# US 12,008,114 B2 · Custom patching automation with machine learning integration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,114 B2 - Document ID: US12008114B2 - Status: Granted - Kind: B2 - Application number: 18/139,455 - Filed: 2023-04-26 - Published: 2023-08-17 - Granted: 2024-06-11 - Earliest claimed: 2020-06-16 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Syed Luqman Ahmed; Adi Narayana Rao Garaga - Web page: https://patentgrep.com/patent/US12008114B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A machine learning computing system identifies a vulnerability associated with a server. Based on information associated with the server and a knowledge base, the computing system schedules an interval for patching the server in a centralized tracking module. Based on the knowledge base and the vulnerability, the computing system creates, validates, and deploys the patch job. During patch job execution, the computing system monitors the status of the patch job at the server and transmits status updates to a user interface module. After expiration of the interval, the computing system generates an assessment report for the executed patch job. The computing system updates the knowledge base based on the assessment report to improve future decisioning processes. Based on the success or failure of the patch job, the computing system, upon a failure indication, automatically reschedules an interval for patching the server. ## Claims ### Claim 1 A system comprising: a plurality of servers communicatively coupled to an enterprise network, the plurality of servers; and a computing platform, comprising: one or more processors; a communication interface communicatively coupled to the one or more processors; and memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: identify, based on a knowledge base of a machine learning module and analysis of the plurality of servers, a vulnerability associated with a server of the plurality of servers; schedule, based on analysis of system information associated with the server and analysis of the knowledge base by the machine learning module, a time interval associated with the server, wherein the time interval comprises an outage period for the server and a tracking module identifies information for existing time intervals associated with the plurality of servers; generate, automatically and by a patch generator, a patch job comprising an update to software running on the server to correct an identified vulnerability, wherein the patch job specifies that sub-processes of the patch occur in a specific sequence; deploy, to the server, the patch job; validate, during the time interval and continuously during execution of the patch job, that the sub-processes are ordered correctly; modify, based on an indication that the sub-processes are ordered incorrectly, an update sequence of the patch job; cause display, via a network and at a user interface, updates comprising information associated with execution of the patch job; analyze, by the machine learning module, an assessment report associated with an executed patch job; and update the knowledge base of the machine learning module based on the analysis of the assessment report associated with the executed patch job. ### Claim 2 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: predict, based on the knowledge base of the machine learning module and analysis the vulnerability, the patch job. ### Claim 3 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: analyze, by the machine learning module, system information associated with the server, wherein the system information comprises usage information for content associated with the server, a geographic location of the server, a reserved maintenance window associated with the server, and an identifier associated with a classification of the server. ### Claim 4 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: communicate, via the network and based on scheduling the time interval associated with the server, a notification to a plurality of individuals associated with the server, wherein the notification comprises information associated with the time interval. ### Claim 5 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: generate, by the machine learning module and based on the vulnerability, a patch job configuration file for use in generating a patch job for the vulnerability associated with the server. ### Claim 6 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: validate, based on the knowledge base of the machine learning module and the tracking module, execution of the patch job, wherein an unsuccessful patch job corresponds to continued exposure to the vulnerability identify an error associated with the unsuccessful patch job; predict a solution for the error; and add associated information of the error and the predicted solution to the knowledge base. ### Claim 7 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: generate, based on expiration of the time interval and based on completion of the executed patch job, the assessment report associated with the executed patch job. ### Claim 8 (depends on 1) The system of claim 1, wherein the instructions, when executed by the one or more processors, cause the computing platform to: assign, by the machine learning module and at the tracking module, responsibility for the vulnerability to a plurality of individuals associated with the server; and communicate, via the network, a notification to a plurality of individuals associated with the server, wherein the notification comprises information associated with the responsibility for the vulnerability. ### Claim 9 One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising one or more processors, memory, and a communication interface, cause the computing platform to: identify, based on a knowledge base of a machine learning module and analysis of a plurality of servers, a vulnerability associated with a server of the plurality of servers; schedule, based on analysis of system information associated with the server and analysis of the knowledge base by the machine learning module, a time interval associated with the server, wherein the time interval comprises an outage period for the server and a tracking module processes information for time intervals associated with the plurality of servers; generate, automatically and by a patch generator, a patch job comprising an update to software running on the server to correct an identified vulnerability, wherein the patch job specifies that sub-processes of the patch occur in a specific sequence; deploy, to the server, the patch job; validate, during the time interval and continuously during execution of the patch job, that the sub-processes are ordered correctly; modify, based on an indication that the sub-processes are ordered incorrectly, an update sequence of the patch job; cause display, via a network and at a user interface of a computing device, updates comprising information associated with execution of a patch job; analyze, by the machine learning module, an assessment report associated with an executed patch job; and store, at the knowledge base of the machine learning module, results of the analysis of the assessment report associated with the executed patch job. ### Claim 10 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: predict, based on the knowledge base of the machine learning module and analysis of the vulnerability, the patch job. ### Claim 11 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: analyze, by the machine learning module, system information associated with the server, wherein the system information comprises usage information for content associated with the server, a geographic location of the server, a reserved maintenance window associated with the server, and an identifier associated with a classification of the server. ### Claim 12 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: communicate, via the network and based on scheduling the time interval associated with the server, a notification to a plurality of individuals associated with the server, wherein the notification comprises information associated with the time interval. ### Claim 13 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: generate, by the machine learning module and based on the vulnerability, a patch job configuration file for use in generating a patch job for the vulnerability associated with the server; and cause, based on the configuration file, execution of the patch job. ### Claim 14 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: cause, based on a configuration file, execution of the patch job; and validate, based on the knowledge base of the machine learning module and the tracking module, execution of the patch job. ### Claim 15 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: generating, based on expiration of the time interval, the assessment report associated with the executed patch job. ### Claim 16 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing platform to: assign, by the machine learning module and at the tracking module, responsibility for the vulnerability to a plurality of individuals associated with the server; and communicate, via the network, a notification to a plurality of individuals associated with the server, wherein the notification comprises information associated with the responsibility for the vulnerability. ### Claim 17 A method, comprising: identifying, based on a knowledge base of a machine learning module and analysis of a plurality of servers, a vulnerability associated with a server of the plurality of servers; scheduling, based on analysis of system information associated with the server and analysis of the knowledge base by the machine learning module, a time interval associated with the server, wherein the time interval comprises an outage period for the server and a tracking module identifies information for existing time intervals associated with the plurality of servers; generating, automatically and by a patch generator, a patch job comprising an update to software running on the server to correct an identified vulnerability, wherein the patch job specifies that sub-processes of the patch occur in a specific sequence; causing execution, after deployment to the server and based on the time interval, of the patch job associated with the vulnerability at the server; validating, continuously during execution of the patch job, that the sub-processes are ordered correctly; modifying, based on an indication that the sub-processes are ordered incorrectly, an update sequence of the patch job; causing display, via a network and at a user interface, updates comprising information associated with execution of the patch job; analyzing, by the machine learning module, an assessment report associated with an executed patch job; and updating the knowledge base of the machine learning module based on the analysis of the assessment report associated with the executed patch job. ### Claim 18 (depends on 17) The method of claim 17, comprising: generating, by the machine learning module and based on the vulnerability, a patch job configuration file for use in generating a patch job for the vulnerability associated with the server; and deploying the patch job to the server, wherein execution of the patch job is based on the configuration file. ### Claim 19 (depends on 17) The method of claim 17, comprising: validating, based on the knowledge base of the machine learning module, execution of the patch job, wherein execution of the patch job is based on a configuration file. ### Claim 20 (depends on 17) The method of claim 17, comprising: validating, based on the knowledge base of the machine learning module, execution of the patch job, wherein execution of the patch job is based on a configuration file generating, based on expiration of the time interval and based on completion of the executed patch job, the assessment report associated with the executed patch job.