Secure digital workspace using machine learning and microsegmentation

1. A method of authenticating a user of a computer system, wherein the user accesses the computer system using a computing device through a network, wherein the computer system implements a virtual desktop infrastructure (VDI), the method comprising:

receiving, from the computing device, authentication credentials;

determining that the authentication credentials match an authorized user of the computer system;

extracting, from the computing device, values of features of the computing device;

retrieving a machine learning (ML) model associated with the authorized user, wherein the ML model is at least one of (a) a supervised ML model or (b) an unsupervised ML model;

executing the ML model to authenticate the values of features of the computing device; and

based on one or more of the values of features of the computing device not being authenticated by the ML model:

providing the computing device access to a virtual desktop running within a virtual computing instance (VCI) of the computer system; and

restricting access privileges associated with the computing device with respect to the virtual desktop based on micro-segmentation through which one or more networks associated with the virtual desktop are divided into logical sub-networks such that the computing device is prevented from accessing one or more of the logical sub-networks.

2. The method of claim 1 , wherein the ML model is an unsupervised ML model, and wherein the method further comprises:

performing a secondary authentication process to determine whether a user using the computing device is the authorized user; and

based on the secondary authentication process determining that the user using the computing device is the authorized user, refitting the ML model such that bounds of normal data points encompass a data point represented by the values of features of the computing device.

3. The method of claim 2 , wherein the ML model is an isolation forest model having a contamination factor between 0.05 and 0.3.

4. The method of claim 1 , wherein the ML model is a supervised ML model, and wherein the method further comprises:

performing a secondary authentication process to determine whether a user using the computing device is the authorized user;

based on the secondary authentication process determining that the user using the computing device is the authorized user, adding the extracted values of features to a historical training file; and

retraining the supervised ML model using the historical training file.

5. The method of claim 4 , wherein the ML model is a logistic regression model.

6. The method of claim 1 , the method further comprising performing a fingerprint authentication by comparing the values of features of the computing device to corresponding values of features in the fingerprint, wherein a successful fingerprint authentication is based on whether values of features that are different between the corresponding values of features of the fingerprint and the values of features of the computing device satisfy a threshold.

7. The method of claim 1 , the method further comprising, subsequent to the executing the ML model to authenticate the values of features of the computing device:

assigning the VCI to the computing device, wherein the VCI is executing within a host computer of the computer system;

establishing a user session within the VCI for the computing device; and

executing a VDI client within the VCI, the VDI client configured to transmit a virtual desktop to the computing device.

8. The method of claim 7 , the method further comprising, based on the one or more of the values of features of the computing device not being authenticated by the ML model, configuring a firewall within the host computer such that the computing device has access to low sensitivity files but does not have access to high sensitivity files.

9. The method of claim 8 , wherein the firewall is executing within the VCI.

10. A system for authenticating a user of a computer system, wherein the user accesses the computer system using a computing device through a network, wherein the computer system implements a virtual desktop infrastructure (VDI), the system comprising:

at least one memory; and

at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to cause the system to:

receive, from the computing device, authentication credentials;

determine that the authentication credentials match an authorized user of the computer system;

extract, from the computing device, values of features of the computing device;

retrieve a machine learning (ML) model associated with the authorized user, wherein the ML model is at least one of (a) a supervised ML model or (b) an unsupervised ML model;

execute the ML model to authenticate the values of features of the computing device; and

based on one or more of the values of features of the computing device not being authenticated by the ML model:

provide the computing device access to a virtual desktop running within a virtual computing instance (VCI) of the computer system; and

restrict access privileges associated with the computing device with respect to the virtual desktop based on micro-segmentation through which one or more networks associated with the virtual desktop are divided into logical sub-networks such that the computing device is prevented from accessing one or more of the logical sub-networks.

11. The system of claim 10 , wherein the ML model is an unsupervised ML model, and wherein the at least one processor and the at least one memory are further configured to cause the system to:

perform a secondary authentication process to determine whether a user using the computing device is the authorized user; and

based on the secondary authentication process determining that the user using the computing device is the authorized user, refitting the ML model such that bounds of normal data points encompass a data point represented by the values of features of the computing device.

12. The system of claim 11 , wherein the ML model is an isolation forest model having a contamination factor between 0.05 and 0.3.

13. The system of claim 10 , wherein the ML model is a supervised ML model, and wherein the at least one processor and the at least one memory are further configured to cause the system to:

perform a secondary authentication process to determine whether a user using the computing device is the authorized user;

based on the secondary authentication process determining that the user using the computing device is the authorized user, add the extracted values of features to a historical training file; and

retrain the supervised ML model using the historical training file.

14. The system of claim 13 , wherein the ML model is a logistic regression model.

15. The system of claim 10 , wherein the at least one processor and the at least one memory are further configured to cause the system to perform a fingerprint authentication by comparing the values of features of the computing device to corresponding values of features in the fingerprint, wherein a successful fingerprint authentication is based on whether values of features that are different between the corresponding values of features of the fingerprint and the values of features of the computing device satisfy a threshold.

16. The system of claim 10 , wherein the at least one processor and the at least one memory are further configured to cause the system to, subsequent to executing the ML model to authenticate the values of features of the computing device:

assign the VCI to the computing device, wherein the VCI is executing within a host computer of the computer system;

establish a user session within the VCI for the computing device; and

execute a VDI client within the VCI, the VDI client configured to transmit a virtual desktop to the computing device.

17. The system of claim 16 , wherein the at least one processor and the at least one memory are further configured to cause the system to, based on the one or more of the values of features of the computing device not being authenticated by the ML model, configure a firewall within the host computer such that the computing device has access to low sensitivity files but does not have access to high sensitivity files.

18. The system of claim 17 , wherein the firewall is executing within the VCI.

19. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

receive from a computing device authentication credentials related to authenticating a user of a computer system, wherein the user accesses the computer system using the computing device through a network, wherein the computer system implements a virtual desktop infrastructure (VDI);

determine that the authentication credentials match an authorized user of the computer system;

extract from the computing device values of features of the computing device;

retrieve a machine learning (ML) model associated with the authorized user, wherein the ML model is at least one of (a) a supervised ML model or (b) an unsupervised ML model;

execute the ML model to authenticate the values of features of the computing device; and

based on one or more of the values of features of the computing device not being authenticated by the ML model:

provide the computing device access to a virtual desktop running within a virtual computing instance (VCI) of the computer system; and

restrict access privileges associated with the computing device with respect to the virtual desktop based on micro-segmentation through which one or more networks associated with the virtual desktop are divided into logical sub-networks such that the computing device is prevented from accessing one or more of the logical sub-networks.

20. The non-transitory computer-readable medium of claim 19 , wherein the ML model is an unsupervised ML model, and wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

perform a secondary authentication process to determine whether a user using the computing device is the authorized user; and

based on the secondary authentication process determining that the user using the computing device is the authorized user, refitting the ML model such that bounds of normal data points encompass a data point represented by the values of features of the computing device.