Bank of America Corporation

Jared D Wilson

Steven E Sinks

Jonathan Sheedy

Matthew Findley

Donald Hess

Brian Devine

Brian P Prange

Robert Riley Zink

Eric Joseph DePree

Stephanie Margaret Pirman

Jackson Byam

Joshua Jenkins

Various aspects of the disclosure relate to automated monitoring and detection of computing threats. A threat detection computing system is configured to monitor for security threats on a networked system. The threat detection system monitors process calls to detect otherwise benign activity that exceeds an expected threshold and identifies threat actor actions that would otherwise go un-noticed and be associated with normal computer activity.

Threshold based detection

A system for operating a remote desktop platform at a remote client device is provided. The remote desktop platform may be launched at the remote client device. The entity network may store a secure container including files, applications and profile settings of a user. The remote client device may retrieve the secure container at each execution of the remote desktop platform. The secure container may be stored temporarily at the remote client device. The remote client device, during the operation of the remote desktop platform, may leverage the hardware and software of the remote client device for accessing and managing the files and applications stored in the secure container. The remote desktop platform may maintain synchronization with the entity network by syncing, at pre-determined intervals, the files and applications stored at the remote client device with the files and applications stored at the entity network.

Network operating system deployment to remote hardware for network extensibility

Polymorphic non-attributable processes and architectures to monitor threat domains (e.g., pharming or phishing websites) are disclosed. Obfuscated requests may be generated by control servers to be blended in with normal traffic sent over cloud networks with randomized exit nodes or with normal traffic sent through an anonymization network. Requests may be sent at randomized intervals or time periods determined algorithmically. The requests are obfuscated in order to mask the origination information and location so that the threat actor does not detect that the website is being monitored. User agents may be spoofed and requests may present as if they originated from residential IP addresses. Automatic real-time monitoring can be provided to determine when sites resolve and are addressable. Fingerprint information, screenshots, security certificate, and other threat domain data can be captured. Request responses can be scanned for threat indicia.

Polymorphic non-attributable website monitor

Aspects of the disclosure relate to email verification. A computing platform may receive an electronic message and identify one or more portions of content in the message. Then, the computing platform may generate and embed one or more message-specific identifiers into the electronic message and store electronic message information associating the one or more portions of content with the one or more embedded message-specific identifiers. Thereafter, the computing platform may receive an electronic message verification request to verify authenticity of an identified electronic message received by a computing device. The computing platform may prompt a user of the computing device to provide authentication information associated with one or more portions of content of the identified electronic message. Based on comparing the authentication information provided by the user to the stored electronic message information, the computing platform may determine whether the identified electronic message is valid and send a notification accordingly.

Electronic mail verification

Growing community of inventors

Charlotte, NC, United States of America

Jared D Wilson