US 10,567,404 B2Granted

Supervisory control and data acquisition

AssigneePalantir Technologies Inc.

InventorsNomi Becker, Isaac Smitley

Life of this patent

Estimating the term…

Loading patent…

Abstract

Aspects of the present disclosure relate to computer system security. A machine accesses a set of records corresponding to a set of users having access to a computer system. The machine stores, for each user in the set of users, a baseline profile representing baseline activity of the user with respect to a set of data sources of the computer system. The machine monitors activity of the set of users with respect to the set of data sources. The machine determines, based on monitoring the activity of the set of users, that a user action of a specified user, with respect to one or more data sources from the set of data sources, is anomalous relative to the baseline profile of the specified user. The machine provides a digital transmission representing the anomalous user action.

Claims17

Dependent claims

A control server comprising:

one or more processors;
and
a memory storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
storing, for each user in a set of users having access to a set of data sources, a baseline profile representing baseline activity of the user with respect to a set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
transmitting, to a client device for display thereat, a representation of a table, wherein each row in the table represents a user activity, and wherein columns in the table represent at least a time, an action type, a user identifier, and whether the user activity is consistent with the baseline profile;
receiving, from the client device, a representation of a selection of a row from the table;
and
transmitting, to the client device for display thereat and in response to the selection of the row, a detailed view of the user activity represented in the selected row, wherein:
(i) the detailed view includes more details about the action type than the table,
(ii) the action type of the selected row is a data transmission,
(iii) the table indicates that the action type is a data transmission,
(iv) the detailed view indicates an amount of data transmitted, a source Internet Protocol (IP) address of the data transmission, and a destination IP address of the data transmission, and
(v) the table does not indicate the amount of data transmitted, the source IP address, and the destination IP address.

11 more elements

A non-transitory machine-readable medium storing instructions which, when executed by one or more machines, cause the one or more machines to perform operations comprising:

storing, for each user in a set of users having access to a set of data sources, a baseline profile representing baseline activity of the user with respect to a set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
transmitting, to a client device for display thereat, a representation of a table, wherein each row in the table represents a user activity, and wherein columns in the table represent at least a time, an action type, a user identifier, and whether the user activity is consistent with the baseline profile;
receiving, from the client device, a representation of a selection of a row from the table;
and
transmitting, to the client device for display thereat and in response to the selection of the row, a detailed view of the user activity represented in the selected row, wherein:
(i) the detailed view includes more details about the action type than the table,
(ii) the action type of the selected row is a data transmission,
(iii) the table indicates that the action type is a data transmission,
(iv) the detailed view indicates an amount of data transmitted, a source Internet Protocol (IP) address of the data transmission, and a destination IP address of the data transmission, and
(v) the table does not indicate the amount of data transmitted, the source IP address, and the destination IP address.

8 more elements

A method comprising:

storing, for each user in a set of users having access to a set of data sources, a baseline profile representing baseline activity of the user with respect to a set of data sources;
monitoring activity of the set of users with respect to the set of data sources;
transmitting, to a client device for display thereat, a representation of a table, wherein each row in the table represents a user activity, and wherein columns in the table represent at least a time, an action type, a user identifier, and whether the user activity is consistent with the baseline profile;
receiving, from the client device, a representation of a selection of a row from the table;
and
transmitting, to the client device for display thereat and in response to the selection of the row, a detailed view of the user activity represented in the selected row, wherein:
(i) the detailed view includes more details about the action type than the table,
(ii) the action type of the selected row is a data transmission,
(iii) the table indicates that the action type is a data transmission,
(iv) the detailed view indicates an amount of data transmitted, a source Internet Protocol (IP) address of the data transmission, and a destination IP address of the data transmission, and
(v) the table does not indicate the amount of data transmitted, the source IP address, and the destination IP address.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/359,021Filed 20 Mar 2019 · continuation
Priority: 21 Jun 2016
Published: US 2019/0230102 A125 Jul 2019
Granted: 18 Feb 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L
Digital communication

Family

Application62/352,933Us provisional application · filed 21 Jun 2016
Application15/434,930Parent of this continuation · filed 16 Feb 2017
Application16/042,702Parent of this continuation · filed 23 Jul 2018
US 2019/0230102 A1Pre-grant publication · published 25 Jul 2019
US 10,298,603 B2Parent of this continuation
US 10,084,802 B1Parent of this continuation
US 2018/0351973 A1Published application
US 10,567,404 B2This patent

From the US filing history. Foreign family members aren’t listed.