hardening Public Gateways

• The Threat: Attackers hiding behind commercial VPNs, proxies, or Tor exit nodes to execute massive, automated vulnerability scanning, brute-forcing, and reconnaissance against public-facing VPN portals or DMZs.
• The Solution: An inbound policy rule leverages Advanced IP Defense categories (such as anonymizers-and-proxies or abuse) to instantly block traffic matching tor-exit, open-proxy, or commercial-vpn tags, dropping scans at the network edge before they can probe public servers.

 

Implementation Best Practices

To ensure a smooth, disruption-free deployment of Advanced IP Defense, Palo Alto Networks recommends the following administrative guardrails:

• Leverage the 7-Day Alert Grace Period: When first enabling Zero-Trust IP, configure the policy action to "alert" mode for the first 7 days. Clients on your network may have pre-existing DNS resolutions cached locally in their operating systems. Enforcing immediate blocks can cause temporary disruption to these active, legitimate sessions. The 7-day alert window allows local caches and the cloud-delivered seen-states to synchronize safely.
• Manage Encrypted DNS within Zero-Trust Architectures: Zero-Trust IP requires the firewall to passively inspect DNS traffic crossing a zone, parsing the IP-TTL pairs from DNS responses to build its local state tables. If endpoints are allowed to utilize encrypted DNS protocols like DoH or DoT, their queries are encrypted within secure TLS tunnels, blinding the firewall’s DNS parsing engine. Use App-ID rules to actively block and drop DoH (dns-over-https) and DoT (dns-over-tls) traffic, forcing clients to gracefully fall back to cleartext DNS over UDP port 53 (support for DoH in the future).
• Considerations for HA Setups: While Advanced IP Defense can work in HA environments, administrators should be aware of certain considerations to ensure smooth operation, but local caches do not actively synchronize between peers in real time. Upon an active-passive failover, the newly active peer starts with a cold cache and must query the Advanced IP Defense cloud service to populate lookups from scratch. During this warm-up window, cache-miss traffic defaults to "fail-open" to prevent business disruption. For this reason, Direct-to-IP blocking rules are not recommended in Active-Active HA setups due to asymmetric routing paths and timing delays that can cause intermittent false blocks.
  
  

Conclusion: A Unified Security Architecture

Advanced IP Defense extends Precision AI to the network layer, hardening your perimeter against threats that bypass standard protocol and web-level inspection engines:

• Inbound Gateway Hardening: Pre-screens public-facing portals and DMZs to block anonymizers and residential proxy botnets before automated scans ever touch your infrastructure.
• Outbound Evasion Prevention: Leverages Zero Trust IP correlation to stop attacks such as direct-to-IP C2 callbacks.

Shifting prevention to the edge replaces 20-day feed lags with real-time intelligence, removes static blocklist overhead, and slashes SOC alert noise across the 67% of enterprise networks exposed to preventable network-layer threats.

Ready to close your network-layer evasion gaps?

Evaluate Your Exposure with a Security Lifecycle Review (SLR): Palo Alto Networks has integrated Advanced IP Defense reporting directly into the Security Lifecycle Review (SLR) tool. Work with your account team to run an SLR on your edge firewalls to receive a customized report highlighting the stealthy direct-to-IP bypasses, malicious scanners, and anonymizers currently traversing your network uninspected.

Activate a 30-Day Free Trial: Qualified customers can immediately activate a 30-day free trial. Run the profile in "Alert" (monitor-only) mode first to validate detection accuracy and view full threat visibility in your SCM dashboards without any risk of traffic interruption.

Prepare for PAN-OS 12.2 Ceres: To leverage full real-time inline cloud lookups, zone-based profiles, and Zero-Trust IP behavioral enforcement, coordinate with your network security team to plan your upgrade to PAN-OS 12.2 (Ceres).

Contact your Palo Alto Networks account representative today to schedule a live, technical demonstration of Advanced IP Defense.