Granted Patent B2

US 12,299,155 · App. 17/697,157 · Granted May 13, 2025

Inventors: George Albero (Charlotte, NC); Olga Kocharyan (Matthews, NC)

Assignee: Bank of America Corporation

G06F21/6218G06F21/53G06N5/022G06Q10/105G06F2221/034

Abstract

Claims (126)

1. A computing platform comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the processor, cause the computing platform to:

monitor, for a plurality of employees, employee activity within an enterprise organization;

generate, for each employee of the plurality of employees, employee control thresholds;

generate, based on an indication from an employee computing device of an employee of the plurality of employees, modified employee control thresholds associated with the employee; and

generate data that is used to train a machine learning model, wherein the training data comprises the employee activity associated with the employee, the employee control thresholds associated with the employee, and the modified employee control thresholds associated with the employee;

train, based on the data and using one or more supervised learning techniques, the machine learning model, wherein training the machine learning model configures the machine learning model to perform anomaly detection in analysis of employee activity information;

generate, based on the indication, test data, wherein the test data comprises a subset of the employee activity associated with the employee;

analyze, within a sandbox environment, the test data;

determine, based on the analysis, whether to:

transmit a notification to an enterprise computing device indicating the test data complies with the employee control thresholds associated with the employee; or

transmit a notification to the enterprise computing device indicating the test data does not comply with the employee control thresholds associated with the employee; and

refine, using a dynamic feedback loop and based on the modified employee control thresholds, the machine learning model, wherein the refining continuously improves accuracy of the machine learning model.

2. The computing platform of claim 1 , wherein:

the enterprise computing device is further configured to receive, from the computing platform, a notification indicating one of:

test data compliance with the employee control thresholds associated with the employee; or

test data non-compliance with the employee control thresholds associated with the employee.

3. The computing platform of claim 1 , wherein the employee activity indicates at least one of:

enterprise databases accessed by the employee;

enterprise applications accessed by the employee;

a ledger indicating a date and a time that the employee entered the enterprise organization;

human resources records associated with the employee;

an IP address associated with the employee computing device;

a multi-factor authentication process associated with the employee computing device; or

keyword searches performed by the employee.

4. The computing platform of claim 1 , wherein the generating the employee control thresholds comprises:

determining a role within the enterprise organization associated with the employee and a line of business associated with the employee;

determining an access level associated with the employee based on the role and the line of business;

comparing the access level associated with the employee to access levels associated with other employees, within the plurality of employees, in a same role and a same line of business as the employee; and

modifying the access level associated with the employee based on the comparison.

5. The computing platform of claim 4 , wherein the analyzing the test data comprises:

comparing the test data to employee activity associated with other employees, within the plurality of employees, in the same role and the same line of business as the employee;

determining whether the test data matches the employee activity associated with the other employees, within the plurality of employees, in the same role and the same line of business as the employee; and

determining:

based on the test data matching the employee activity associated with the other employees, that the test data is not an outlier; or

based on the test data failing to match the employee activity associated with the other employees, that the test data is an outlier.

6. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the processor, further cause the computing platform to:

implement, based on the indication from the employee computing device, the modified employee control thresholds; and

initiate, based on the notification indicating the test data does not comply with the employee control thresholds associated with the employee, a security review of the employee activity associated with the employee.

7. The computing platform of claim 1 , wherein the indication from the employee computing device comprises at least one of:

a letter of resignation;

suspicious activity flagged within the employee activity associated with the employee; or

reduced employee presence within the enterprise organization.

8. A method comprising:

at a computing device comprising at least one processor, a communication interface, and memory:

monitoring, for a plurality of employees, employee activity within an enterprise organization;

generating, for each employee of the plurality of employees, employee control thresholds;

generating, based on an indication from an employee computing device of an employee of the plurality of employees, modified employee control thresholds associated with the employee;

generating training data for training a machine learning model, wherein the training data comprises the employee activity associated with the employee, the employee control thresholds associated with the employee, and the modified employee control thresholds associated with the employee;

training, based on the data and using one or more supervised learning techniques, the machine learning model, wherein training the machine learning model configures the machine learning model to perform anomaly detection in analysis of employee activity information;

generating, based on the indication, test data, wherein the test data comprises a subset of the employee activity associated with the employee;

analyzing, within a sandbox environment, the test data;

determining, based on the analysis, whether to:

transmit a notification to the enterprise organization indicating the test data complies with the employee control thresholds associated with the employee; or

transmit a notification to the enterprise organization indicating the test data does not comply with the employee control thresholds associated with the employee; and

refining, using a dynamic feedback loop and based on the modified employee control thresholds, the machine learning model, wherein the refining continuously improves accuracy of the machine learning model.

9. The method of claim 8 , wherein:

the enterprise computing device is further configured to receive, from the computing device, a notification indicating one of:

test data compliance with the employee control thresholds associated with the employee; or

test data non-compliance with the employee control thresholds associated with the employee.

10. The method of claim 8 , wherein the employee activity indicates at least one of:

enterprise databases accessed by the employee;

enterprise applications accessed by the employee;

a ledger indicating a date and a time that the employee entered the enterprise organization;

human resources records associated with the employee;

an IP address associated with the employee computing device;

a multi-factor authentication process associated with the employee computing device; or

keyword searches performed by the employee.

11. The method of claim 8 , wherein the generating the employee control thresholds comprises:

determining a role within the enterprise organization associated with the employee and a line of business associated with the employee;

determining an access level associated with the employee based on the role and the line of business;

comparing the access level associated with the employee to access levels associated with other employees, within the plurality of employees, in a same role and a same line of business as the employee; and

modifying the access level associated with the employee based on the comparison.

12. The method of claim 11 , wherein the analyzing the test data comprises:

comparing the test data to employee activity associated with other employees, within the plurality of employees, in the same role and the same line of business as the employee;

determining whether the test data matches the employee activity associated with the other employees, within the plurality of employees, in the same role and the same line of business as the employee; and

determining:

based on the test data matching the employee activity associated with the other employees, that the test data is not an outlier; or

based on the test data failing to match the employee activity associated with the other employees, that the test data is an outlier.

13. The method of claim 8 , further comprising:

implementing, based on the indication from the employee computing device, the modified employee control thresholds; and

initiating, based on the notification indicating the test data does not comply with the employee control thresholds associated with the employee, a security review of the employee activity associated with the employee.

14. The method of claim 8 , wherein the indication from the employee computing device comprises at least one of:

a letter of resignation;

suspicious activity flagged within the employee activity associated with the employee; or

reduced employee presence within the enterprise organization.

15. One or more non-transitory computer-readable media storing instructions that, when executed by a computing device comprising at least one processor, a communication interface, and memory, cause the computing device to:

monitor, for a plurality of employees, employee activity within an enterprise organization;

generate, for each employee of the plurality of employees, employee control thresholds;

generate, based on an indication from an employee computing device of an employee of the plurality of employees, modified employee control thresholds associated with the employee; and

generate data that is used to train a machine learning model, wherein the training data comprises the employee activity associated with the employee, the employee control thresholds associated with the employee, and the modified employee control thresholds associated with the employee;

train, based on the data and using one or more supervised learning techniques, the machine learning model, wherein training the machine learning model configures the machine learning model to perform anomaly detection in analysis of employee activity information;

generate, based on the indication, test data, wherein the test data comprises a subset of the employee activity associated with the employee;

analyze, within a sandbox environment, the test data; and

determine, based on the analysis, whether to:

transmit a notification to an enterprise computing device indicating the test data complies with the employee control thresholds associated with the employee; or

transmit a notification to the enterprise computing device indicating the test data does not comply with the employee control thresholds associated with the employee; and

refine, using a dynamic feedback loop and based on the modified employee control thresholds, the machine learning model, wherein the refining continuously improves accuracy of the machine learning model.

16. The one or more non-transitory computer-readable media of claim 15 , wherein:

the enterprise computing device is further configured to receive, from the computing device, a notification indicating one of:

test data compliance with the employee control thresholds associated with the employee; or

test data non-compliance with the employee control thresholds associated with the employee.

17. The one or more non-transitory computer-readable media of claim 15 , wherein the employee activity indicates at least one of:

enterprise databases accessed by the employee;

enterprise applications accessed by the employee;

a ledger indicating a date and a time that the employee entered the enterprise organization;

human resources records associated with the employee;

an IP address associated with the employee computing device;

a multi-factor authentication process associated with the employee computing device; or

keyword searches performed by the employee.

18. The one or more non-transitory computer-readable media of claim 15 , wherein the generating the employee control thresholds comprises:

determining a role within the enterprise organization associated with the employee and a line of business associated with the employee;

determining an access level associated with the employee based on the role and the line of business;

comparing the access level associated with the employee to access levels associated with other employees, within the plurality of employees, in a same role and a same line of business as the employee; and

modifying the access level associated with the employee based on the comparison.

19. The one or more non-transitory computer-readable media of claim 18 , wherein the analyzing the test data comprises:

comparing the test data to employee activity associated with other employees, within the plurality of employees, in the same role and the same line of business as the employee;

determining whether the test data matches the employee activity associated with the other employees, within the plurality of employees, in the same role and the same line of business as the employee; and

determining:

based on the test data matching the employee activity associated with the other employees, that the test data is not an outlier; or

based on the test data failing to match the employee activity associated with the other employees, that the test data is an outlier.

20. The one or more non-transitory computer-readable media of claim 15 , wherein the memory stores additional computer-readable instructions that, when executed by the processor, further cause the computing device to:

implement, based on the indication from the employee computing device, the modified employee control thresholds; and

initiate, based on the notification indicating the test data does not comply with the employee control thresholds associated with the employee, a security review of the employee activity associated with the employee.

Assignments (1)

Continuity (1)

References Cited (37)