Smart File Quarantine Using ML and Sandbox Risk Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems face a trade-off between minimizing waiting time, risk, and cost in file scanning and quarantining, as comprehensive scanning increases waiting time and cost while less scanning increases risk.
Innovation Solution
Implementing a smart quarantine system using machine learning to determine whether to quarantine, scan, or allow files based on a combination of policy and machine learning, minimizing the number of files processed by a sandbox and reducing the number of malicious files passed to users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files are scanned by sandbox, then risk of infection is minimized, but waiting time and cost increase significantly
Solution Approach 1:
The file processing system is segmented into multiple pathways: a fast path for benign files (allow immediate access) and a slow path for suspicious files (quarantine and scan). The machine learning model segments files based on their risk profile, directing only high-risk files to the sandbox for thorough scanning while allowing low-risk files to pass through immediately.
Solution Approach 2:
The machine learning model performs preliminary classification of files before they reach the sandbox. By pre-evaluating files using ML techniques on features like file headers, metadata, and basic characteristics, the system identifies suspicious files in advance and directs only those to the sandbox, avoiding the need to scan all files.
2Reliability
If all files are scanned by sandbox, then risk of infection is minimized, but cost increases significantly
Solution Approach 1:
The system segments the file population into benign and suspicious categories using machine learning, directing only the suspicious segment to the expensive sandbox scanning process. This segmentation based on risk assessment dramatically reduces the number of files requiring resource-intensive sandbox analysis.
Solution Approach 2:
Instead of applying full sandbox scanning to all files (excessive action), the system applies partial scanning only to files that meet suspicious criteria identified by the machine learning model. This partial action approach maintains security for high-risk files while avoiding wasteful expenditure on clearly benign files.
3Loss of time
If machine learning is used to filter files, then waiting time and cost are reduced, but number of malicious files passed through may increase
Solution Approach 1:
The machine learning model serves as an intermediary between file intake and sandbox scanning. It acts as a filter that preserves security by correctly identifying malicious files while reducing the workload on the sandbox. The ML model is trained to minimize false negatives, ensuring that malicious files are not passed through to users.
Data Source
Figure 1A
Figure 1B
Figure 2A~2B
AI summary
Systems and methods include obtaining a file associated with a user for processing; utilizing a combination of policy for the user and machine learning to determine whether to i) quarantine the file and scan the file in a sandbox, ii) allow the file to the user and scan the file in the sandbox, and iii) allow the file to the user without the scan; responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and, responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.