Abstract: Systems and methods include receiving a domain for a determination of a likelihood the domain is malicious or benign; obtaining data associated with the domain including log data from a cloud-based system that performs monitoring of a plurality of users; analyzing the domain with a plurality of components to assess the likelihood, wherein at least one of the plurality of components is a trained machine learning model; and combining results of the plurality of components to predict the likelihood the domain is malicious or benign.

Abstract: Systems and methods include receiving content for classification; classifying the content as one of benign and malicious utilizing a model that has been trained with a training set of data including benign data and malicious data; determining a first pattern associated with the content; comparing the first pattern with a second pattern that is associated with one of the benign data and the malicious data; and determining an uncertainty of the classifying based on a distance between the first pattern and the second pattern. The systems and methods can include discarding the classification if the distance is greater than a configurable threshold.

Abstract: Systems and methods include training a machine learning model with data for identifying features in monitored traffic in a network; analyzing the trained machine learning model to identify information overhead therein, wherein the information overhead is utilized in part for the training; removing the information overhead in the machine learning model; and providing the machine learning model for runtime use for identifying the features in the monitored traffic, with the removed information overhead from the machine learning model.

Abstract: Systems and methods include receiving a content item between a user device and a location on the Internet or an enterprise network; utilizing a trained machine learning ensemble model to determine whether the content item is malicious; responsive to the trained machine learning ensemble model determining the content item is malicious or determining the content item is benign but such determining is in a blind spot of the trained ensemble model, performing further processing on the content item; and, responsive to the trained machine learning ensemble model determining the content item is benign with such determination not in a blind spot of the trained machine learning ensemble model, allowing the content item. A blind spot is a location where the trained machine learning ensemble model has not seen any examples with a combination of features at the location or has examples with conflicting labels.

Abstract: Systems and methods include obtaining a file associated with a user for processing; utilizing a combination of policy for the user and machine learning to determine whether to i) quarantine the file and scan the file in a sandbox, ii) allow the file to the user and scan the file in the sandbox, and iii) allow the file to the user without the scan; responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and, responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.

Abstract: Embodiments monitor application performance metrics representing the performance of a software application executed by one or more host computing devices. Based on the application of rules to the application performance metrics, an elasticity action, such as a power-on action, a power-off action, a deploy action, and/or a destroy action, is determined. The elasticity action is transmitted to one or more target hosts, which perform the elasticity action. The target host may be selected based on host performance metrics. Further, a load balancing service may accommodate the addition of a new software application instance to a cluster and/or the removal of an existing software application instance from the cluster.

Abstract: Embodiments monitor application performance metrics representing the performance of a software application executed by one or more host computing devices. Based on the application of rules to the application performance metrics, an elasticity action, such as a power-on action, a power-off action, a deploy action, and/or a destroy action, is determined. The elasticity action is transmitted to one or more target hosts, which perform the elasticity action. The target host may be selected based on host performance metrics. Further, a load balancing service may accommodate the addition of a new software application instance to a cluster and/or the removal of an existing software application instance from the cluster.