Patent ID: 11966472
Assignee: BANK OF AMERICA CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. Non-transitory computer-readable media storing instructions that, when executed by a computing device comprising at least one processor, memory, and a communication interface, cause the computing device to:
enumerate, based on an indication received from a software distribution point (SDP) computing system that indicates at least one file has been created, available files stored on the SDP computing system;
compare enumerated files to logical paths associated with the SDP computing system to identify one or more new files;
retrieve, from the SDP computing system via a network, the one or more new files;
extract metadata from each of the one or more new files;
recursively extract, based on an indication that a file of the one or more new files is a container file, metadata from each file stored in the container file of the one or more new files;
identify a match of metadata of a file of the one or more new files and metadata stored in a data store comprising information stored of “known-good” files;
enrich the matched metadata with an indication that the file is “known-deployed”, wherein the indication comprises artifact metadata only available during dynamic execution of a particular entry of an artifact by a known deployed file metadata analysis engine, and wherein the artifact metadata comprises an indication of the SDP computing system and an indication that the file was introduced to a host through methods associated with approved software distribution practices and wherein artifact file metadata is enriched with labels to identify a functionality associated with the artifact;
trigger synchronization of stored metadata to an external computing system based on an update of the matched metadata to allow elimination of deployment-related activity from analysis; and
causing, based on the synchronization, analysis of newly saved files by the SDP using stored synchronized metadata to identify potentially malicious content.