Abstract: A document execution engine that receives a document for execution within a document execution environment. The document execution engine may also detect activity within the document execution environment associated with the received document, and apply the trained machine learned model to the detected activity to determine if the detected activity is representative of malicious behavior and, in response to determining that the detected activity is representative of malicious behavior, to identify remedial actions that can mitigate the malicious behavior. The document execution engine may also provide, to a device of a user, a recommendation to perform the identified remedial actions.

Abstract: A document execution engine receives a training set of data representative of incidents of malicious activity within a document execution environment. The training set also includes data representative of remedial actions taken in response to the malicious behavior, and resulting measures of mitigation. The document execution engine trains a machine learned model based on the training set. The trained machine learned model, when applied to activity within the document execution environment, can identify activity that is indicative of malicious behavior. The trained machine learned model can then output recommendations for remedial actions to take in response to the identified malicious activity. The recommended remedial actions can be provided for display to a user of the document execution engine, via a client device of the user.