| CPC G06F 21/565 (2013.01) [G06F 2221/034 (2013.01)] | 25 Claims |
|
20. A method comprising:
receiving a query requesting a score for a file stored by a file management system;
determining a tenant identification (ID) for the query;
querying a judge database associated with the tenant ID for the score; and
returning the score to the endpoint;
wherein:
there are a plurality of judges each having an associated judge database, each of the judges being executed by a judgment engine;
an analysis engine generates information characterizing each file which is indicative of a level of trustworthiness, the generated information comprising one or more of attributes indicative of the file comprising ransomware, at least one of the attributes indicating one or more of whether the corresponding file is packed, whether the corresponding file is signed, or whether the corresponding file contains code causing files to be uploaded;
each of a plurality of judges are notified to commence or revisit a judging process based on the generated analysis information;
each of the judges retrieve the analysis information in response to the notifying;
each of the judges comprising or executing a corresponding machine learning model to determine a respective trustworthiness score for each file based on the analysis information; and
storing the trustworthiness scores in the corresponding judge database.
|