User verification of malware impacted files

A system comprising:

• one or more hardware processors;
• and
• a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
• accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device;
• determining that one or more server-stored files from the plurality of server-stored files are affected by a malware activity;
• generating a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the metadata indicating a suspicious file renaming activity and an indication whether the one or more server-stored files are shared with other client devices registered with the cloud storage server, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files;
• receiving a confirmation response from the client device, the confirmation response identifying at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files;
• and
• training a malware detection model based on the confirmation response from the client device, feedback from other users or client devices with files sharing a same attribute or feature of the one or more server-stored files, features of the one or more server-stored files, and metadata corresponding to the one or more server-stored files, wherein the determining of the malware activity is based on the malware detection model.

A machine-storage medium storing instructions that, when executed by one or more processors of a machine, cause the one or more processors to perform operations comprising:

• accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device;
• determining that one or more server-stored files from the plurality of server-stored files are affected by a malware activity;
• generating a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the metadata indicating a suspicious file renaming activity and an indication whether the one or more server-stored files are shared with other client devices registered with the cloud storage server, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files;
• receiving a confirmation response from the client device, the confirmation response identifying at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files;
• and
• training a malware detection model based on the confirmation response from the client device, feedback from other users or client devices with files sharing a same attribute or feature of the one or more server-stored files, features of the one or more server-stored files, and metadata corresponding to the one or more server-stored files, wherein the determining of the malware activity is based on the malware detection model.