Systems and methods for prioritizing and detecting file datasets based on metadata
The disclosed computer-implemented method for prioritizing and detecting file datasets based on metadata may include (i) receive a group of files from a data storage, (ii) train a machine-learning model utilizing a set of properties derived from metadata associated with the files, (iii) identify, utilizing the machine-learning model, a dataset including at least one candidate file that performs an action in a set of predetermined actions, and (iv) prioritize the action based on the dataset. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for prioritizing and detecting file datasets based on metadata, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by the computing device, a plurality of files from a data storage;
training, by the computing device, a machine-learning model utilizing a set of properties derived from metadata associated with the files, wherein training the machine-learning model comprises:
scanning the metadata to identify the properties, the properties comprising features to include in training data;
utilizing the training data to build a classifier for each action in a set of predetermined actions; and
verifying the classifier, wherein verifying the classifier comprises:
determining an accuracy of the classifier for the each action;
discarding the classifier when the classifier is inaccurate:
receiving new training data in the machine-learning model; and
rebuilding the classifier based on the new training data;
identifying, by the computing device and utilizing the machine-learning model, a dataset comprising at least one candidate file that performs an action in a set of predetermined actions; and
prioritizing, by the computing device, the action based on the dataset.
2. The computer-implemented method of claim 1 , wherein scanning the metadata comprises scanning at least one of file metadata, user metadata, and access metadata.
3. The computer-implemented method of claim 2 , wherein the file metadata, the user metadata, and the access metadata comprise at least one of:
file directory service data;
file directory data;
access control list data; and
file access data.
4. The computer-implemented method of claim 1 , wherein the features comprise at least one of:
file owner attribute data;
file user attribute data;
file type data;
file activity data;
file permission data;
file age data;
filename classification data; and
file share risk data.
5. The computer-implemented method of claim 1 , wherein identifying the dataset comprises predicting the dataset utilizing the machine-learning model.
6. The computer-implemented method of claim 5 , wherein predicting the dataset comprises predicting that the candidate file is included in the dataset.
7. The computer-implemented method of claim 1 , wherein the predetermined actions comprise at least one of:
a file remediation action; and
a file classification action.
8. A system for prioritizing and detecting file datasets based on metadata, the system comprising:
a receiving module, stored in memory, that receives a plurality of files from a data storage;
a training module, stored in the memory, that trains a machine-learning model utilizing a set of properties derived from metadata associated with the files, wherein training module trains the machine-learning model by:
scanning the metadata to identify the properties, the properties comprising features to include in training data;
utilizing the training data to build a classifier for each action in a set of predetermined actions; and
verifying the classifier, wherein verifying the classifier comprises:
determining an accuracy of the classifier for the each action;
discarding the classifier when the classifier is inaccurate:
receiving new training data in the machine-learning model; and
rebuilding the classifier based on the new training data;
an identification module, stored in the memory, that utilizes the machine-learning model to identify a dataset comprising at least one candidate file that performs an action in a set of predetermined actions;
a prioritization module, stored in the memory, that prioritizes the action based on the dataset; and
at least one physical processor that executes the receiving module, the training module, the identification module, and the prioritization module.
9. The system of claim 8 , wherein the training module scans the metadata by scanning at least one of file metadata, user metadata, and access metadata.
10. The system of claim 9 , wherein the file metadata, the user metadata, and the access metadata comprise at least one of:
file directory service data;
file directory data;
access control list data; and
file access data.
11. The system of claim 8 , wherein the features comprise at least one of:
file owner attribute data;
file user attribute data;
file type data;
file activity data;
file permission data;
file age data;
filename classification data; and
file share risk data.
12. The system of claim 8 , wherein the identification module identifies the dataset by predicting the dataset utilizing the machine-learning model.
13. The system of claim 12 , wherein the identification module predicts the dataset by predicting that the candidate file is included in the dataset.
14. The system of claim 8 , wherein the predetermined actions comprise at least one of:
a file remediation action; and
a file classification action.
15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive a plurality of files from a data storage;
train a machine-learning model utilizing a set of properties derived from metadata associated with the files, wherein the one or more computer-executable instructions cause the computing device to train the machine-learning model by:
scanning the metadata to identify the properties, the properties comprising features to include in training data;
utilizing the training data to build a classifier for each action in a set of predetermined actions; and
verifying the classifier, wherein verifying the classifier comprises:
determining an accuracy of the classifier for the each action;
discarding the classifier when the classifier is inaccurate:
receiving new training data in the machine-learning model; and
rebuilding the classifier based on the new training data;
identify, utilizing the machine-learning model, a dataset comprising at least one candidate file that performs an action in a set of predetermined actions; and
prioritize the action based on the dataset.
16. The non-transitory computer-readable medium of claim 15 , wherein the metadata comprises at least one of file metadata, user metadata, and access metadata.
17. The non-transitory computer-readable medium of claim 16 , wherein the file metadata, the user metadata, and the access metadata comprise at least one of:
file directory service data;
file directory data;
access control list data; and
file access data.
18. The non-transitory computer-readable medium of claim 15 , wherein the features comprise at least one of:
file owner attribute data;
file user attribute data;
file type data;
file activity data;
file permission data;
file age data;
filename classification data; and
file share risk data.
19. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-executable instructions cause the computing device to identify the dataset by predicting the dataset utilizing the machine-learning model.
20. The non-transitory computer-readable medium of claim 19 , wherein predicting the dataset comprises predicting that the candidate file is included in the dataset.