Abstract: Systems, computer program products, and methods are described herein for leveraging a distributed network system for secure data transfers. The present disclosure is configured to receive a data transfer from an entity where the entity is at least partially implicated within the data transfer, where the data transfer comprises participants; record the data transfer within a distributed network system, where the distributed network system comprises previous data transfers; verify identities of participants associated with the data transfer; and trigger the data transfer between participants.

Abstract: Aspects of the disclosure relate to using multiple machine learning models and a sand-box environment to detect malicious uniform resource locators (URLs) and login pages stored in a QR code. An application on a computing device will augment QR code data stored in a QR code and the computing device sends the QR code data and computing device metadata to a deep learning computing platform. The QR code data may comprise a URL and communication protocol information. The deep learning computing platform will generate, by multiple machine learning models and a sand-box environment, a sand-box score using the URL, a user-based score using the computing device metadata, and a connections score using the communication protocol information. The deep learning platform then determines whether the computing device should reject and delete the QR code data based on whether the scores are below a pre-determined threshold.

Abstract: Arrangements for detecting polymorphic botnets using a pattern matching engine are provided. The platform may train a pattern matching engine to generate image pattern statuses based on a training set of historical image patterns. The platform may automatically generate real-time interaction information based on monitoring interactions between user devices and cloud platforms. The platform may generate a potentially malicious image pattern based on the real-time interaction information. The platform may then input the image pattern into the pattern matching engine to generate an image pattern status for the image pattern. The platform may store the image pattern to a pattern storage repository. Based on identifying the image pattern as malicious, the platform may initiate a security action. The platform may update the pattern matching engine based on the image pattern and its image pattern status to detect future polymorphic botnet attacks.

Abstract: Systems, computer program products, and methods are described herein for robotic process automation (RPA) and machine learning (ML) for dynamic network monitoring and packet validation in electronic environments. The present disclosure is configured to extract data from network data packets received from at least one or more data sources and determine, using an ML engine, at least one network event trigger based on the data. The system also determines, using the ML engine, bot criteria of an RPA bot based on the at least one network event trigger. Also, the system assigns the RPA bot to execute a network transmission protocol based on at least the bot criteria and executes, via the RPA bot, a network transmission protocol.

Abstract: Systems, computer program products, and methods are described herein for computer network event data redundancy suppression via integrated machine learning. The present disclosure includes receiving interaction data from at least one endpoint device of a plurality of endpoint devices, recording the interaction data in usage logs, determining a presence of an event in the usage logs using at least one log analysis platform, enriching, using a lookup command of a network event management system, the event to form at least one enriched event, transmitting the at least one enriched event to a first machine learning model, determining a presence of a fractional event based on the at least one enriched event, grouping the fractional event with related fractional events into an aggregate event, determining a target endpoint device group for transmitting the aggregate event, and transmitting the aggregate event to the target endpoint device group.

Abstract: Apparatus and methods for a proactive monitoring-container switching system is provided. The system may include a server cluster. The system may proactively monitor the servers within the cluster to determine if one or more servers within the cluster are showing weaknesses. Upon identifying the weaknesses, the system may identify an available server within the cluster and copy the contents of the weakened server to the available server. The system may then switch the DNS pointer from the weakened server to the available server. Switching the DNS pointer may switch any users and/or applications from the weakened server to the available server with minimal disruption. The synchronizing between servers may maintain the health of the server cluster.

Abstract: Systems, computer program products, and methods are described herein for resource tokenization using advanced computational models for data analysis and automated processing. The present disclosure is configured to receive a resource from a distributed network, wherein the distributed network is configured to digitize the resource. Further, the present disclosure is configured to execute a smart contract, wherein the smart contract is configured to automate execution of an agreement. Further still, the present disclosure is configured to transmit a notification to a user device to provide real-time access to the resource and resource data. Further still, the present disclosure is configured to configure, via an ownership engine, the resource data, wherein the ownership engine provides ownership transfers based on the agreement. Further still, the present disclosure is configured to implement, via an implementation engine, the resource on the distributed network.

Abstract: An apparatus may include a computer processor operating in a data center and running an AI/ML model. The apparatus may include a trace log agent and a telemetry agent. The computer processor may be configured to train and run the AI/ML model to determine if a resource in the data center is being utilized or is idle by using data provided by the trace log agent and a telemetry agent. The apparatus may include a status check engine, a discovery engine, and an analytics engine. The computer processor may be configured to run each of these engines to confirm a prediction by the AI/ML model that the resource is idle. The computer processor may be configured to notify an administrator of the data center if the AI/ML model predicts the resource is idle and the engines provide increased confidence to the prediction.

Abstract: Virtual machine images may be constantly scanned using background process, to identify current and evolving security risks, such as by optimizing the image scanning a last-in, first-out (LIFO) stack to prioritize most relevant images. Older and/or non-relevant image are removed from the scanning process and removed from use. Virtual machines image prioritization is based on each virtual machine image's current and/or potential usage requirement, where the LIFO stack prioritizes the scanning order. Newly created virtual machine images and/or newly re-activated virtual machine images are placed onto a provisioning queue (first-in, first out) before activation. The virtual machine images active within a host computing environment are processed via a reconciliation process to scan for indications of security vulnerabilities and/or threats to network security. Obsolete or otherwise irrelevant virtual machine images are removed from use via a repository synchronization process.

Abstract: An apparatus may include conduction of a secure transfer at a point of identification using image recognition and blockchain authentication. The apparatus may include a computer processor, a camera, an image capturing machine, a reference database, an XGBoost image recognition machine learning model, and a blockchain. The computer processor may be an edge computing device. The computer processor may be configured to identify a user at a point of identification by capturing an image, running the Features detection engine to identify sets of features, running the XGBoost image recognition machine learning model to identify labels in the sets of features, and matching the sets of features and labels to a record in the reference database. The computer processor may further be configured to seek user approval on the user's portable device before providing the transfer. Once the user has approved the transfer, the transfer may be recorded in the blockchain.

Abstract: Aspects of the disclosure relate to detecting attempts to violate the security of an ATM. A computing system may determine whether an ATM is being used to perform a transaction. Based on the ATM not being used to perform a transaction, images of portions of the ATM may be generated. Estimated dimensions of the ATM may be determined. Digital twin data may be retrieved. The digital twin data may comprise a digital twin representation of the ATM and measured dimensions of the ATM. There may be a determination of whether the estimated dimensions of the ATM match the measured dimensions of the ATM. Based on the estimated dimensions of the ATM not matching the measured dimensions of the ATM, the ATM may be deactivated. Furthermore, a message indicating that the ATM was deactivated may be sent to a validation computing system.

Abstract: Virtual machine images may be constantly scanned using background process, to identify current and evolving security risks, such as by optimizing the image scanning a last-in, first-out (LIFO) stack to prioritize most relevant images. Older and/or non-relevant image are removed from the scanning process and removed from use. Virtual machines image prioritization is based on each virtual machine image's current and/or potential usage requirement, where the LIFO stack prioritizes the scanning order. Newly created virtual machine images and/or newly re-activated virtual machine images are placed onto a provisioning queue (first-in, first out) before activation. The virtual machine images active within a host computing environment are processed via a reconciliation process to scan for indications of security vulnerabilities and/or threats to network security. Obsolete or otherwise irrelevant virtual machine images are removed from use via a repository synchronization process.

Abstract: Aspects of the disclosure are directed to importing software container images, where an image importer that may import a very large number of container images into local repositories from one or more upstream repositories to an enterprise container platform. An associated computing cluster executes containers (for example, applications and operators) based on the imported container images. Each release (version) of a product supported by the enterprise container platform may require importing newer image sets with respect to the current version. With one aspect, an image importer maintains an image list for container images of the current version, where only missing newer container images for a newer version are added to the list. Only the missing container images for the new version are imported to the enterprise container platform. This approach circumvents importing previously imported container and/or available newer images, thus reducing the amount of imported data from upstream repositories.

Abstract: Systems and methods for alerting an organization about activity that may be fraudulent. Systems may include a computer processor, a storage module, a cleaning module, a preprocessing module, a features extraction module, and a machine learning module. The computer processor may be configured to run a fraud detection engine by collecting publicly available electronic forms every 36 hours, using the modules to store the forms, clean the data, preprocess the data, and run a machine learning model to extract features and to determine if a threshold indicating a risk of fraud has been exceeded. The machine learning models include a liquid, solvency, and profitability ratio classification model, a disclosure classification model, a sentiment analysis model, an anomaly detection classification model, an ownership analysis classification model, and an ESG disclosure classification model. When exceeding a threshold, the computer processor may notify an administrator of the exceeded threshold's identity.

Abstract: A computing platform may train, using historical information migration error information, an information reconciliation engine to predict information migration errors. The computing platform may detect migration of information from a source information system to a target information system. The computing platform may generate, by inputting the information into the information reconciliation engine, a list of predicted migration errors. The computing platform may sample the migrated information to identify a list of real time migration errors. The computing platform may identify corrective actions to address the list of predicted migration errors and the list of real time migration errors. The computing platform may generate, based on the corrective actions, a configuration file.

Abstract: A video QR code may be used to authenticate a user using a user device. The video QR code may include a video in which a QR code is shown in motion over a time interval. The movement may be, for example, a change in position or orientation of the QR code. The authentication process may include generating the video QR code, causing a display of the video QR code, capturing, with the user device from the display, images of the QR code at specified times during the video, and determining whether there is a match between the captured images on the user device and the displayed images at the specified times. The authentication may also confirm the geolocation of the user device and the display match. The QR code may be extracted from the images. User access to a system may be granted upon verification of the QR code.

Abstract: Aspects of the disclosure relate to detecting attempts to violate the security of an ATM. A computing system may determine whether an ATM is being used to perform a transaction. Based on the ATM not being used to perform a transaction, images of portions of the ATM may be generated. Estimated dimensions of the ATM may be determined. Digital twin data may be retrieved. The digital twin data may comprise a digital twin representation of the ATM and measured dimensions of the ATM. There may be a determination of whether the estimated dimensions of the ATM match the measured dimensions of the ATM. Based on the estimated dimensions of the ATM not matching the measured dimensions of the ATM, the ATM may be deactivated. Furthermore, a message indicating that the ATM was deactivated may be sent to a validation computing system.

Abstract: An apparatus may include conduction of a secure transfer at a point of identification using image recognition and blockchain authentication. The apparatus may include a computer processor, a camera, an image capturing machine, a reference database, an XGBoost image recognition machine learning model, and a blockchain. The computer processor may be an edge computing device. The computer processor may be configured to identify a user at a point of identification by capturing an image, running the Features detection engine to identify sets of features, running the XGBoost image recognition machine learning model to identify labels in the sets of features, and matching the sets of features and labels to a record in the reference database. The computer processor may further be configured to seek user approval on the user's portable device before providing the transfer. Once the user has approved the transfer, the transfer may be recorded in the blockchain.

Abstract: An apparatus may include a computer processor operating in a data center and running an AI/ML model. The apparatus may include a trace log agent and a telemetry agent. The computer processor may be configured to train and run the AI/ML model to determine if a resource in the data center is being utilized or is idle by using data provided by the trace log agent and a telemetry agent. The apparatus may include a status check engine, a discovery engine, and an analytics engine. The computer processor may be configured to run each of these engines to confirm a prediction by the AI/ML model that the resource is idle. The computer processor may be configured to notify an administrator of the data center if the AI/ML model predicts the resource is idle and the engines provide increased confidence to the prediction.

Abstract: Arrangements for detecting polymorphic botnets using a pattern matching engine are provided. The platform may train a pattern matching engine to generate image pattern statuses based on a training set of historical image patterns. The platform may automatically generate real-time interaction information based on monitoring interactions between user devices and cloud platforms. The platform may generate a potentially malicious image pattern based on the real-time interaction information. The platform may then input the image pattern into the pattern matching engine to generate an image pattern status for the image pattern. The platform may store the image pattern to a pattern storage repository. Based on identifying the image pattern as malicious, the platform may initiate a security action. The platform may update the pattern matching engine based on the image pattern and its image pattern status to detect future polymorphic botnet attacks.