3rd party data explorer

Patent metadata

Field	Value
Publication number	US-2024430267-A1
Application number	US-202418829974-A
Country	US
Kind code	A1
Filing date	Sep 10, 2024
Priority date	Feb 4, 2022
Publication date	Dec 26, 2024
Grant date	—

Abstract

Systems and methods for managing third party data are provided. A third party data management system includes a processing circuit. The processing circuit is configured to receive first third party activity data from a source computing system and via a cybersecurity correlation and analytics computing system, determine a computing entity external to the third party data management system associated with the third party activity data based on at least one item extracted from the first third party activity data, periodically monitor third party activity associated with the computing entity, comprising operations to collect second third party activity data, and correlate the monitored second third party activity data to an entity profile.

First claim

What is claimed is:

1 . A system, comprising:
a processing circuit configured to:
extract an identifier from first third party activity data, wherein the identifier is extracted based at least in part on routing information of a traffic packet of the first third party activity data;
determine an item of an entity profile based at least in part on the identifier;
based on the item, determine a computing entity external to the system associated with the first third party activity data and the identifier; and
monitor third party activity on a plurality of data channels associated with the computing entity, comprising collecting second third party activity data, wherein collecting the second third party activity data comprise querying or accessing the plurality of data channels.

2 . The system of claim 1 , wherein the routing information comprises at least one of a source information or a destination information of the traffic packet.

3 . The system of claim 1 , wherein the routing information comprises at least one of application-layer level routing information, Transport Layer Security (TLS) routing information, Security Shell Layer (SSL) routing information, Simple Mail Transfer Protocol (SMTP) routing information, transport or Internet-link level routing information, or data link-layer routing information.

4 . The system of claim 1 , wherein at least one of a header, a footer, or metadata of the traffic packet comprises the routing information.

5 . The system of claim 1 , wherein the identifier comprises at least one of a domain identifier, subdomain identifier, email address, file name, or Internet Protocol (IP) address.

6 . The system of claim 1 , wherein the processing circuit is communicatively coupled to a database comprising a system of records retrievably storing a plurality of data points associated with a plurality of third party entities, and wherein at least one in the plurality of data points represents a policy associated with the monitored third party activity, the processing circuit being further configured to correlate the monitored third party activity to the policy.

7 . The system of claim 1 , wherein
the processing circuit is further configured to identify an unknown computing entity external to the system associated with the first third party activity data, the identifier comprises at least one of a cookie, a unique code, a public/private key, a user name, an active directory handle, a social media handle, an email address, or a financial account identifier.

8 . The system of claim 7 , wherein the processing circuit is further configured to:
generate a notification comprising the identifier; and transmit the notification to an administrator associated with the entity profile.

9 . The system of claim 1 , wherein the processing circuit is further configured to generate a user interface comprising a graphical representation of the entity profile.

10 . A method, comprising:
extracting, by a processing circuit, an identifier from first third party activity data, wherein the identifier is extracted based at least in part on routing information of a traffic packet of the first third party activity data; determining, by the processing circuit, an item of an entity profile based at least in part on the identifier; based on the item, determining, by the processing circuit, a computing entity external to the system associated with the first third party activity data and the identifier; and monitoring, by the processing circuit, third party activity on a plurality of data channels associated with the computing entity, comprising collecting second third party activity data, wherein collecting the second third party activity data comprise querying or accessing the plurality of data channels.

11 . The method of claim 10 , wherein the routing information comprises at least one of a source information or a destination information of the traffic packet.

12 . The method of claim 10 , wherein the routing information comprises at least one of application-layer level routing information, Transport Layer Security (TLS) routing information, Security Shell Layer (SSL) routing information, Simple Mail Transfer Protocol (SMTP) routing information, transport or Internet-link level routing information, or data link-layer routing information.

13 . The method of claim 10 , wherein at least one of a header, a footer, or metadata of the traffic packet comprises the routing information.

14 . The method of claim 10 , wherein the identifier comprises at least one of a domain identifier, subdomain identifier, email address, file name, or Internet Protocol (IP) address.

15 . The method of claim 10 , wherein the processing circuit is communicatively coupled to a database comprising a system of records retrievably storing a plurality of data points associated with a plurality of third party entities, and wherein at least one in the plurality of data points represents a policy associated with the monitored third party activity, the processing circuit being further configured to correlate the monitored third party activity to the policy.

16 . The method of claim 10 , further comprising identifying an unknown computing entity external to the system associated with the first third party activity data, wherein the identifier comprises at least one of a cookie, a unique code, a public/private key, a user name, an active directory handle, a social media handle, an email address, or a financial account identifier.

17 . The method of claim 16 , further comprising:
generating a notification comprising the identifier; and transmitting the notification to an administrator associated with the entity profile.

18 . The method of claim 10 , further comprising generating a user interface comprising a graphical representation of the entity profile.

19 . One or more non-transitory computer readable media storing instructions that, when executed by a processor, causes the processor to:
extract an identifier from first third party activity data, wherein the identifier is extracted based at least in part on routing information of a traffic packet of the first third party activity data; determine an item of an entity profile based at least in part on the identifier; based on the item, determine a computing entity external to the system associated with the first third party activity data and the identifier; and monitor third party activity on a plurality of data channels associated with the computing entity, comprising collecting second third party activity data, wherein collecting the second third party activity data comprise querying or accessing the plurality of data channels.

20 . The non-transitory computer readable media of claim 19 , wherein the routing information comprises at least one of a source information or a destination information of the traffic packet.

Assignees

• Wells Fargo Bank Na

Inventors

• Edison Charles Steven
• Wurzer Kevin Michael
• Wegba Kodzo
• Bonk James Ellis
• Smith James A
• Vue Cheng Tcha
• Jacobson Paul D
• Fricano Daniel

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title