Bank of America Corporation

Stephanie Margaret Pirman

Eric Joseph DePree

Jeffrey Wayne Texada

Robert Riley Zink

Jared D Wilson

A method analyzes dependency information for a first data store. Upon determining that a data pipeline associates a first log type generated by the first data store with a second log type generated by a second data store, a first number of logs of the first log type that are generated at a first time, a first baseline number, and a first threshold value are determined. Upon determining that the first number of logs differs from the first baseline number by less than the first threshold value, a second number of logs of the second log type that are generated at a second time, a second baseline number, and a second threshold value are determined. Upon determining that the second number of logs differs from the second baseline number by more than the second threshold value, the data pipeline is identified as degraded.

System and method for automated data pipeline degradation detection

A method includes analyzing a first log of a first log type generated by a first data store and determining if the first log has a first format of the first log type. In response to determining that the first log does not have the first format of the first log type, the first data store and the first log type are identified as degraded. A first impact score is determined for the first log type. First dependency information is analyzed for the first data store. In response to determining that no data store receives data items from the first data store, a report is generated. The report includes an identification that the first data store is degraded, an identification that the first log type is degraded, and the first impact score associated with the first log type.

System and method for automated data item degradation detection

Polymorphic non-attributable processes and architectures to monitor threat domains (e.g., pharming or phishing websites) are disclosed. Obfuscated requests may be generated by control servers to be blended in with normal traffic sent over cloud networks with randomized exit nodes or with normal traffic sent through an anonymization network. Requests may be sent at randomized intervals or time periods determined algorithmically. The requests are obfuscated in order to mask the origination information and location so that the threat actor does not detect that the website is being monitored. User agents may be spoofed and requests may present as if they originated from residential IP addresses. Automatic real-time monitoring can be provided to determine when sites resolve and are addressable. Fingerprint information, screenshots, security certificate, and other threat domain data can be captured. Request responses can be scanned for threat indicia.

Polymorphic non-attributable website monitor

A method includes determining a first number of logs of a first log type that are generated by a first data store at a first time for a first time interval. A first baseline number and a first threshold value are determined for the first data store. The first baseline number is an expected number of logs of the first log type generated by the first data store at the first time for the first time interval. In response to determining that the first number of logs differs from the first baseline number by more than the first threshold value, the first data store and the first log type are identified as degraded. A report is generated. The report includes an identification that the first data store is degraded and an identification that the first log type is degraded.

Growing community of inventors

Chicago, IL, United States of America

Stephanie Margaret Pirman