Smart File Quarantine Using ML Risk Screening and Sandbox Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face a trade-off between minimizing waiting time, risk, and cost in file scanning, as comprehensive scanning increases waiting time and cost while reducing scanning increases risk, necessitating a balanced approach.
Innovation Solution
Implementing a smart quarantine system using machine learning to determine whether to quarantine, scan, or allow files based on policy and machine learning models, minimizing the number of quarantined and scanned files, focusing sandbox efforts on high-risk files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files are scanned by sandbox, then risk of infection is minimized, but waiting time and cost increase significantly
Solution Approach 1:
The patent applies partial action by using machine learning to identify and scan only the subset of files that are most likely to be malicious, rather than scanning all files. The ML model predicts risk scores for files, and only files exceeding a certain threshold are sent to the sandbox for full scanning, thus reducing waiting time while maintaining adequate security coverage
Solution Approach 2:
The machine learning model serves as an intermediary between file upload and sandbox scanning. It acts as a filtering layer that pre-processes files and selects which ones require expensive sandbox scanning, thereby reducing the overall scanning burden and waiting time while still catching malicious files
2Reliability
If all files are scanned by sandbox, then risk of infection is minimized, but cost increases significantly
Solution Approach 1:
The system performs partial scanning by using ML to identify only the high-risk subset of files warranting sandbox scanning. This reduces the number of expensive sandbox operations from potentially all files to only those with high predicted maliciousness scores, significantly lowering computational cost while maintaining security effectiveness
Solution Approach 2:
The machine learning model acts as a cost-reducing intermediary that filters out low-risk files before they reach the expensive sandbox environment. By predicting which files are likely malicious, it prevents unnecessary sandbox scanning of benign files, thereby reducing overall processing cost
3Loss of time
If less scanning is performed, then waiting time and cost are minimized, but risk of infection increases significantly
Solution Approach 1:
The system changes the parameter of scanning intensity by dynamically adjusting which files receive full sandbox scanning based on ML-predicted risk scores. Files with high risk scores undergo full scanning, while low-risk files receive minimal or no scanning, optimizing the balance between security and user experience
Solution Approach 2:
The machine learning model performs preliminary risk assessment before sandbox scanning. This pre-screening action identifies high-risk files that need thorough scanning while filtering out low-risk files, ensuring that security resources are focused where they are most needed
Data Source
AI summary
Systems and methods of sandboxing a file include responsive to receiving a file associated with a user, obtaining policy for the user; analyzing the file with a machine learning model; and based on a combination of the policy for the user and a verdict of the machine learning model, one of quarantining the file for analysis in a sandbox and allowing the file to the user. The present disclosure presents a smart quarantine with a goal of minimizing the number of files quarantined, the number of malicious files passed through to an end user, and a number of files scanned by a sandbox.