Supervisory control and data acquisition
Aspects of the present disclosure relate to computer system security. A machine accesses a set of records corresponding to a set of users having access to a computer system. The machine stores, for each user in the set of users, a baseline profile representing baseline activity of the user with respect to a set of data sources of the computer system. The machine monitors activity of the set of users with respect to the set of data sources. The machine determines, based on monitoring the activity of the set of users, that a user action of a specified user, with respect to one or more data sources from the set of data sources, is anomalous relative to the baseline profile of the specified user. The machine provides a digital transmission representing the anomalous user action.
1. A control server comprising:
one or more processors; and
a memory storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile representing baseline activity of the user with respect to a set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
transmitting, to a client device for display thereat, a representation of a table, wherein each row in the table represents a user activity, and wherein columns in the table represent at least a time, an action type, a user identifier, and whether the user activity is consistent with the baseline profile;
receiving, from the client device, a representation of a selection of a row from the table; and
transmitting, to the client device for display thereat and in response to the selection of the row, a detailed view of the user activity represented in the selected row, wherein:
(i) the detailed view includes more details about the action type than the table,
(ii) the action type of the selected row is a data transmission,
(iii) the table indicates that the action type is a data transmission,
(iv) the detailed view indicates an amount of data transmitted, a source Internet Protocol (IP) address of the data transmission, and a destination IP address of the data transmission, and
(v) the table does not indicate the amount of data transmitted, the source IP address, and the destination IP address.
2. The control server of claim 1 , wherein the table indicates that the user activity of the selected row is inconsistent with the baseline profile, and wherein the detailed view indicates a reason why the user activity is inconsistent with the baseline profile.
3. The system of claim 1 , the operations further comprising:
determining, based on monitoring the activity of the set of users, that a specified user action of a specified user comprises modifying the certificate authority;
determining that the specified user has never modified the certificate authority previously; and
providing, in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously, a digital transmission representing the user action of the specified user.
4. The control server of claim 1 , wherein the set of data sources is hosted at a computer system.
5. The control server of claim 4 , wherein the set of data sources comprises one or more of: a packet log of packets travelling between the computer system and an external network, a driver log of the computer system, a secure socket layer (SSL) certificate authority (CA) of the computer system, a programmable logic controller (PLC) of the computer system, a simple mail transfer protocol (SMTP) log of the computer system, a web access log of the computer system, service repos of the computer system, network drives of the computer system, workstation performance logs of the computer system, and workstation network traffic of the computer system.
6. The control server of claim 4 , wherein the set of users having access to the set of data sources comprise system administrators of the computer system.
7. A non-transitory machine-readable medium storing instructions which, when executed by one or more machines, cause the one or more machines to perform operations comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile representing baseline activity of the user with respect to a set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
transmitting, to a client device for display thereat, a representation of a table, wherein each row in the table represents a user activity, and wherein columns in the table represent at least a time, an action type, a user identifier, and whether the user activity is consistent with the baseline profile;
receiving, from the client device, a representation of a selection of a row from the table; and
transmitting, to the client device for display thereat and in response to the selection of the row, a detailed view of the user activity represented in the selected row, wherein:
(i) the detailed view includes more details about the action type than the table,
(ii) the action type of the selected row is a data transmission,
(iii) the table indicates that the action type is a data transmission,
(iv) the detailed view indicates an amount of data transmitted, a source Internet Protocol (IP) address of the data transmission, and a destination IP address of the data transmission, and
(v) the table does not indicate the amount of data transmitted, the source IP address, and the destination IP address.
8. The machine-readable medium of claim 7 , wherein the table indicates that the user activity of the selected row is inconsistent with the baseline profile, and wherein the detailed view indicates a reason why the user activity is inconsistent with the baseline profile.
9. The machine-readable medium of claim 7 , the operations further comprising:
determining, based on monitoring the activity of the set of users, that a specified user action of a specified user comprises modifying the certificate authority;
determining that the specified user has never modified the certificate authority previously; and
providing, in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously, a digital transmission representing the user action of the specified user.
10. The machine-readable medium of claim 7 , wherein the set of data sources is hosted at a computer system.
11. The machine-readable medium of claim 10 , wherein the set of data sources comprises one or more of: a packet log of packets travelling between the computer system and an external network, a driver log of the computer system, a secure socket layer (SSL) certificate authority (CA) of the computer system, a programmable logic controller (PLC) of the computer system, a simple mail transfer protocol (SMTP) log of the computer system, a web access log of the computer system, service repos of the computer system, network drives of the computer system, workstation performance logs of the computer system, and workstation network traffic of the computer system.
12. The machine-readable medium of claim 10 , wherein the set of users having access to the set of data sources comprise system administrators of the computer system.
13. A method comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile representing baseline activity of the user with respect to a set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
transmitting, to a client device for display thereat, a representation of a table, wherein each row in the table represents a user activity, and wherein columns in the table represent at least a time, an action type, a user identifier, and whether the user activity is consistent with the baseline profile;
receiving, from the client device, a representation of a selection of a row from the table; and
transmitting, to the client device for display thereat and in response to the selection of the row, a detailed view of the user activity represented in the selected row, wherein:
(i) the detailed view includes more details about the action type than the table,
(ii) the action type of the selected row is a data transmission,
(iii) the table indicates that the action type is a data transmission,
(iv) the detailed view indicates an amount of data transmitted, a source Internet Protocol (IP) address of the data transmission, and a destination IP address of the data transmission, and
(v) the table does not indicate the amount of data transmitted, the source IP address, and the destination IP address.
14. The method of claim 13 , wherein the table indicates that the user activity of the selected row is inconsistent with the baseline profile, and wherein the detailed view indicates a reason why the user activity is inconsistent with the baseline profile.
15. The method of claim 13 , further comprising:
determining, based on monitoring the activity of the set of users, that a specified user action of a specified user comprises modifying the certificate authority;
determining that the specified user has never modified the certificate authority previously; and
providing, in response to determining that the user action comprises modifying the certificate authority and in response to determining that the specified user has never modified the certificate authority previously, a digital transmission representing the user action of the specified user.
16. The method of claim 13 , wherein the set of data sources is hosted at a computer system.
17. The method of claim 16 , wherein the set of data sources comprises one or more of: a packet log of packets travelling between the computer system and an external network, a driver log of the computer system, a secure socket layer (SSL) certificate authority (CA) of the computer system, a programmable logic controller (PLC) of the computer system, a simple mail transfer protocol (SMTP) log of the computer system, a web access log of the computer system, service repos of the computer system, network drives of the computer system, workstation performance logs of the computer system, and workstation network traffic of the computer system.