Antiransomware file analysis and scoring

A system comprising:

• at least one data processor;
• and
• memory storing instructions, which when executed by the at least one processor, result in operations comprising:
• receiving a query requesting a score for a file stored by a file management system;
• determining a tenant identification (ID) for the query;
• querying, using a judge tenant map that maps tenant IDs to matching judges, a judgment database for the score from a judge matching the tenant ID;
• and
• returning the score to an endpoint;
• wherein:
• the judges are a plurality of machine learning-based judges each having an associated judge database, each of the judges being executed by a judgment engine;
• an analysis engine generates information characterizing each file which is indicative of a level of trustworthiness, the generated information comprising one or more of attributes indicative of ransomware;
• each of the judges is notified to commence or revisit a judging process based on the generated information;
• each of the judges retrieves the generated information in response to the notifying;
• each of the judges comprises or executes a corresponding machine learning model to determine a respective trustworthiness score for each file based on the generated information;
• and
• the determined trustworthiness scores are stored in the associated judge databases.

A method comprising:

• receiving a query requesting a score for a file stored by a cloud-based file management system that serves multiple tenants;
• determining a tenant identification (ID) for the query based on an identification of an endpoint in the query;
• querying, using a judge tenant map that maps tenant IDs to matching judges, a judgment database for the score from a judge matching the tenant ID;
• and
• returning the score to the endpoint;
• wherein:
• the judges are a plurality of machine learning-based judges each having an associated judge database and a respective data queue, each of the judges being executed by a judgment engine;
• an analysis engine generates information characterizing each file which is indicative of a level of trustworthiness, the generated information comprising one or more attributes indicative of ransomware including whether each file is packed, is signed, is encrypted, causes other files to be encrypted, includes code causing deletion of files, or includes code causing files to be uploaded;
• each of the judges is notified to commence or revisit a judging process based on the generated information;
• each of the judges retrieves the generated information from the respective data queue associated with the judge in response to the notifying;
• each of the judges comprises or executes a corresponding machine learning model to determine, in parallel with each other judge, a respective trustworthiness score for each file based on the generated information;
• and
• the determined trustworthiness scores are stored in the associated judge databases on a tenant-by-tenant basis.