Patent ID: 11966472
Assignee: BANK OF AMERICA CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A system comprising:
a software distribution point (SDP) computing system comprising memory storing a plurality of files;
a known-deployed file metadata analysis server comprising:
a processor; and
non-transitory memory storing instructions that, when executed by the processor, causes the known-deployed file metadata analysis server to:
enumerate, based on an indication received from the SDP computing system that indicates at least one file has been created, available files stored on the SDP computing system;
compare enumerated files to logical paths associated with the SDP computing system to identify one or more new files;
retrieve, from the SDP computing system via a network, the one or more new files;
extract metadata from each of the one or more new files;
recursively extract, based on an indication that a file of the one or more new files is a container file, metadata from each file stored in the container file of the one or more new files;
identify a match of metadata of a file of the one or more new files and metadata stored in a data store comprising information stored of “known-good” files;
enrich the matched metadata with an indication that the file is “known-deployed”, wherein the indication comprises artifact metadata only available during dynamic execution of a particular entry of an artifact by the known deployed file metadata analysis server, and wherein the artifact metadata comprises an indication of the SDP and an indication that the file was introduced to a host through methods associated with approved software distribution practices and wherein artifact file metadata is enriched with labels to identify a functionality associated with the artifact;
trigger synchronization of stored metadata to an external computing system based on an update of the matched metadata to allow elimination of deployment-related activity from analysis; and
causing, based on the synchronization, analysis of newly saved files by the SDP using synchronized metadata to identify potentially malicious content.