# US 12,007,969 B2 · Automatic computer data deduplication process for application whitelisting system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,007,969 B2 - Document ID: US12007969B2 - Status: Granted - Kind: B2 - Application number: 17/819,222 - Filed: 2022-08-11 - Published: 2024-02-15 - Granted: 2024-06-11 - Earliest claimed: 2022-08-11 - Assignees: Saudi Arabian Oil Company - Applicants: Saudi Arabian Oil Company - Inventors: Dana Baghabrah; Aseel Alomair; Asma Soleja - Web page: https://patentgrep.com/patent/US12007969B2 ## CPC - G06F 16/215: Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors - G06F 21/629: {to features or functions of an application} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method to perform application whitelisting for a computer system is disclosed. The method includes detecting, in an application whitelisting database of the computer system, that a first agent entry and a second agent entry have a same machine name within the computer system, recording, in a duplicates repository separate from the application whitelisting database, the first agent entry and the second agent entry, detecting, in the duplicates repository separate from the application whitelisting database, that the first agent entry has a connected status, recording, in a connected duplicates repository separate from the application whitelisting database, the first agent entry based on the connected status, determining, by at least comparing the duplicates repository and the connected duplicates repository, that the second agent entry is a disconnected duplicate of the first agent entry, and deleting, in response to said determining, the second agent entry from the application whitelisting database. ## Claims ### Claim 1 A method to perform application whitelisting for a computer system, comprising: detecting, by a computer processor and in an application whitelisting database of the computer system, that a first agent entry and a second agent entry have a same machine name within the computer system; recording, by the computer processor and in a duplicates repository separate from the application whitelisting database, the first agent entry and the second agent entry; detecting, by the computer processor and in the duplicates repository separate from the application whitelisting database, that the first agent entry has a connected status; recording, by the computer processor and in a connected duplicates repository separate from the application whitelisting database, the first agent entry based on the connected status; determining, by the computer processor at least comparing the duplicates repository and the connected duplicates repository, that the second agent entry is a disconnected duplicate of the first agent entry; deleting, by the computer processor and in response to said determining, the second agent entry from the application whitelisting database, and increasing operation efficiency of the computer system by dynamically reducing, based at least on the computer processor deleting the second agent entry, a space of the application whitelisting database, wherein a number of times that a human analyst needs to investigate the application whitelisting database is reduced based at least on the computer processor deleting the second agent entry. ### Claim 2 (depends on 1) The method of claim 1, further comprising: storing, prior to deleting the second agent entry from the application whitelisting database, the second agent entry and associated information in a disconnected repository separate from the application whitelisting database. ### Claim 3 (depends on 2) The method of claim 2, further comprising: detecting, prior to said storing, that the second agent entry has a disabled policy; and changing, prior to said storing, the disabled policy of the second agent to a non-disabled policy. ### Claim 4 (depends on 2) The method of claim 2, wherein the disconnected repository comprises a comma-separated-values (CSV) file. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining that the second agent entry has a days-off value exceeding a pre-determined threshold, wherein deleting the second agent entry from the application whitelisting database is based on the days-off value exceeding the pre-determined threshold. ### Claim 6 (depends on 4) The method of claim 4, wherein the pre-determined threshold is specified as 90 days. ### Claim 7 (depends on 1) The method of claim 1, further comprising: deleting, in response to deleting the second agent entry from the application whitelisting database, the first agent entry and the second agent entry from the duplicates repository. ### Claim 8 A system, comprising: a computer processor; and memory storing instructions, when executed, causing the computer processor to: detect, in an application whitelisting database of a computer system, that a first agent entry and a second agent entry have a same machine name within the computer system; record, in a duplicates repository separate from the application whitelisting database, the first agent entry and the second agent entry; detect, in the duplicates repository separate from the application whitelisting database, that the first agent entry has a connected status; record, in a connected duplicates repository separate from the application whitelisting database, the first agent entry based on the connected status; determine, by at least comparing the duplicates repository and the connected duplicates repository, that the second agent entry is a disconnected duplicate of the first agent entry; delete, in response to said determining, the second agent entry from the application whitelisting database; and increases operation efficiency of the system by dynamically reducing, based at least on the computer processor deleting the second agent entry, a space of the application whitelisting database, wherein a number of times that a human analyst needs to investigate the application whitelisting database is reduced based at least on the computer processor deleting the second agent entry. ### Claim 9 (depends on 8) The system of claim 8, the instructions, when executed, further causing the computer processor to: store, prior to deleting the second agent entry from the application whitelisting database, the second agent entry and associated information in a disconnected repository separate from the application whitelisting database. ### Claim 10 (depends on 9) The system of claim 9, the instructions, when executed, further causing the computer processor to: detect, prior to said storing, that the second agent entry has a disabled policy; and change, prior to said storing, the disabled policy of the second agent to a non-disabled policy. ### Claim 11 (depends on 9) The system of claim 9, wherein the disconnected repository comprises a comma-separated-values (CSV) file. ### Claim 12 (depends on 8) The system of claim 8, the instructions, when executed, further causing the computer processor to: determine that the second agent entry has a days-off value exceeding a pre-determined threshold, wherein deleting the second agent entry from the application whitelisting database is based on the days-off value exceeding the pre-determined threshold. ### Claim 13 (depends on 12) The system of claim 12, wherein the pre-determined threshold is specified as 90 days. ### Claim 14 (depends on 8) The system of claim 8, the instructions, when executed, further causing the computer processor to: delete, in response to deleting the second agent entry from the application whitelisting database, the first agent entry and the second agent entry from the duplicates repository. ### Claim 15 An application whitelisting system, comprising: an application whitelisting database of a computer system; a duplicates repository separate from the application whitelisting database; a connected duplicates repository separate from the application whitelisting database; a computer processor; and memory storing instructions, when executed, causing the computer processor to: detect, in the application whitelisting database, that a first agent entry and a second agent entry have a same machine name within the computer system; record, in the duplicates repository, the first agent entry and the second agent entry; detect, in the duplicates repository, that the first agent entry has a connected status; record, in the connected duplicates repository, the first agent entry based on the connected status; determine, by at least comparing the duplicates repository and the connected duplicates repository, that the second agent entry is a disconnected duplicate of the first agent entry; delete, in response to said determining, the second agent entry from the application whitelisting database, and increase operation efficiency of the computer system by dynamically reducing, based at least on said deleting the second agent entry, a space of the application whitelisting database, wherein a number of times that a human analyst needs to investigate the application whitelisting database is reduced based at least on said deleting the second agent entry. ### Claim 16 (depends on 15) The application whitelisting system of claim 15, the instructions, when executed, further causing the computer processor to: store, prior to deleting the second agent entry from the application whitelisting database, the second agent entry and associated information in a disconnected repository separate from the application whitelisting database. ### Claim 17 (depends on 16) The application whitelisting system of claim 16, the instructions, when executed, further causing the computer processor to: detect, prior to said storing, that the second agent entry has a disabled policy; and change, prior to said storing, the disabled policy of the second agent to a non-disabled policy. ### Claim 18 (depends on 16) The application whitelisting system of claim 16, wherein the disconnected repository comprises a comma-separated-values (CSV) file. ### Claim 19 (depends on 15) The application whitelisting system of claim 15, the instructions, when executed, further causing the computer processor to: determine that the second agent entry has a days-off value exceeding a pre-determined threshold, wherein deleting the second agent entry from the application whitelisting database is based on the days-off value exceeding the pre-determined threshold. ### Claim 20 (depends on 15) The application whitelisting system of claim 15, the instructions, when executed, further causing the computer processor to: delete, in response to deleting the second agent entry from the application whitelisting database, the first agent entry and the second agent entry from the duplicates repository.