Supervisory control and data acquisition
View Patent ↗Aspects of the present disclosure relate to computer system security. A machine accesses a set of records corresponding to a set of users having access to a computer system. The machine stores, for each user in the set of users, a baseline profile representing baseline activity of the user with respect to a set of data sources of the computer system. The machine monitors activity of the set of users with respect to the set of data sources. The machine determines, based on monitoring the activity of the set of users, that a user action of a specified user, with respect to one or more data sources from the set of data sources, is anomalous relative to the baseline profile of the specified user. The machine provides a digital transmission representing the anomalous user action.
1. A control server comprising:
one or more processors; and
a memory storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile indicating whether the user has previously modified a certificate authority for the set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
determining, based on monitoring the activity of the set of users, that a user action of a specified user comprises modifying the certificate authority;
determining that the specified user has never modified the certificate authority previously; and
providing, in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously, a digital transmission representing the user action of the specified user.
2. The control server of claim 1 , wherein the set of data sources is hosted at a computer system.
3. The control server of claim 2 , wherein the set of data sources comprises one or more of: a packet log of packets travelling between the computer system and an external network, a driver log of the computer system, a secure socket layer (SSL) certificate authority (CA) of the computer system, a programmable logic controller (PLC) of the computer system, a simple mail transfer protocol (SMTP) log of the computer system, a web access log of the computer system, service repos of the computer system, network drives of the computer system, workstation performance logs of the computer system, and workstation network traffic of the computer system.
4. The control server of claim 2 , wherein the set of users having access to the set of data sources comprise system administrators of the computer system.
5. The control server of claim 2 , the operations further comprising:
blocking access, by the specified user, to the computer system in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously.
6. The control server of claim 1 , the operations further comprising:
detecting that the user action includes accessing the set of data sources at a time of day different from a time of day for accessing the set of data sources specified in the baseline profile.
7. The control server of claim 1 , the operations further comprising:
detecting that the user action includes accessing the set of data sources from a geographic location different from a geographic location for accessing the set of data sources specified in the baseline profile.
8. A non-transitory machine-readable medium storing instructions which, when executed by one or more processors of a machine, cause the one or more processors to perform operations comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile indicating whether the user has previously modified a certificate authority for the set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
determining, based on monitoring the activity of the set of users, that a user action of a specified user comprises modifying the certificate authority;
determining that the specified user has never modified the certificate authority previously; and
providing, in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously, a digital transmission representing the user action of the specified user.
9. The machine-readable medium of claim 8 , wherein the set of data sources is hosted at a computer system.
10. The machine-readable medium of claim 9 , wherein the set of data sources comprises one or more of:
a packet log of packets travelling between the computer system and an external network, a driver log of the computer system, a secure socket layer (SSL) certificate authority (CA) of the computer system, a programmable logic controller (PLC) of the computer system, a simple mail transfer protocol (SMTP) log of the computer system, a web access log of the computer system, service repos of the computer system, network drives of the computer system, workstation performance logs of the computer system, and workstation network traffic of the computer system.
11. The machine-readable medium of claim 9 , wherein the set of users having access to the set of data sources comprise system administrators of the computer system.
12. The machine-readable medium of claim 9 , the operations further comprising:
blocking access, by the specified user, to the computer system in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously.
13. The machine-readable medium of claim 8 , the operations further comprising:
detecting that the user action includes accessing the set of data sources at a time of day different from a time of day for accessing the set of data sources specified in the baseline profile.
14. The machine-readable medium of claim 8 , the operations further comprising:
detecting that the user action includes accessing the set of data sources from a geographic location different from a geographic location for accessing the set of data sources specified in the baseline profile.
15. A method comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile indicating whether the user has previously modified a certificate authority for the set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
determining, based on monitoring the activity of the set of users, that a user action of a specified user comprises modifying the certificate authority;
determining that the specified user has never modified the certificate authority previously; and
providing, in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously, a digital transmission representing the user action of the specified user.
16. The method of claim 15 , wherein the set of data sources is hosted at a computer system.
17. The method of claim 16 , wherein the set of data sources comprises one or more of: a packet log of packets travelling between the computer system and an external network, a driver log of the computer system, a secure socket layer (SSL) certificate authority (CA) of the computer system, a programmable logic controller (PLC) of the computer system, a simple mail transfer protocol (SMTP) log of the computer system, a web access log of the computer system, service repos of the computer system, network drives of the computer system, workstation performance logs of the computer system, and workstation network traffic of the computer system.
18. The method of claim 16 , wherein the set of users having access to the set of data sources comprise system administrators of the computer system.
19. The method of claim 16 , further comprising:
blocking access, by the specified user, to the computer system in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously.
20. The method of claim 15 , further comprising:
detecting that the user action includes accessing the set of data sources at a time of day different from a time of day for accessing the set of data sources specified in the baseline profile.