Collaborative infrastructure supporting cyber-security analytics in industrial networks

A system comprising:

• a listener module configured to identify an operational anomaly in a network system by accessing an anomaly flag that indicates a potential cyber-security threat based on detection of the operational anomaly by a cyber-security analytics engine, the network system comprising a plurality of assets, the operational anomaly involving an operation pattern that is inconsistent with a normal operation pattern observed in the network system;
• a query module configured to access, from an asset analytics engine, domain data of an asset from among the plurality of assets, the asset domain data including state information about the asset and a specific configuration of asset parameters related to the state information;
• an analysis module, including a processor of a machine, configured to identify a state change in the asset based on a reconfiguration event involving the asset included in the asset domain data, the analysis module further configured to determine that the operational anomaly is correlated with the state change, the analysis module further configured to determine that the operational anomaly is a false positive with respect to the potential cyber-security threat based on the operational anomaly being correlated with the state change;
• and
• a clearing module configured to cause the anomaly flag to be cleared in response to determining that the anomaly is a false positive based on determining the operational anomaly is correlated with the state change of the asset,
• the clearing module further configured to store a record comprising the operational anomaly, the state change, and an indication of the operational anomaly being a false positive.

A non-transitory machine-readable storage medium embodying instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:

• identifying an operational anomaly in a network system by accessing an anomaly flag that signals a potential cyber-security threat based on detection of the operational anomaly by a cyber-security analytics engine, the network system comprising a plurality of assets, the operational anomaly involving an operation pattern that is inconsistent with a normal operation pattern observed in the network system;
• identifying an asset from the plurality of assets involved in the operational anomaly;
• accessing asset domain data including state information related to the asset, the state information including a specific configuration of asset parameters;
• identifying, using the asset domain data, a state change in the asset resulting from a reconfiguration event involving the asset;
• determining that the state change of the asset resulting from the reconfiguration event and the operational anomaly are time-correlated based on the asset domain data;
• determining that the operational anomaly is a false positive with respect to the potential cyber-security threat based on determining that the operational anomaly is correlated with the state change resulting from the reconfiguration event;
• causing the anomaly flag to be cleared in response to determining that the anomaly is a false positive based on determining the operational anomaly is correlated with the state change of the asset;
• and
• storing a record comprising the operational anomaly, the state change, and an indication of the operational anomaly being a false positive.