Patent ID: 11928631
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
providing a training set of files including a first plurality of files each having a file location, an access control list, and known business value;
training a machine learning model to automatically estimate a business value of a sample file based on the training set of files;
analyzing a second plurality of files within an enterprise network for a threat level using a threat model based on one or more of behavioral tags, executable file paths, and Uniform Resource Locators;
identifying one or more intermediate threat samples within the second plurality of files that are not within a predetermined confidence level of safe or malicious according to the threat model;
determining an estimated business value for each of the one or more intermediate threat samples using the machine learning model;
ranking the one or more intermediate threat samples for presentation within a user interface based on a combination of a likelihood of maliciousness determined according to the threat model and the estimated business value determined according to the machine learning model; and
presenting the one or more intermediate threat samples to a user in the user interface for human evaluation.