Bank of America Corporation

Edward Lee Traywick

George Albero

Scot Lincoln Daniels

Elijah Clark

Jake Michael Yara

Rick Wayne Sumrall

Konata Stinson

Emanuel David Guller

Christopher D Nobile

Joshua R Johnson

Elizabeth R Liuzzo

Cody Dean Searl

Dustin Paul Stocks

Michael Beveridge

Christopher Stephen Littrell

Caleb G Mann

Laura Stillman Lavender

David Joseph Walsh

Daniel Martin

Paul Swiencicki

Nicholas O'reilly

Olga Kocharyan

Tomas Mata Castrejon, Iii

Carrie Elaine Gates

Keaton Drake

Ariel Fontaine Hill

Stephen C Brown

John Scott Alston

Ava Elizabeth Wallace

Barry Walsh

Barry Gregory Jude Walsh

Automatically and covertly activating audio/video mechanisms within a mobile communication device when a user is confronted with a duress-inducing event or a situation based on receipt of a duress indicator. The duress indicator is a subtle user input, such as a personal gesture, personal audible code or device input that triggers the covert activation of audio/video recording mechanisms on a mobile communication device. As a result, audio and/or video data of a duress-inducing event can be captured absent other parties to the duress-inducing event being aware that audio/video data is being captured.

Indicator triggered activation of audio/video recording devices within a mobile communication device

Arrangements for machine learning-based anomaly detection are provided. In some examples, historical data related to user interactions with enterprise organization resources and location may be received and used to train a machine learning model. Current user interaction data, as well as current location data, may be received. The current user interaction data and location data may be input to the machine learning model and the model may be executed to detect any anomalies in the data. If no anomalies are detected, the process may return to receive subsequent user interaction and location data for analysis. If an anomaly is detected, a notification may be generated and transmitted to an administrator computing device for display by the device.

Machine learning-based anomaly detection

Arrangements for controlling access to secure resources when a VPN is detected. In some examples, a request to access an enterprise organization resource may be received by a computing platform and from a user computing device. The computing platform may determine whether a VPN is detected in the request. If not, the computing platform may enable a connection between the user computing device and the requested resource. If a VPN is detected, data may be extracted from the request. The data may include identification of a user, a type of VPN and/or a type of user computing device. The extracted data may be input to an AI/ML model and the model may be executed to generate a customized notification. The notification may indicate that use of a VPN has been detected and may provide customized instructions to disable the type of VPN detected.

Controlling access to secure systems based on virtual private network detection

Aspects of the disclosure relate to a voice authentication platform. The voice authentication platform may monitor remote communications to identify a first voice sample. The voice authentication platform may train a voice authentication model to output similarity scores, based on the first voice sample. The voice authentication platform may identify a second voice sample. The voice authentication platform may generate a similarity score by inputting the second voice sample into the model. The voice authentication platform may compare the similarity score to a threshold value. If the similarity score meets or exceeds the threshold value, the voice authentication platform may update a user profile. If the similarity score is below the threshold value, the voice authentication platform may initiate a security action. The voice authentication platform may create an iterative feedback loop to update the voice authentication model.

Artificial intelligence-supported proxy worker detection using voice authentication

Embodiments of the invention are directed to systems, computer program products, and methods for electronic authentication of electronic distributed network traffic via enriched data. An authorization request is provided from a user of a first endpoint device to send or receive data with a second endpoint device. A request for a first authentication credential to the first endpoint device is transmitted, and an authentication transmission is received by the system. An enhanced authentication engine is initialized, which collects, by a middleware, data flow from an identity database to the enhanced authentication engine. A metadata source is combined with the data flow to form a combined data, which is transmitted to an alert engine.

System and method for electronic authentication of electronic distributed network traffic via enriched data

Arrangements for detecting an email deluge are provided. A computing platform may train an artificial intelligence (AI) engine. The computing platform may receive a group of electronic messages. The computing platform may identify a user profile based on an electronic user identifier associated with the group of electronic messages. The computing platform may determine one or more electronic characteristics based on content associated with the group of electronic messages. The computing platform may generate one or more rules to determine whether a deluge has been detected. Based on determine that a deluge has been detected, the computing platform may quarantine the group of electronic messages and/or perform other actions.

Email deluge solution

Arrangements for providing dynamic passive authentication are provided. In some aspects, registration data may be received for a plurality of users. The registration data may include biometric data of each user of the plurality of users, and identification of one or more user computing devices that each user is authorize to access. In response to receiving an indication of login to a user computing device by a first user, one or more passive authentication functions may be activated and biometric data may be received from devices associated with the user computing device. The computing platform may compare the received biometric data to registration biometric data associated with the first user. If the received data matches the registration data, the system may capture additional biometric data at a subsequent time. If the received data does not match the registration data, one or more mitigation actions may be identified and executed.

Dynamic passive authentication

A security feature within an apparatus that includes a fingerprint scanner used for purposes of authentication. Specifically, a first indicator is detected that is a user input to a fingerprint scanner and indicates the occurrence of a duress-inducing event. In response to detecting the first indicator, (i) access to the apparatus is controlled, and (ii) access to functionality provided by the apparatus is controlled. As such, if the user is being forced to input their fingerprint by a nefarious entity desiring access to the apparatus, the present invention provides a means by which the user can covertly activate certain features on the apparatus that prevent the nefarious entity from access to the apparatus and/or functionality provided by the apparatus.

Fingerprint authentication-related indicators for controlling device access and/or functionality

Aspects of the disclosure are directed to a supporting authentication between a computing platform and a computer that has an attached geolocation dongle. The attached geolocation dongle provides location information to the computer that is indicative of a current location of the computer, where the location information is obtained from RF signals generated from neighboring cell towers or the Global Positioning System. The computing platform may utilize the location information for authenticating the computer. Moreover, the location information may be encrypted by the geolocation dongle based on an encryption key known by the geolocation dongle and the computing platform. With another aspect, authentication is supported by a computer and an associated communication device that provides location information to the computer via a short-range communication channel. With another aspect, authentication is supported by a computer and an associated communication device that provides location information directly to the computing platform.

Geolocation authenticator

Aspects of the disclosure relate to account lineage tracking and automatically executing responsive actions upon detecting an incomplete lineage chain. A computing platform may receive an account-change message from a database-level interceptor. The account-change message may include information identifying a first target account as a database-level source account and identifying a second target account associated with one or more target databases. The first target account may be associated with a target application configured to access the target database. After receiving the account-change message, the computing platform may determine, based on a failure to detect a source account associated with the first target account, that an account lineage chain associated with the account-change message is incomplete. In response to determining that the account lineage chain is incomplete, the computing platform may generate and send one or more commands to limit access of the first target account to the target database.

Automatically executing responsive actions upon detecting an incomplete account lineage chain

Systems, computer program products, and methods are described herein for a data obfuscation authentication security display session. The invention provides a secondary authentication by recognizing the initial access to a display screen and overlaying and presenting false information on the screen. The false screen may mimic that of a real account screen, but the personal information about the user is false. The invention then requires the user to perform a secondary authentication to gain access information on the display session that is not false. The invention may allow for a duress code implementation in place of the secondary authentication, which initiates security protocols, include a continuum based protocol arrangement of security protocols.

Data obfuscation authentication security display session system

Systems, computer program products, and methods are described herein for implementing device manipulation for counteracting facial recognition authentication security malfeasance. The present invention is configured to receive a request from a user via a client device to access an authentication subsystem to execute a facial recognition authentication for access to an application; initiate the facial recognition authentication on the client device in response to receiving the request; receive, from the client device, one or more external inputs in response to one or more authentication prompts; determine, using a machine learning subsystem, that at least one of the one or more external inputs is associated with a first preconfigured duress code; trigger, using a breach detection subsystem, a first set of security protocols; and execute, using the breach detection subsystem, a first set of predefined actions associated with the first set of security protocols.

Device manipulation system for counteracting facial recognition authentication security malfeasance

Aspects of the disclosure relate to account lineage tracking and automatically executing responsive actions upon detecting an account lineage. A computing platform may receive a first account-change message from a source-level interceptor. The first account-change message may include information identifying a source account associated with a first computing device and identifying a first target account. The first target account may be associated with a target application configured to access the target database. The computing platform may receive a second account-change message from a database-level interceptor. The second account-change message may include information identifying the first target account as a database-level source account and identifying a second target account associated with one or more target databases. After receiving the first and second account-change messages, the computing platform may generate a notification comprising information associated with an account lineage between the source account and the second target account.

Automatically executing responsive actions based on a verification of an account lineage chain

Aspects of the disclosure relate to improving user responses to cyber security threats. A computing platform may generate a test communication to simulate a potential cyber threat activity. Then, the computing platform may send, via the communication interface, the test communication to a user device associated with a target user. Then, the computing platform may receive, via the communication interface and from the user device, a response to the test communication. Subsequently, the computing platform may determine, based on the response, a threat awareness level for the target user, where the threat awareness level is indicative of a susceptibility of the target user to the potential cyber threat activity. Then, the computing platform may send, to the target user and based on the threat awareness level, an alert notification to counter the cyber threat activity.

Growing community of inventors

Bellbrook, OH, United States of America

Edward Lee Traywick