Predictive model application for file upload prevention determination

Abstract

According to an example, an apparatus can include a memory having stored thereon machine-readable instructions that can cause a processor to receive a request to upload a file to a directory and determine whether the request is a request to upload a file of a predefined type to the directory. Further, based on a determination that the request is a request to upload a file of the predefined type to the directory, the processor can determine, through application of a predictive model, whether the directory is a user content directory and, based on a determination that the application of the predictive model indicates that the directory is a user content directory, block the request and / or output a notification regarding receipt of the request.

Description

Background Technology

[0001] Many websites offer directories where users can upload various types of files via the internet. Users may upload files to directories for storage, security, and / or to share with other users. In some cases, directories can be vulnerable to arbitrary file upload attacks, where malicious users can upload files containing server-side executable code. In these types of attacks, when a file is accessed, the server may run server-side executable code, which may include malicious code or backdoor code, potentially exposing the server to the attack. Attached Figure Description

[0002] Features of this disclosure are shown by way of example, but are not limited to, the following figures(s), wherein similar numbers denote similar elements, wherein:

[0003] Figure 1 A block diagram of a network environment according to an embodiment of the present disclosure is shown, wherein the apparatus can determine whether to block a request to upload a file of a predefined type based on whether the application indication directory of the prediction model is a user content directory;

[0004] Figure 2 Embodiments according to this disclosure are depicted. Figure 1 A block diagram of the device depicted in the image;

[0005] Figure 3 A flowchart is depicted illustrating a method, according to embodiments of the present disclosure, for applying a predictive model to a particular directory to determine whether that particular directory will receive files of a predefined type from a user; and

[0006] Figure 4 A block diagram of a computer-readable medium according to an embodiment of the present disclosure is depicted, the computer-readable medium having computer-readable instructions thereon for determining, through the application of a predictive model, whether the destination of an upload request will receive an executable file. Detailed Implementation

[0007] For simplicity and illustrative purposes, the principles of this disclosure are described primarily with reference to embodiments and examples thereof. In the following description, numerous specific details are set forth to provide an understanding of the embodiments and examples. However, it will be apparent to those skilled in the art that the embodiments and examples can be practiced without being limited to these specific details. In some instances, well-known methods and / or structures have not been described in detail to avoid unnecessarily obscuring the description of the embodiments and examples. Furthermore, embodiments and examples can be used in various combinations.

[0008] In this disclosure, the terms "a" and "an" are intended to mean at least one specific element. As used herein, the term "comprising" means including but not limited to, and the term "including" means including but not limited to. The term "based on" means at least partially based on.

[0009] As mentioned above, directories that receive user content uploads can be vulnerable to attacks such as arbitrary file upload attacks. In some cases, directories that typically receive user content uploads may be known and can be monitored for potential malicious upload requests. However, in many cases, determining whether a directory typically receives user content uploads (e.g., non-executable files) may not be a priori, because, for example, there are a relatively large number of directories that users can use to upload various types of files. In other cases, a directory may simply not be identified as intended for receiving user content or for receiving executable files. Without such information about directories, it can be difficult to distinguish between directories that receive executable files and those that do not. As a result, potentially malicious files may be uploaded to user content directories, which could expose the servers associated with those directories to attacks, such as arbitrary file upload attacks.

[0010] This document discloses systems, apparatus, methods, and computer-readable media in which processors can reduce or prevent attacks deployed through user content directories. Specifically, the processor can determine whether a directory is a user content directory, and based on this determination, can prevent the upload of files of predefined types to that directory. For example, the processor can prevent the upload of executable files (e.g., files containing server-side executable code) to a directory that the processor has determined to be a user content directory. One technical problem discussed above is that directories may be vulnerable to attacks by malicious users, such as arbitrary file attacks. The technical solution provided in this disclosure can protect directories, and thus the server hosting the directory, from such attacks.

[0011] As discussed in this paper, the processor can apply a predictive model to categorize directories as either receiving files of predefined types from the user or not receiving files of predetermined types from the user. The predictive model can be generated by feeding a training set of data into a machine learning operation, where the training set can include data related to user uploads to directories of multiple file types. Furthermore, the processor can input features or characteristics of a directory into the predictive model, and the model can predict whether the directory is likely a user-generated content directory. The processor can also determine whether to allow a requested file upload based on the prediction.

[0012] First refer to Figure 1 and Figure 2 . Figure 1A block diagram of a network environment 100 according to an embodiment of the present disclosure is shown, wherein device 102 can determine whether to block a request to upload a file of a predefined type based on whether the application indication directory of the prediction model is a user content directory. Figure 2 Embodiments according to this disclosure are depicted. Figure 1 The block diagram of the device 102 depicted herein is shown. It should be understood that the network environment 100 and the device 102 of the network environment 100 may include additional features, and some features described herein may be removed and / or modified without departing from the scope of the network environment 100 or the device 102.

[0013] like Figure 1 As shown, network environment 100 may include device 102, multiple users 120a-120n, directories 130a-130m, and network 140. According to the example, device 102 may be a server or other type of computing device, such as a network gateway, access point, etc., which can provide security services (and other services) to directories 130a-130m, where the variable "m" can represent a value greater than 1. In some examples, each user among users 120a-120n can submit a request to upload files via a computing device (such as a personal computer, laptop computer, tablet computer, smartphone, handheld scanning device, etc.), where the variable "n" can represent a value greater than 1.

[0014] According to the example, some or all of directories 130a-130m may each include a Uniform Resource Locator (URL), folders, etc. Furthermore, some or all of directories 130a-130m may be websites or other online services to which users 120a-120n can upload files. Some of these files may include executable files, which may include files containing executable code, executable programs, etc., and can be defined as files containing encoded instructions that, when executed, can cause a computer or server to perform the instructed task. Alternatively, some files may include non-executable files, which may include data files that do not include encoded instructions. Examples of data files may include image files, video files, document files, and / or similar types.

[0015] like Figure 1As further illustrated, each of users 120a-120n can upload request 122 to device 102 via network 140 to upload files to directories 130a-130m. Network 140 can be any suitable type of network through which users 120a-120 (e.g., computing devices used by users 120a-120n) and device 102 can communicate with each other, such as the Internet, wide area network, local area network, and / or the like. Furthermore, device 102 and directories 130a-130m can be part of a public network, for example, part of a public domain 132, a component within a public firewall, and / or the like.

[0016] like Figure 1 and Figure 2 As shown, device 102 may include processor 104, memory 106, and data storage 108. Data storage 108 may be random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), a storage device, etc. Data storage 108 may store a prediction model 110 thereon, which can be used to classify directories into user content directories that will accept certain types of files but not others. Prediction model 110 may be in the form of an equation, a system of equations, or may have other suitable forms. In some examples, processor 104 may generate prediction model 110 by performing machine learning operations on a training set of data, where the training set of data may include data related to user uploads of multiple types of files to the directory. In other examples, another processor or device (not shown) may generate prediction model 110.

[0017] As discussed herein, device 102, and more specifically, processor 104, can use predictive model 110 to control whether upload request 122 is satisfied or rejected. In one aspect, device 102 can operate to provide security to directories 130a-130m, for example, by controlling the permission and rejection of user-uploaded files to directories 130a-130b. That is, device 102 can block the upload of certain types of files to certain directories where files might expose those directories and / or components within domain 132 to attacks such as arbitrary file upload attacks, denial-of-service attacks, phishing attacks, etc. In particular, device 102 can apply predictive model 110 to directory 130a to determine whether a particular directory 130a is a user content directory.

[0018] In general, a user content directory can be a directory where users can normally upload non-executable files and therefore typically do not accept files of predefined types (e.g., executable files, specific types of executable files, etc.). Based on the determination that a specific directory 130a is a user content directory and therefore typically does not accept files of predefined types, device 102 can take action to prevent files from being uploaded to the specific directory 130a and / or can output a notification about a potential attack.

[0019] Processor 104 can control the operation of device 102, and memory 106 can store data that processor 104 can access and / or execute. Processor 104 can be a semiconductor-based microprocessor, central processing unit (CPU), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), and / or other hardware device. Memory 106 can also be referred to as a computer-readable medium, such as random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), storage device, etc. Memory 106 can be a non-transient computer-readable storage medium, where the term "non-transient" excludes transient propagation signals. In any respect, memory 106 can store machine-readable instructions executable by processor 104 thereon.

[0020] Although device 102 is described as having a single processor 104, it should be understood that device 102 may include additional processors and / or cores without departing from the scope of device 102. In this regard, references to a single processor 104 and a single memory 106 can be understood to additionally or alternatively refer to multiple processors 104 and multiple memories 106. Furthermore, or alternatively, processor 104 and memory 106 may be integrated into a single component, for example, an integrated circuit of processor 104 and processor 106 may be provided thereon. Furthermore, or alternatively, the operations performed by processor 104 as described herein may be distributed across multiple devices 102 and / or multiple processors 104.

[0021] like Figure 2As shown, memory 106 may store machine-readable instructions 200-206 executable by processor 104. Although instructions 200-206 are described herein as being stored on memory 106 and thus may comprise a set of machine-readable instructions, device 102 may include hardware logic blocks that can perform functions similar to instructions 200-206. For example, processor 104 may include hardware components capable of executing instructions 200-206. In other examples, device 102 may include combinations of instructions and hardware logic blocks to implement or perform functions corresponding to instructions 200-206. In any of these examples, processor 104 may implement hardware logic blocks and / or execute instructions 200-206. As discussed herein, device 102 may also include additional instructions and / or hardware logic blocks such that processor 104 can perform functions other than those described above. Figure 2 Operations other than those discussed, or operations performed in place of those operations.

[0022] Processor 104 can execute instruction 200 to receive a request 122 to upload a file to directory 130a. For example... Figure 1 As shown, processor 104 can receive file upload request 122 from user 120a (e.g., client device) via network 140. Upload request 122 may include information identifying directory 130a, such as the IP address, URL, etc. of directory 130a. Upload request 122 may also include the file being requested to be uploaded.

[0023] Processor 104 can execute instruction 202 to determine whether upload request 122 is a request to upload a file of a predefined type to directory 130a. That is, for example, processor 104 can analyze the requested file to determine whether the file is of a predefined type. For instance, processor 104 can determine whether the file contains executable code, such as whether the file is an executable file, a specific type of executable file, or a file containing server-side executable code. Processor 104 can make this determination based on, for example, the file name, the file name extension, etc.

[0024] Based on the determination that the request is for uploading a file that does not belong to a predefined type, processor 104 may allow upload request 122 to be satisfied, thereby allowing the file to be uploaded to directory 130a. That is, for example, based on the determination that the file in upload request 122 is not an executable file, such as not including server-side executable code, processor 104 may allow upload request 122.

[0025] However, based on the determination that the request is for uploading files of a predefined type to directory 130a, processor 104 may execute instruction 204 to determine, through the application of prediction model 110, whether directory 130a is a user content directory. A user content directory can be a directory to which users 120a-120n can typically upload certain types of files (such as data files, image files, video files, document files, and / or the like). In other words, a user content directory can be a directory to which users 120a-120n typically or never upload executable files (e.g., files containing server-side executable code). In some cases, processor 104 may not determine a priori whether directory 130a is a user content directory (e.g., whether it receives files of a predefined type). Since the set of domains 132 or other directories may include a large number of directories 130a-130m, such as hundreds or thousands of directories, and / or since new directories may continue to be added, it may be impractical or infeasible for processor 104 to a priori determine whether each directory in directories 130a-130m is a user content directory. In other words, it may be impractical or infeasible for processor 104 to a priori determine whether each directory in directories 130a-130m is a user content directory.

[0026] As discussed herein, prediction model 110 can be used to classify directory 130a as whether it is a user content directory. In other words, prediction model 110 can classify directory 130a as, for example, specified or configured to receive predefined types of files from users 120a-120n. That is, for example, prediction model 110 can identify features or characteristics of directory 130a, and the identified features or characteristics can be input into the prediction model. Features or characteristics of directory 130a may include, for example, tags, identifiers, URLs, etc. in directory 130a. In some examples, processor 104 can generate prediction model 110 by performing machine learning operations on a training set of data, where the training set of data includes data related to user uploads of multiple types of files to the directory. In other examples, prediction model 110 can be pre-generated and stored in data storage 108, and processor 104 can access prediction model 110 from data storage 108.

[0027] Processor 104 can apply prediction model 110 to the input features or characteristics to determine whether directory 130a is a user content directory, thereby preventing the receipt of predefined types of files from users 120a-120n, such as files containing server-side executable code. In other words, processor 104 can determine whether prediction model 110 predicts, based on the input features or characteristics, that directory 130a is a user content directory or that directory 130a has a higher probability of receiving predefined types of files. For example, user content directories typically include words or combinations of words indicating their purpose, such as photos, videos, user playlists, etc. Therefore, prediction model 110 can predict that directory 130a has a high probability of becoming a user content directory based on the presence of specific words in directory 130a.

[0028] Furthermore, based on the determination by prediction model 110 that directory 130a is a user content directory, processor 104 can execute instruction 206 to block requests and / or output notifications regarding the receipt of requests. In other words, based on processor 104's determination by application prediction model 110 that directory 130a is a user content directory, processor 104 can prevent the uploaded files in the request from being uploaded to directory 130a. Therefore, processor 104 can prevent files including server-side executable code from being uploaded to directory 130a.

[0029] Additionally, or alternatively, processor 104 may output a notification indicating that a request to upload a file of a predefined type to directory 130a has been received. In other words, the notification may indicate that a request to upload an executable file (e.g., a file containing server-side executable code) to the user's content directory has been received. Processor 104 may output this notification, along with, for example, an error message, to user 120a who submitted upload request 122, to notify user 120a that upload request 122 has been rejected. Processor 104 may additionally or alternatively output notifications to administrators, logs, etc.

[0030] However, since the application-indicated directory 130a of the determination prediction model 110 is not a user content directory, the processor 104 may allow the request to be fulfilled. That is, the processor 104 may allow the file in upload request 122 to be uploaded to directory 130a. In other words, the processor 104 may allow files that are executable files to be uploaded to directory 130a based on the determination that the application-indicated directory 130a of the determination prediction model 110 is designated to receive executable files (e.g., server-side executable files) from users 120a-120n.

[0031] about Figure 3 Method 300 describes in more detail the various ways in which the processor 104 of device 102 can operate. Specifically, Figure 3A flowchart depicts a method 300 according to embodiments of the present disclosure for applying a predictive model to a specific directory 130a to determine whether the specific directory 130a will receive files of a predefined type from users 120a-120n. It should be understood that... Figure 3 The described method 300 may include additional operations, and some of said operations may be removed and / or modified without departing from the scope of method 300. For illustrative purposes, the description of method 300 will refer to... Figure 1 and Figure 2 The features described in the text.

[0032] In box 302, processor 104 can use a training set of data to generate a prediction model 110, which will be used to classify directories as either receiving files of a predefined type from users 120a-120n or not receiving files of a predetermined type from users 120a-120n. Specifically, for example, processor 104 can access a training set of data that may include data related to user uploads of multiple file types to multiple directories. The multiple file types may include data files, executable files, server-side executable files, etc. Furthermore, the training set of data may include manually managed data and / or real-world data related to user uploads of multiple file types to directories.

[0033] According to the example, processor 104 can use machine learning operations on the training set of data to generate a predictive model 110. Processor 104 can employ any suitable machine learning operation on the training set of data to generate the predictive model 110. For example, processor 104 can employ supervised learning algorithms, recurrent neural network algorithms, word packets, doc2vec with regression, etc. In any respect, processor 104 can use machine learning operations to identify, for example, various features or correlations between features of multiple directories in the training set of data, and whether multiple directories normally receive certain types of files, such as whether a directory only receives data files from a user, only receives executable files from a user, or both. Processor 104 can generate the predictive model 110 based on the features or characteristics of the directories to model the behavior of the directories, such as whether the directory receives executable files.

[0034] In box 304, processor 104 can access request 122 to upload a file to a specific directory 130a, where the file is a file of a predefined type. Processor 104 can access upload request 122 by, for example, receiving upload request 122 from user 120a via network 140. In some examples, device 102 providing processor 104 may be a gateway device through which network traffic from network 140 can be routed. In other examples, device 102 may be a server that can provide security and / or other services to directories 130a-130m in domain 132. In any respect, processor 104 may receive upload request 122 before the request is submitted to directory 130a.

[0035] In box 306, processor 104 can apply prediction model 110 to a specific directory 130a to determine whether the specific directory 130a will receive files of a predefined type from users 120a-120n. That is, processor 104 can input features of the specific directory 130a (e.g., filename, URL, etc.) into prediction model 110 and can apply prediction model 110 to determine whether the specific directory 130a will receive files of a predefined type from users 120a-120n. In some examples, the application of prediction model 110 to a specific directory 130a can lead to a determination of whether the specific directory 130a is a user content directory.

[0036] Based on the determination in box 306 that a specific directory 130a will receive files of a predefined type from users 120a-120n, processor 104 may allow files to be uploaded to the specific directory 130a in box 308. That is, for example, based on the determination that the specific directory 130a is not a user content directory, processor 104 may allow files that may be executable files to be uploaded to the specific directory 130a. This may include files being uploaded to the specific directory 130a.

[0037] However, based on the determination in box 306 that a specific directory 130a will not receive files of predefined types from users 120a-120n, processor 104 may refuse to upload files to the specific directory 130a in box 310. That is, for example, based on the determination that the specific directory 130a is a user content directory, processor 104 may not allow files that may be executable files to be uploaded to the specific directory 130a. Furthermore, or alternatively, based on the determination in box 306 that the specific directory 130a will not receive files of predefined types from users 120a-120n, processor 104 may output an instruction to attempt to upload files to the specific directory 130a. Processor 104 may output this instruction to user 120a, the administrator, and / or the file log.

[0038] According to the example, device 102 can be a gateway; therefore, the gateway's processor 104 can access request 122 to upload a file to a specific directory 130a. Furthermore, the gateway's processor can refuse to upload the file to the specific directory 130a.

[0039] In other examples, the gateway may receive upload request 122 and forward it to the server. In these examples, device 102 may be the server, and the server's processor 104 may receive upload request 122 from the gateway. Furthermore, the server's processor 104 may apply prediction model 110 to a specific directory 130a to determine whether the specific directory 130a is correctly receiving files of predefined types from users 120a-120n. Additionally, the gateway may receive from the server a determination that the specific directory 130a is not correctly receiving files of predefined types from users 120a-120n, or a determination that the specific directory 130a is not correctly receiving files of predefined types from users 120a-120n.

[0040] In some examples, applying prediction model 110 to a specific directory 130a may not result in an indication of whether that specific directory 130a will receive files of a predefined type from users 120a-120n. This may occur, for example, when inputs of characteristics of a specific directory 130a may not lead to a determination exceeding a certain predetermined confidence level. In these cases, processor 104 may default to rejecting the file upload and may output an indication to the administrator and / or user 120a that the requested upload 122 has been rejected.

[0041] Some or all of the operations described in Method 300 may be included as a utility program, program, or subroutine on any desired computer-accessible medium. Furthermore, Method 300 may be implemented by a computer program, which may exist in various active and inactive forms. For example, they may exist as machine-readable instructions, including source code, object code, executable code, or other formats. Any of the above may be embodied on a non-transitory computer-readable storage medium.

[0042] Examples of non-transient computer-readable storage media include computer system RAM, ROM, EPROM, EEPROM, and magnetic disks, optical disks, or magnetic tapes. Therefore, it should be understood that any electronic device capable of performing the functions described above can also perform those functions listed above.

[0043] Turn now Figure 4The diagram illustrates a block diagram of a computer-readable medium 400 according to an embodiment of the present disclosure, on which computer-readable instructions may be stored for determining, through the application of a prediction model 110, whether the destination of an upload request 122 wishes to receive an executable file. It should be understood that... Figure 4 The computer-readable medium 400 depicted may include additional instructions, and some of the instructions described herein may be removed and / or modified without departing from the scope of the computer-readable medium 400 disclosed herein. The computer-readable medium 400 may be a non-transient computer-readable medium, wherein the term "non-transient" does not include transient propagating signals.

[0044] Computer-readable medium 400 may store computer-readable instructions 402-408 thereon, such as Figure 1 and 2 The processor 104 depicted can execute computer-readable instructions 402-408. The computer-readable medium 400 can be an electronic, magnetic, optical, or other physical storage device that contains or stores the executable instructions. The computer-readable medium 400 can be, for example, random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), storage devices, optical discs, etc.

[0045] The processor can acquire, decode, and execute instruction 402 to receive a request 122 to upload an executable file to a destination. The executable file can be a file containing code that the server can execute, such as server-side executable code. Furthermore, the destination can be a directory where files can be uploaded 130a.

[0046] The processor can acquire, decode, and execute instruction 404 to determine, through the application of prediction model 110, whether destination 130a will receive an executable file. According to the example, the processor can use a training set of data to generate prediction model 110, where the training set of data may include data related to user uploads of various file types to the destination. Prediction model 110 can be used to classify the destination as either receiving files of a predefined type from the user or not receiving files of a predetermined type from the user.

[0047] The processor can fetch, decode, and execute instruction 406 to instruct destination 130a, based on the determination prediction model 110, not to receive the executable file, blocking request 122 and / or outputting a notification regarding the acceptance of the request. However, the processor can fetch, decode, and execute instruction 408 to instruct destination 130a, based on the determination prediction model 110, to receive the executable file, allowing the executable file to be uploaded to destination 130a.

[0048] Although detailed descriptions have been made throughout this disclosure, the representative examples of this disclosure are applicable in a wide range of applications, and the foregoing discussion is not intended to be limiting, but is provided as an illustrative discussion of various aspects of this disclosure.

[0049] The descriptions and illustrations herein are examples of this disclosure and some of its variations. The terminology, descriptions, and figures used herein are set forth by way of illustration only and are not intended to be limiting. Many variations are possible within the scope of this disclosure and are intended to be defined by the following claims and their equivalents, wherein all terms are expressed in their broadest reasonable sense unless otherwise stated.

Claims

1. An apparatus comprising: processor; as well as A memory that stores instructions, which, when executed by the processor, cause the processor to: Receive requests to upload files to a specific directory; Determine whether the file in the request is an executable file or an executable file of a predefined type; Based on determining whether the file in the request is an executable file or an executable file of a predefined type, a prediction model is applied to determine whether the specific directory in the request is a user content directory. The prediction model is generated by performing machine learning operations on a training dataset, wherein the training dataset includes data related to users uploading multiple types of files to the directory. The name of the specific directory from the request is input into the prediction model and the prediction model is applied to determine whether the specific directory is a user content directory, wherein the user content directory is a directory type that does not accept executable files from users. as well as Based on the determination that the file in the request is an executable file or an executable file of a predefined type, and based on the determination that the specific directory in the request is a user content directory, the request is blocked and a notification about receiving the request is output.

2. The apparatus of claim 1, wherein the instructions cause the processor to: Based on the determination that the file in the request is an executable file or an executable file of a predefined type, and based on the determination that the specific directory in the request is not a user content directory, the request is allowed to be satisfied.

3. The apparatus of claim 1, wherein the instructions cause the processor to: The request is received from the client device via the network.

4. The apparatus of claim 1, wherein the apparatus includes a network gateway.

5. The apparatus of claim 1, wherein the file is allowed to be uploaded to the specific directory based on the determination that the file in the request is an executable file or an executable file of a predefined type and based on the determination that the specific directory in the request is not a user content directory.

6. The apparatus of claim 1, wherein the particular directory includes a folder or a Uniform Resource Locator.

7. The apparatus of claim 1, wherein the prediction model is generated and stored in a database, and wherein the instructions cause the processor to: The generated prediction model is accessed from the database.

8. A method comprising: A predictive model is generated by a processor, which is generated by performing machine learning operations using a training dataset, wherein the training dataset includes data related to multiple types of files uploaded by users to a directory; The processor accesses requests to upload files to a specific directory; The processor determines whether the file in the request is an executable file; Based on the determination that the file in the request is an executable file, the processor determines whether the specific directory in the request is the directory that receives the executable file from the user by inputting the name of the specific directory from the request into the prediction model and applying the prediction model. as well as Based on the determination that the file in the request is an executable file and based on the determination that the specific directory in the request is a directory for receiving executable files from the user, the processor allows the file in the request to be uploaded to the specific directory.

9. The method according to claim 8, further comprising: Based on the determination that the file in the request is an executable file and that the specific directory is a directory that does not accept executable files from users, the upload of the file in the request to the specific directory is refused.

10. The method of claim 8, further comprising: Based on the determination that the file in the request is an executable file and that the specific directory is a directory that does not accept executable files from users, an instruction is output to attempt to upload the file to the specific directory.

11. The method of claim 8, wherein the prediction model is used to classify a directory as receiving executable files from a user or not receiving executable files from a user.

12. The method of claim 11, wherein accessing the training dataset further comprises accessing manually curated data or accessing real-world data relating to the user uploading the plurality of file types to the directory.

13. The method of claim 8, further comprising: Machine learning operations are applied to the training dataset to generate the prediction model.

14. The method of claim 8, further comprising: Access the request to upload the file to the specific directory at the network gateway; as well as Based on the determination that the file in the request is an executable file and that the specific directory is a directory that does not accept executable files from users, the gateway refuses to upload the file in the request to the specific directory.

15. The method of claim 8, further comprising: The request to upload the file is forwarded to the server, where the server applies the prediction model to the specific directory to determine whether the specific directory is the directory that receives executable files from the user. as well as The determination that the specific directory received from the server is the directory from which executable files from the user are not received.

16. The method of claim 8, wherein the file in the request is a server-side executable file and the specific directory in the request is a user content directory.

17. A computer-readable medium storing computer-readable instructions, which, when executed by a processor, cause the processor to: Receive requests to upload files to a specific directory; Determine whether the file in the request is an executable file; Based on the determination that the file in the request is an executable file, a prediction model is applied to determine whether the specific directory in the request is a directory that receives executable files. The prediction model is generated by performing machine learning operations on a training dataset, wherein the training dataset includes data related to multiple types of files uploaded by users to the directory. The determination of whether the specific directory is a directory that receives executable files is made by inputting the name of the specific directory from the request into the prediction model and applying the prediction model. as well as Based on the determination that the file in the request is an executable file and based on the determination that the specific directory in the request is a directory that does not accept executable files from the user, the request is blocked and a notification about the acceptance of the request is output.

18. The computer-readable medium of claim 17, wherein the prediction model is used to classify a directory as receiving files of a predefined type from a user or not receiving files of a predefined type from a user.

19. The computer-readable medium of claim 17, wherein the instructions further cause the processor to: Based on the determination that the file in the request is an executable file and based on the determination that the specific directory in the request is a directory for receiving executable files, the upload of the executable file in the request to the specific directory is permitted.

Images