Checkout system executable code monitoring, and user account compromise determination system
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for a checkout system executable code monitoring, and user account compromise determination system. The system monitors executable code initiating and executing on checkout systems, including determining hashes of the executable code. The system determines whether the executable code is malicious based on the hash, and associated information of the executable code. Additionally, the system monitors user access to checkout systems, and determines user accounts associated with being compromised. User interfaces are generated describing checkout systems associated with a risk of being compromised, and are configured for user interaction, which cause generation of updated user interfaces and access to electronic data stores to determine information relevant to the user interaction.
1. A computerized method comprising:
by a system of one or more computer systems,
aggregating indications of processes executing in memory of disparate computing systems, the computing systems being configured to access sensitive information, wherein the sensitive information represents transactions associated with payment instruments;
determining that one or more processes are not authorized to access the sensitive information, wherein a first process of the determined processes is determined to be monitoring payment instruments; and
causing presentation, via an interactive user interface, of information summarizing the determined processes and information summarizing computing systems executing the determined processes, wherein the interactive user interface enables generation of one or more alerts associated with payment instruments determined to be monitored by the first process, and wherein the interactive user interface:
presents summary information associated with processes executing on the computing systems that are not authorized to access the sensitive information, wherein the summary information comprises a graphical depiction of a measure associated with the processes,
presents summary information associated with checkout systems executing processes that are not authorized to access the sensitive information, wherein the summary information comprises a graphical depiction of a measure associated with the checkout systems, and
responds to user input associated with the alerts, wherein the interactive user interface triggers determination as to a risk level associated with the first process based on a hash associated with the first process, and wherein in response to user input the interactive user interface is configured to present detailed information associated with the first process.
2. The method of claim 1 , wherein the processes are associated with respective executable code on the computing systems.
3. The method of claim 1 , wherein aggregating indications of processes is based on information obtained from respective agents executing on the computing systems, the agents monitoring processes executing in memory.
4. The method of claim 1 , wherein determining that the first process is not authorized to access the sensitive information comprises:
comparing a name associated with the first process with one or more names of processes authorized to access the sensitive information; or
comparing a file location of executable code associated with the first process with one or more file locations of executable code associated with processes authorized to access the sensitive information; or
comparing a cryptographic hash of executable code associated with the first process with cryptographic hashes of executable code associated with processes authorized to access the sensitive information.
5. The method of claim 1 , wherein the method further comprises:
obtaining information identifying a set of payment instruments known to be compromised;
comparing the set of payment instruments to payment instruments associated with transactions; and
updating the interactive user interface to present indications of computing systems which accessed the payment instruments.
6. The method of claim 5 , wherein the interactive user interface is configured to present indications of particular processes executing on the computing systems indicated in the interactive user interface, the particular processes not being authorized to access the sensitive information.
7. The method of claim 1 , wherein the interactive user interface:
responds to selection of a particular process executing on one or more computing systems;
triggers determination as to a risk level associated with the particular process based on a hash associated with the particular process; and
in response to user input, presents information describing a heat map associated with affected checkout systems.
8. A computing system comprising one or more hardware processors and computer storage media storing instructions that when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
aggregating indications of processes executing in memory of disparate computing systems, the computing systems being configured to access sensitive information, wherein the sensitive information represents transactions associated with payment instruments;
determining that one or more processes are not authorized to access the sensitive information, wherein a first process of the determined processes is determined to be monitoring payment instruments; and
causing presentation, via an interactive user interface, of information summarizing the determined processes and information summarizing computing systems executing the determined processes, wherein the interactive user interface enables generation of one or more alerts associated with payment instruments determined to be monitored by the first process, and wherein the interactive user interface:
presents summary information associated with processes executing on the computing systems that are not authorized to access the sensitive information, wherein the summary information comprises a graphical depiction of a measure associated with the processes,
presents summary information associated with checkout systems executing processes that are not authorized to access the sensitive information, wherein the summary information comprises a graphical depiction of a measure associated with the checkout systems, and
responds to user input associated with the alerts, wherein the interactive user interface triggers determination as to a risk level associated with the first process based on a hash associated with the first process, and wherein in response to user input the interactive user interface is configured to present detailed information associated with the first process.
9. The computing system of claim 8 , wherein the processes are associated with respective executable code on the computing systems.
10. The computing system of claim 8 , wherein aggregating indications of processes is based on information obtained from respective agents executing on the computing systems, the agents monitoring processes executing in memory.
11. The computing system of claim 8 , wherein determining that the first process is not authorized to access the sensitive information comprises:
comparing a name associated with the first process with one or more names of processes authorized to access the sensitive information; or
comparing a file location of executable code associated with the first process with one or more file locations of executable code associated with processes authorized to access the sensitive information; or
comparing a cryptographic hash of executable code associated with the first process with cryptographic hashes of executable code associated with processes authorized to access the sensitive information.
12. The computing system of claim 8 , wherein the operations further comprise:
obtaining information identifying a set of payment instruments known to be compromised;
comparing the set of payment instruments to payment instruments associated with transactions; and
updating the interactive user interface to present indications of computing systems which accessed the payment instruments.
13. The computing system of claim 12 , wherein the interactive user interface is configured to present indications of particular processes executing on the computing systems indicated in the interactive user interface, the particular processes not being authorized to access the sensitive information.
14. The computing system of claim 8 , wherein the interactive user interface:
responds to selection of a particular process executing on one or more computing systems;
triggers determination as to a risk level associated with the particular process based on a hash associated with the particular process; and
in response to user input, presents information describing a heat map associated with affected checkout systems.
15. Non-transitory computer storage media storing instructions that when executed by a system of one or more processors, cause the system to perform operations comprising:
aggregating indications of processes executing in memory of disparate computing systems, the computing systems being configured to access sensitive information, wherein the sensitive information represents transactions associated with payment instruments;
determining that one or more processes are not authorized to access the sensitive information, wherein a first process of the determined processes is determined to be monitoring payment instruments; and
causing presentation, via an interactive user interface, of information summarizing the determined processes and information summarizing computing systems executing the determined processes, wherein the interactive user interface enables generation of one or more alerts associated with payment instruments determined to be monitored by the first process, and wherein the interactive user interface:
presents summary information associated with processes executing on the computing systems that are not authorized to access the sensitive information, wherein the summary information comprises a graphical depiction of a measure associated with the processes,
presents summary information associated with checkout systems executing processes that are not authorized to access the sensitive information, wherein the summary information comprises a graphical depiction of a measure associated with the checkout systems, and
responds to user input associated with the alerts, wherein the interactive user interface triggers determination as to a risk level associated with the first process based on a hash associated with the first process, and wherein in response to user input the interactive user interface is configured to present detailed information associated with the first process.
16. The computer storage media of claim 15 , wherein the processes are associated with respective executable code on the computing systems.
17. The computer storage media of claim 15 , wherein aggregating indications of processes is based on information obtained from respective agents executing on the computing systems, the agents monitoring processes executing in memory.
18. The computer storage media of claim 15 , wherein determining that first process is not authorized to access the sensitive information comprises:
comparing a name associated with the first process with one or more names of processes authorized to access the sensitive information; or
comparing a file location of executable code associated with the first process with one or more file locations of executable code associated with processes authorized to access the sensitive information; or
comparing a cryptographic hash of executable code associated with the first process with cryptographic hashes of executable code associated with processes authorized to access the sensitive information.
19. The computer storage media of claim 15 , wherein the operations further comprise:
obtaining information identifying a set of payment instruments known to be compromised;
comparing the set of payment instruments to payment instruments associated with transactions; and
updating the interactive user interface to present indications of computing systems which accessed the payment instruments.
20. The computer storage media of claim 19 , wherein the interactive user interface is configured to present indications of particular processes executing on the computing systems indicated in the interactive user interface, the particular processes not being authorized to access the sensitive information.