Utilizing machine learning for smart quarantining of potentially malicious files
Systems and methods include obtaining a file associated with a user for processing; utilizing a combination of policy for the user and machine learning to determine whether to i) quarantine the file and scan the file in a sandbox, ii) allow the file to the user and scan the file in the sandbox, and iii) allow the file to the user without the scan; responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and, responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.
1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
obtaining a file associated with a user for processing;
utilizing a combination of policy for the user and processing of the file with machine learning to determine whether to
i) quarantine the file and scan the file in a sandbox,
ii) allow the file to the user and scan the file in the sandbox, and
iii) allow the file to the user without the scan;
responsive to the allow the file, sending the file to the user independent of the sandbox;
responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and
responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
responsive to the file being allowed and the sandbox determining the file is malicious, marking the file as malicious and blocking the file a next time.
3. The non-transitory computer-readable storage medium of claim 1 , wherein the policy is used to determine whether to i) quarantine and iii) allow, and the machine learning is used to determine whether to ii) allow.
4. The non-transitory computer-readable storage medium of claim 1 , wherein the policy is used to determine whether to iii) allow, and the machine learning is used to determine whether to i) quarantine and ii) allow.
5. The non-transitory computer-readable storage medium of claim 1 , wherein the policy is used to determine whether to iii) allow, and the machine learning is used to determine whether to i) quarantine, ii) allow, and iii) allow.
6. The non-transitory computer-readable storage medium of claim 1 , wherein the machine learning includes a trained machine learning ensemble model configured to determine whether the file is malicious.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the obtaining is based on inline monitoring of the user by a cloud-based system.
8. An apparatus comprising:
a network interface communicatively coupled to a network;
a processor communicatively coupled to the network interface; and
memory storing computer-executable instructions that, when executed, cause the processor to
obtain a file associated with a user for processing;
utilize a combination of policy for the user and processing of the file with machine learning to determine whether to
i) quarantine the file and scan the file in a sandbox,
ii) allow the file to the user and scan the file in the sandbox, and
iii) allow the file to the user without the scan;
responsive to the allow the file, sending the file to the user independent of the sandbox;
responsive to the quarantine of the file and the sandbox determining the file is malicious, block the file; and
responsive to the quarantine of the file and the sandbox determining the file is benign, allow the file.
9. The apparatus of claim 8 , wherein the computer-executable instructions that, when executed, further cause the processor to
responsive to the file being allowed and the sandbox determining the file is malicious, mark the file as malicious and block the file a next time.
10. The apparatus of claim 8 , wherein the policy is used to determine whether to i) quarantine and iii) allow, and the machine learning is used to determine whether to ii) allow.
11. The apparatus of claim 8 , wherein the policy is used to determine whether to iii) allow, and the machine learning is used to determine whether to i) quarantine and ii) allow.
12. The apparatus of claim 8 , wherein the policy is used to determine whether to iii) allow, and the machine learning is used to determine whether to i) quarantine, ii) allow, and iii) allow.
13. The apparatus of claim 8 , wherein the machine learning includes a trained machine learning ensemble model configured to determine whether the file is malicious.
14. The apparatus of claim 8 , wherein the apparatus is a node in a cloud-based system.
15. A method comprising:
obtaining a file associated with a user for processing;
utilizing a combination of policy for the user and processing of the file with machine learning to determine whether to
i) quarantine the file and scan the file in a sandbox,
ii) allow the file to the user and scan the file in the sandbox, and
iii) allow the file to the user without the scan;
responsive to the allow the file, sending the file to the user independent of the sandbox;
responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and
responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.
16. The method of claim 15 , further comprising
responsive to the file being allowed and the sandbox determining the file is malicious, marking the file as malicious and blocking the file a next time.
17. The method of claim 15 , wherein the policy is used to determine whether to i) quarantine and iii) allow, and the machine learning is used to determine whether to ii) allow.
18. The method of claim 15 , wherein the policy is used to determine whether to iii) allow, and the machine learning is used to determine whether to i) quarantine and ii) allow.
19. The method of claim 15 , wherein the policy is used to determine whether to iii) allow, and the machine learning is used to determine whether to i) quarantine, ii) allow, and iii) allow.
20. The method of claim 15 , wherein the machine learning includes a trained machine learning ensemble model configured to determine whether the file is malicious.