Malicious behavior detection and mitigation in a document execution environment

Non-transitory computer readable storage media comprising instructions that when executed by one or more processors causes the one or more processors to:

• receive a document for execution within the document execution environment;
• detect activity within the document execution environment associated with the received document to obtain a detected activity, wherein the detected activity includes an amount of time between accessing the document and execution of the document within the document execution environment;
• applying a trained machine learned model to the detected activity to determine if the detected activity is representative of malicious behavior and, in response to determining that the detected activity is representative of malicious behavior, to identify one or more remedial actions that can mitigate the malicious behavior, wherein applying the trained machine learning model comprises:
• applying, the trained machine learning model to the amount of the the time to determine a likelihood that the amount of the time is indicative of malicious behavior;
• and
• applying a threshold to the likelihood that the amount of the time to identify the one or more remedial actions, wherein the threshold is determined based on a length of the document;
• and
• providing, to a device of a user, a recommendation to perform the identified one or more remedial actions.

A computer system comprising:

• one or more processors;
• and
• a non-transitory computer readable storage medium comprising instructions that when executed by the one or more processors causes the one or more processors to:
• receive a document for execution within a document execution environment;
• detect activity within the document execution environment associated with the received document to obtain a detected activity, wherein the detected activity includes an amount of time between accessing the document and execution of the document within the document execution environment;
• apply a trained machine learned model to the detected activity to determine if the detected activity is representative of malicious behavior and, in response to determining that the detected activity is representative of malicious behavior, to identify one or more remedial actions that can mitigate the malicious behavior,
• wherein applying the trained machine learning model comprises:
• applying, the trained machine learning model to the amount of the the time to determine a likelihood that the amount of the time is indicative of malicious behavior;
• and
• applying a threshold to the likelihood that the amount of the time to identify the one or more remedial actions, wherein the threshold is determined based on a length of the document;
• and
• provide, to a device of a user, a recommendation to perform the identified one or more remedial actions.