Using machine learning to detect malicious upload activity

A system for training a machine learning model using information pertaining to characteristics of upload activity performed at a client device, the system comprising:

• a memory;
• and
• a processing device, coupled to the memory, to:
• generate training data to train the machine learning model, wherein generating the training data comprises:
• generate first training input, the first training input comprising (i) information identifying, for each of a plurality of application categories, a frequency of upload activity that corresponds to uploading first amounts of data during a specified time interval, wherein each of the plurality of application categories comprise one or more applications that are installed at the client device and that upload the first amounts of data;
• and
• generate a first target output for the first training input, wherein the first target output indicates whether the frequency of upload activity that corresponds to uploading the first amounts of data correspond to malicious or non-malicious upload activity;
• and
• provide the training data to train the machine learning model on (i) a set of training inputs comprising the first training input, and (ii) a set of target outputs comprising the first target output.

A system for using a trained machine learning model with respect to information pertaining to characteristics of upload activity performed at a client device, the system comprising:

• a memory;
• and
• a processing device, coupled to the memory, to:
• provide to the trained machine learning model first input comprising (i) information identifying, for each of a plurality of application categories, information pertaining a frequency of upload activity that corresponds to uploading first amounts of data during a specified time interval, wherein each of the plurality of application categories comprise one or more applications that are installed at the client device and that upload the first amounts of data;
• and
• obtain, from the trained machine learning model, one or more outputs identifying (i) an indication of the frequency of upload activity, for each of the plurality of application categories, pertaining to the first amounts of data uploaded from the client device, and (ii) for each of the plurality of application categories, a level of confidence that the frequency of upload activity corresponds to a malicious upload activity.