Bank of America Corporation

Jeffrey Wayne Texada

Jennie Kathleen Egbert

Eric Joseph DePree

Stephanie Margaret Pirman

Matthew E Kelly

Dan E Summers

Steven Dimaria

Scott Fennell

Christopher Daniel Birch

Steven E Sinks

John Daron Redmon

Thomas Thornbury

Mark Allen Brock

A method for classifying a suspicious text message on a user device is disclosed. The method includes communicating between a classification processor and a user device, where the classification processor receives the suspicious text message from the user device, the suspicious text message having information data. The method includes applying a hashing function to the information data to generate hashed information data. The method includes storing the hashed information data in one or more of a plurality of network nodes in a blockchain network, and comparing the hashed information data to known hashed malicious data stored on a database. The method includes classifying the information data as containing malicious data based on the comparison.

System and method for classifying suspicious text messages received by a user device

A method analyzes dependency information for a first data store. Upon determining that a data pipeline associates a first log type generated by the first data store with a second log type generated by a second data store, a first number of logs of the first log type that are generated at a first time, a first baseline number, and a first threshold value are determined. Upon determining that the first number of logs differs from the first baseline number by less than the first threshold value, a second number of logs of the second log type that are generated at a second time, a second baseline number, and a second threshold value are determined. Upon determining that the second number of logs differs from the second baseline number by more than the second threshold value, the data pipeline is identified as degraded.

System and method for automated data pipeline degradation detection

A method includes analyzing a first log of a first log type generated by a first data store and determining if the first log has a first format of the first log type. In response to determining that the first log does not have the first format of the first log type, the first data store and the first log type are identified as degraded. A first impact score is determined for the first log type. First dependency information is analyzed for the first data store. In response to determining that no data store receives data items from the first data store, a report is generated. The report includes an identification that the first data store is degraded, an identification that the first log type is degraded, and the first impact score associated with the first log type.

System and method for automated data item degradation detection

Arrangements for providing typosquatting detection and notification functions are provided. In some aspects, user input data may be received. The user input may include a website or website address received via a web browser address bar displayed on a user computing device. The user input may be analyzed, using a machine learning model, to determine a likelihood of typosquatting. The determined likelihood may be compared to a threshold and, if the likelihood is below the threshold, the user may proceed with the request to access the website. If the likelihood meets or exceeds the threshold, a notification or user interface may be generated requesting user input confirming that the user input reflects a correct or desired website. User response data may be received and used to update and/or validate the machine learning model.

Typosquatting detection and notification

Embodiments of the invention are directed to systems, methods, and computer program products for utilizing machine learning to predict future deceitful domain names and determine preferred security responses. As such, the system allows for use of a machine learning engine to collect new domain name registration information from a plurality of sources and predict future name registrations associated with said sources. A single user may register deceitful domain names through a plurality of domain name registration systems. By collecting data from multiple servers, the system may identify data trends and generate predictions of future domain names independently of any individual server. Thus, the system may benefit a number of entities, by providing real-time data analysis that would not be obtainable by any one entity operating alone. Additionally, the system may provide a single managing entity with real-time suggestions that may decrease the likelihood of a security incident involving a particular domain name.

System and method for network address anomaly detection using machine learning

A method includes determining a first number of logs of a first log type that are generated by a first data store at a first time for a first time interval. A first baseline number and a first threshold value are determined for the first data store. The first baseline number is an expected number of logs of the first log type generated by the first data store at the first time for the first time interval. In response to determining that the first number of logs differs from the first baseline number by more than the first threshold value, the first data store and the first log type are identified as degraded. A report is generated. The report includes an identification that the first data store is degraded and an identification that the first log type is degraded.

System and method for automated data source degradation detection

A known-deployed file metadata repository (KDFMR) and analysis engine enumerates reference lists of files stored on a software delivery point (SDP) and compares the enumerated list of files and associated metadata to previously stored values in the KDFMR. If newly stored or modified files are identified, the analysis engine acquires the files from the SDP. Each file is analyzed to determine whether the file is an atomic file or a container file and metadata is generated or extracted. Each file stored in a container file is recursively extracted and analyzed, where metadata is generated for each extracted file and each container file. The KDFMR periodically analyzes the files stored on the SDP for differences to maintain the currency of the KDFMR data with respect to files stored on the SDP. Storage or modification of files on the SDP triggers analysis of the associated file. KDFMR data is updated with metadata determined based on sandbox detonation of files and/or identified artifacts of known-deployed files.

Known-deployed file metadata repository and analysis engine

A system determines baseline deployment properties of operating system deployments stored by a deployment repository and endpoint deployment properties of a deployed operating system executed by an endpoint device. An artificial intelligence model is configured to determine a security response based at least in part on the endpoint deployment properties of the endpoint device. By providing the endpoint deployment properties to the artificial intelligence model, a mismatch value is determined that corresponds to an amount that the endpoint deployment properties are different than the baseline deployment properties. Based on the mismatch value, an action is determined to improve security of the deployed operating system executed by the endpoint device. The determined action is executed to improve security of the deployed operating system.

Data security system with dynamic intervention response

Embodiments of the invention are directed to systems, methods and computer program products for automated collection of user-specified forensic data from a target computer associated with a case. In particular, embodiments herein disclosed provide for a system that is configured to provide a user interface to allow a user to select a target computer within a network, select one or more user profiles associated with the target computer, and specify one or more types of forensic data to be collected from the target computer. The system is also configured to create a subfolder in a folder linked to the case and one or more files in the subfolder for storing the user-specified data; connect the computer apparatus to the target computer; and collect the specified data and save the collected data to the files.

Growing community of inventors

Carrollton, TX, United States of America

Jeffrey Wayne Texada