Patent ID: 11966472
Assignee: BANK OF AMERICA CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method comprising:
receiving, via a computing network, a signal indicating storage of a file at a software distribution point (SDP) computing system, wherein the signal is automatically generated by the SDP computing system based on saving of at least one file;
enumerating, by a known deployed file metadata analysis engine, available files stored on the SDP computing system;
retrieving, based on a comparison of enumerated files to logical paths associated with the SDP computing system to identify one or more new files and by the known deployed file metadata analysis engine from the SDP computing system via a network, the one or more new files;
extracting, by the known deployed file metadata analysis engine, metadata from each of the one or more new files;
recursively extracting, based on an indication that a file of the one or more new files is a container file and by the known deployed file metadata analysis engine, metadata from each file stored in the container file of the one or more new files;
identifying, by the known deployed file metadata analysis engine, a match of metadata of a file of the one or more new files and metadata stored in a data store comprising information stored of “known-good” files that comprises an indication of one or more of an associated internal development group and a trusted vendor providing “safe” applications;
enriching, by the known deployed file metadata analysis engine, the matched metadata with an indication that the file is “known-deployed”, wherein the indication comprises artifact metadata only available during dynamic execution of a particular entry of an artifact by the known deployed file metadata analysis engine, and wherein the artifact metadata comprises an indication of the SDP and an indication that the file was introduced to a host through methods associated with approved software distribution practices and wherein artifact file metadata is enriched with labels to identify a functionality associated with the artifact;
triggering, by the known deployed file metadata analysis engine, synchronization of stored metadata to an external computing system based on an update of the matched metadata to allow elimination of deployment-related activity from analysis; and
causing, based on the synchronization, analysis of newly saved files by the SDP using synchronized metadata to identify potentially malicious content.