Detecting uploads of malicious files to cloud storage

A computer-implemented method comprising:

• obtaining a data object uploaded to cloud computing storage;
• determining a feature of the data object in a feature dimension;
• determining a first distance between the data object and a first data object cluster, the first distance based on the feature of the data object and a first object cluster feature in the feature dimension of the first data object cluster;
• determining a second distance between the data object and a second data object cluster, the second distance based on the feature of the data object and a second object cluster feature in the feature dimension of the second data object cluster, the first data object cluster and the second data object cluster having been determined from data objects uploaded to the cloud computing storage based on distance between the data objects in the feature dimension, the data objects comprising a first data object known to be malicious and a second data object known to be benign;
• assigning a threat score to the data object based on the first distance and the second distance;
• determining a deep scan score for the data object utilizing the threat score, wherein the deep scan score is biased against false negatives to favor performing a deep scan on likely-benign files as compared with likely-malicious files;
• performing the deep scan on the data object in response to the deep scan score being above a threshold, wherein the deep scan comprises executing code of the data object within an isolated execution environment and analyzing runtime behavior of the code;
• and
• responsive to the deep scan indicating the data object is malicious, triggering a cybersecurity response.

A computer-readable storage medium embodying computer-readable instructions configured, when executed by a processor, to cause the processor to:

• determine a first file cluster from files uploaded to a cloud storage medium, the first file cluster determined based on distances between the files in a feature space, the files comprising a file known to be malicious and a file known to be benign;
• obtain a first file uploaded to the cloud storage medium;
• determine a first feature of the first file in the feature space;
• determine a first distance in the feature space between the first file and the first file cluster, the first distance based on the first feature of the first file and a file cluster feature of the first file cluster;
• assign a threat probability to the first file based on the first distance between the first file and the first file cluster;
• determine a deep scan probability for the first file utilizing the threat probability, wherein the deep scan probability is biased against false negatives to favor performing a deep scan on likely-benign files as compared with likely-malicious files;
• perform the deep scan on the first file in response to the deep scan probability being above a threshold, wherein the deep scan comprises executing code of the first file within an isolated execution environment and analyzing runtime behavior of the code;
• and
• responsive to the deep scan indicating the first file is malicious, cause a cybersecurity action to be performed.