Box, Inc.

Methods, systems and computer program products for analyzing historical user interactions within a content management system. The approach detects and mitigates against malicious interactions involving artificial intelligence (AI), including prompt injection attacks, by analyzing historical interaction data rather than relying solely on static or rule-based safeguards.

Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for content management systems. A security threat management facility (STMF) is identified. The STMF contains a database of threat assessment values in addition to further information pertaining to one or more users. Concurrent with operation of the STMF, a content management system (CMS) tracks user-initiated content object interaction events. Based on analysis of the tracked user-initiated content object interaction events, a further threat assessment value is generated by the CMS. Such a further threat assessment is determined based on one or more user-to-user relationships or one or more user-to-file relationships as determined at the content management system. An augmented threat assessment is formed using both the threat assessment values of the STMF with the further threat assessment value from the CMS. The augmented threat assessment is then provided to the STMF.

Disclosed is an approach for performing auto-classification of documents. A machine learning framework is provided to analyze the document, where labels associated with certain documents can be propagated to other documents.

Methods, systems, and computer program products for content management systems. Multiple components are operatively interconnected to carry out operations for content management systems. Content objects of a content management system (CMS) are managed from original creation through to final disposition (e.g., deletion). The CMS communicates with a security threat management facility (STMF). In operation, the STMF establishes a first set of security parameters corresponding to information derived from packet inspection, whereas the CMS establishes a second set of security parameters corresponding to information derived at least in part by analysis of user activities or contents of the content object. A security perimeter is formed by combining the first set of security parameters and a second set of security parameters. Risks or vulnerabilities corresponding to the content object are minimized by choosing the lower of any two compared parameters to define a lower risk perimeter for the content object.

Methods, systems and computer program products for recommending remediation actions to selected users of collaboration systems. Certain disclosed techniques commence upon observing user-to-object interactions and user-to-user interactions raised by users of a collaboration system. A first specialized data structure is populated with activity values that characterize user-to-object interactions raised by individual users. A second specialized data structure is populated with sharing values that characterize observed sharing events over shared content objects. The values of the first data structure are correlated to the values of the second data structure to calculate a total contribution amount for each of the users of the collaboration system. A small set of communication recipients is identified by ranking the individual users based on a calculated total contribution amount. To avoid wasteful messaging to all users of the collaboration system, messages are sent only to the small set of recipients. The messages contain recommended remediation actions.

Methods, systems and computer program products for analyzing historical user interactions across multiple users within a content management system. This approach employs machine learning to identify patterns and similarities in user behavior, enabling more accurate AI agent assignment and customization. By considering the collective behavior of user groups, the invention can provide AI agents that are better tailored to specific tasks and user needs, ultimately improving their effectiveness and user satisfaction.

Methods, systems and computer program products for analyzing historical user interactions across multiple users within a content management system. This approach employs machine learning to identify patterns and similarities in user behavior, enabling more accurate AI agent assignment and customization. By considering the collective behavior of user groups, the invention can provide AI agents that are better tailored to specific tasks and user needs, ultimately improving their effectiveness and user satisfaction.

Methods, systems, and computer program products for implementing LLM-based document sensitivity classification with user-defined policies. This leverages the advanced capabilities of Large Language Models (LLMs) for nuanced document classification, transcending the limitations of rigid rules-based systems.

Methods, systems and computer program products for content management systems. The techniques of the methods, systems and/or computer program products automatically determine activity-based content object access permissions and/or make a recommendation of activity-based content object access permissions. A machine learning model is formed from observations of user interactions over a plurality of content objects. The model is continually updated based on ongoing observation and analysis of user interaction events. When a collaborative relationship is formed between an invitor and one or more invitees, the activity-based permissions model is accessed to determine a set of access permissions to assign to the collaborative relationship. A single collaborative relationship may cover many collaboration objects. In some cases, a set of access permissions are automatically assigned to the collaborative relationship. In other cases, a set of access permissions is presented to the invitor as a recommendation. A user can accept or reject any recommendation.

Methods, systems, and computer program products for managing interactions between a content management system (CMS) and a large language model (LLM) system. The semantics of user questions can be considered before prompting an LLM, or alternatively, before querying datasets that are local to the CMS. Given a user question to be answered, the embedding of the user question can be matched against preconfigured sample question embeddings to determine a best match. A prompt corresponding to the determined best match is then configured based on identification of the class or classes that correspond to the matched question. Prompts for provision to LLMs can be synthesized based on a particular user's identity and/or based on the particular user's historical collaboration activities over objects of the CMS. The LLM can be hosted by a third-party provider. Alternatively all or portions of a large language model system can be hosted within the CMS.