Deployment of machine learning models for discernment of threats

A computer program product comprising a non-transitory machine-readable medium storing instructions that, when executed by at least one data processor forming part of at least one computing device, cause the at least one data processor to perform operations comprising:

• detecting a mismatch between model-based classifications produced by a first version of a computer-implemented machine learning threat discernment model and a second version of a computer-implemented machine learning threat discernment model for a file;
• analyzing the mismatch to determine appropriate handling for the file, the analyzing comprising comparing a human-generated classification for a file, a first model version status that reflects classification by the first version of the computer-implemented machine learning threat discernment model, and a second model version status that reflects classification by the second version of the computer-implemented machine learning threat discernment model, the analyzing further comprising allowing the human-generated classification to dominate when it is available;
• and
• taking an action based on the analyzing, the action comprising:
• presenting the file via user interface functionality of an administrative interface with a choice of creating a new human-generated classification of the file as safe or allowing the second model version classification to govern when the file is deemed safe by the first model version but unsafe by the second model version, and when the human-generated classification is unavailable for the file;
• quarantining a file deemed unsafe by the first version of the computer-implemented machine learning threat discernment model but safe by the second version of the computer-implemented machine learning threat discernment model when the human-generated classification is unavailable for the file;
• and
• presenting the file via the user interface functionality of the administrative interface with a second choice of designating the file for local analysis and/or allowing the second model version classification to continue to block use of the file until the human-generated classification becomes available when the file is deemed unsafe by the second model version and the human human-generated classification is unavailable and when the first model version has not previously classified the file.

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
• detecting a mismatch between model-based classifications produced by a first version of a computer-implemented machine learning threat discernment model and a second version of a computer-implemented machine learning threat discernment model for a file;
• analyzing the mismatch to determine appropriate handling for the file, the analyzing comprising comparing a human-generated classification for a file, a first model version status that reflects classification by the first version of the computer-implemented machine learning threat discernment model, and a second model version status that reflects classification by the second version of the computer-implemented machine learning threat discernment model, the analyzing further comprising allowing the human-generated classification to dominate when it is available;
• and
• taking an action based on the analyzing, the action comprising:
• presenting the file via user interface functionality of an administrative interface with a choice of creating a new human-generated classification of the file as safe or allowing the second model version classification to govern when the file is deemed safe by the first model version but unsafe by the second model version, and when the human-generated classification is unavailable for the file;
• quarantining a file deemed unsafe by the first version of the computer-implemented machine learning threat discernment model but safe by the second version of the computer-implemented machine learning threat discernment model when the human-generated classification is unavailable for the file;
• and
• presenting the file via the user interface functionality of the administrative interface with a second choice of designating the file for local analysis and/or allowing the second model version classification to continue to block use of the file until the human-generated classification becomes available when the file is deemed unsafe by the second model version and the human human-generated classification is unavailable and when the first model version has not previously classified the file.