Managing machine learning models

A computerized system comprising:

• a memory storing executable instructions;
• and
• a processor, coupled to the memory, that performs a method by executing the instructions stored in the memory, the method comprising:
• receiving, by a plurality of deployed models of the computerized system, a plurality of files to an enterprise system in a communication system, each deployed model configured to analyze the plurality of files from a different perspective;
• analyzing, in parallel and independently, by the plurality of deployed models, the plurality of files to create a plurality of results with corresponding data, each result of the plurality of results is associated with a respective deployed model of the plurality of deployed models, wherein the plurality of results identifies one or more suspicious files of the plurality of files;
• calculating, by the processor, ranked results by ranking the plurality of results according to a confidence level, and clustered groups by clustering the plurality of results based on similar data;
• calculating, by the processor, classes by correlating the ranked results to the clustered groups, wherein the classes indicate accurate results and inaccurate results;
• retraining, by the processor, the plurality of deployed models having the classes indicating the inaccurate results with new training sets to create a plurality of retrained models, the new training sets based on the classes and the corresponding data;
• validating, by the processor, the plurality of retrained models have been retrained when the plurality of retrained models identify the one or more suspicious files of the plurality of files from the receiving;
• comparing, by the processor, the classes of the plurality of deployed models to new classes of the plurality of retrained models, the new classes determined by repeating the receiving, analyzing, and calculating for the plurality of retrained models;
• and
• deploying, by the processor, the plurality of retrained models when the new classes of the plurality of retrained models indicate accurate results greater than the classes of the plurality of deployed models.

A method comprising:

• receiving, by a first deployed model and a second deployed model of a computerized system, a file to an enterprise system in a communication system, the first deployed model and the second deployed model configured to analyze a plurality of files from a different perspective;
• analyzing, in parallel and independently, by the first deployed model and the second deployed model, the file to create a first result with first corresponding data associated with the first deployed model and a second result with second corresponding data associated with the second deployed model, wherein the first result or the second result identifies the file as a suspicious file;
• calculating, by the computerized system, ranked results by ranking the first result and the second result according to a confidence level;
• calculating, by the computerized system, a first class associated with the first result and a second class associated with the second result, wherein the first class indicates an accurate result and the second class indicates an inaccurate result;
• retraining, by the computerized system, the second deployed model having the second class indicating the inaccurate results with new training sets to create a second retrained model, the new training sets based on the second class and the corresponding data;
• validating, by the computerized system, the second retrained model has been retrained when the second retrained model identifies the suspicious file from the receiving;
• comparing, by the computerized system, the first class of the first deployed model to a new second class of the second retrained model, the new second class determined by repeating the receiving, analyzing, and calculating for the second retrained model;
• and
• deploying, by the computerized system, the second retrained model when the new second class of the second retrained model indicates the accurate result greater than the first class of the first deployed model.