Bank of America Corporation

Steven E Sinks

Jonathan Sheedy

Donald Hess

Jared D Wilson

Matthew Findley

Brian Devine

Brian P Prange

Joshua Abraham

Jeffrey Wayne Texada

Joshua Jenkins

A network system of pattern analysis includes a centralized AI-based pattern analysis engine and each computing device comprises a local AI-based pattern analysis engine. The pattern analysis engine(s) each analyze computing operations on a local machine basis or a on a network basis depending on where installed. The AI-based pattern analysis engines identify common activity patterns for each machine and exclude the common activity patterns from further analysis of the computing operations, leading to more efficient identification of activity patterns indicative of nefarious activity. Once detected, the AI-based pattern analysis engines trigger an incident response to counter the nefarious activities. The AI-based pattern analysis engines include AI models that are continually or periodically trained to update the baseline common activity patterns.

Pattern analysis threat identification-aggregation engine

Various aspects of the disclosure relate to automated monitoring and detection of computing threats. A threat detection computing system is configured to monitor for security threats on a networked system. The threat detection system monitors process calls to detect otherwise benign activity that exceeds an expected threshold and identifies threat actor actions that would otherwise go un-noticed and be associated with normal computer activity.

Threshold based detection

A lateral movement identification tool analyzes communications sent and received from a local host to identify potential instances of lateral movement. When the host-based lateral movement identification tool identifies a host to host connection, the tool processes one or more artificial intelligence algorithms to analyze information from local network resources including a directory service, a local network system such as a network basic input/output system, a domain name system, and event logs. The lateral movement identification tool correlates the aggregated information with identified host to host messaging and sends alerts when lateral movement is suspected. Alerts may be either presented locally or provided to a central console based on configuration information.

Artificial intelligence-based lateral movement identification tool

An information security method to detect, validate, source, and/or remediate propagated, maliciously generated, AI content is disclosed. Search-engine spider(s) to crawl the Internet to identify posted content, which is analyzed with signature-based detection, anomaly detection, and machine learning to identify suspect content, which is compared against validated content. A malicious-AI probability score is generated based on the results of the foregoing AI analysis and the content differences. Metadata corresponding to the suspect content is extracted. A malicious activity mapping is compiled from available data. Suspect content is attempted to be recreated by publicly available online AI bots to identify the AI engine that generated the malicious content. Metadata pertaining to the origination source that accessed the source AI bot. Metadata is used to trace the malicious content back to the originator. Proofs regarding the foregoing are generated. Notifications/demands may be generated. Countermeasures against future attacks may be deployed.

Detection, validation, and sourcing of malicious AI-generated distributed data

An information-security method for securely accessing a web site through non-password user authentication to an intermediary portal is disclosed. A hardware/biometric login authenticates a user to a portal, which provides 1-click user access to web sites. The portal generates a strong password for each web site. Private keys with the passwords embedded therein are generated by the portal and stored along with public keys for the web sites. Communications between the portal and web sites are asymmetrically encrypted using the keys. Passwords for the web sites are updated or autorotated by the portal on-demand, at periodic intervals, and/or in response to data breaches or threat vectors to provide enhanced security. Updated login credentials are communicated to the web sites when the passwords are changed by the portal. Passwords are managed transparently to the user such that users need not be aware or keep track of their passwords.

Portal control of web site credentials using asymmetric public/private key encryption without user selection or user password management

A network traffic correlation engine monitors inbound and/or outbound connection information received from on each host computer system on a network. Each host device on the network store data logs corresponding to information corresponding to communications sent by the device and received by the device. The network traffic correlation engine correlates connections between different hosts throughout the network. If the network traffic correlation engine identified unmatched outbound and inbound connections, the network traffic correlation engine generates an alert to initiate further investigation and may also provide a mapping of the communications showing a possible start device for the connection and/or a type of access that the connections may now be providing.

Network traffic correlation engine

Aspects of the disclosure relate to preventing data loss using enhanced analysis of the URLs and URIs in webpage requests. A computing platform may receive a user request to access a webpage, and may determine whether the webpage is regularly accessed by the user and whether the user is permitted to access the webpage. Based on determining the user might not regularly access the website, but that the user is permitted to access the webpage, the computing platform may engage an artificial intelligence (AI) engine to parse the URL and URI from the webpage request. The AI engine may compare the URL to source code associated with the webpage to determine whether the URI was re-written. The computing platform may grant the webpage request based on determining the source code corresponds to the URL and based on determining the URI might not have been re-written.

Preventing data loss using enhanced analysis of the URLs and URIs in webpage requests

A network environment scanning engine may monitor electronic communications received via an external computing network and by an enterprise computing system. The network environment scanning engine after receipt of an electronic message, analyze the electronic message to identify, by a network environment scanning engine using a machine learning algorithm, executable code for execution by a processor of computing device addressed as a recipient of the message. The network environment scanning engine further analyzes, using a machine-learning based algorithm in a virtual security environment, the executable code to identify whether the executable code comprises one or more environment variables. Based on the analysis of the executable code, the network environment scanning engine either triggers, based on identification of the one or more environment variables and by an electronic messaging system, an alert sent via a communication network or releases the electronic message for delivery to the recipient computing device.

Network environment control scanning engine

A network security computing system includes a steganographic communications analysis engine monitoring incoming and outgoing messages on a secure computing network. The steganographic communications analysis engine identifies a pattern of file transfers between a first computing device on the secure computing network and an internal or external message recipient. When a pattern is identified, the steganographic communications analysis engine quarantines an associated computing device from the secure network. The steganographic communications analysis engine analyzes files transferred between the computing device and the recipient for indications of steganographic information and causes display, based on an identified indication of steganography, an indication that the computing device had been compromised by command and control malware.

Command and control steganographic communications detection engine

Aspects of the disclosure relate to email verification. A computing platform may receive an electronic message and identify one or more portions of content in the message. Then, the computing platform may generate and embed one or more message-specific identifiers into the electronic message and store electronic message information associating the one or more portions of content with the one or more embedded message-specific identifiers. Thereafter, the computing platform may receive an electronic message verification request to verify authenticity of an identified electronic message received by a computing device. The computing platform may prompt a user of the computing device to provide authentication information associated with one or more portions of content of the identified electronic message. Based on comparing the authentication information provided by the user to the stored electronic message information, the computing platform may determine whether the identified electronic message is valid and send a notification accordingly.

Electronic mail verification

A system determines baseline deployment properties of operating system deployments stored by a deployment repository and endpoint deployment properties of a deployed operating system executed by an endpoint device. An artificial intelligence model is configured to determine a security response based at least in part on the endpoint deployment properties of the endpoint device. By providing the endpoint deployment properties to the artificial intelligence model, a mismatch value is determined that corresponds to an amount that the endpoint deployment properties are different than the baseline deployment properties. Based on the mismatch value, an action is determined to improve security of the deployed operating system executed by the endpoint device. The determined action is executed to improve security of the deployed operating system.

Growing community of inventors

Scottsdale, AZ, United States of America

Steven E Sinks