US 12,406,069 B2
System for remediation of security vulnerabilities in computing devices using continuous device-level scanning and monitoring
Manu Jacob Kurian, Dallas, TX (US); Joel Townsend, Spring Church, PA (US); Tomas M. Castrejon, III, Fort Mill, SC (US); Michael Robert Young, Davidson, NC (US); and David Nardoni, Sierra Madre, CA (US)
Assigned to BANK OF AMERICA CORPORATION, Charlotte, NC (US)
Filed by BANK OF AMERICA CORPORATION, Charlotte, NC (US)
Filed on May 2, 2022, as Appl. No. 17/734,260.
Prior Publication US 2023/0351023 A1, Nov. 2, 2023
Int. Cl. G06F 21/57 (2013.01); G06F 21/55 (2013.01); G06N 20/00 (2019.01)
CPC G06F 21/577 (2013.01) [G06F 21/552 (2013.01); G06F 21/554 (2013.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A system for remediation of security vulnerabilities in computing devices using continuous device-level scanning and monitoring, the system comprising:
a memory device with computer-readable program code stored thereon;
a communication device; and
a processing device operatively coupled to the memory device and the communication device, wherein the processing device is configured to execute the computer-readable program code to:
generate a software metadata list and a hardware metadata list for an endpoint device within a network;
continuously monitor components within the endpoint device based on the software metadata list and the hardware metadata list;
detect a new component within the endpoint device that does not appear in the software metadata list or the hardware metadata list;
analyze, using a machine learning algorithm, operational behavior of the new component, wherein analyzing the operational behavior comprises using machine learning to determine whether the new component is related to operations of the endpoint device, wherein analyzing the operational behavior further comprises pausing operation of the new component while the new component is analyzed; and
based on the operational behavior of the new component, determine a level of security of the new component, wherein determining the level of security of the new component comprises, based on determining whether the new component is related to the operations of the endpoint device, determining whether the new component is authorized or unauthorized.