Automated cyber physical threat campaign analysis and attribution

A system for automated cyber physical threat campaign analysis and attribution, comprising:

• a multi-dimensional time series and graph hybrid data server comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
• create a dataset based at least in part by data gathered from a monitored network and exogenous data collected from published threat intelligence feeds and extracted from public-facing websites;
• and
• aggregate the dataset into a cyber-physical systems graph;
• an automated planning service module comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
• receive the dataset from the multi-dimensional time series data server;
• and
• conduct a plurality of cyberattack simulations on the monitored network with the dataset as input data, wherein the plurality of cyberattack simulations comprises cyberattacks from substantially all points of the monitored network;
• and
• a directed computation graph module comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
• receive the cyber-physical systems graph from the multi-dimensional time series and graph hybrid data server;
• generate a plurality of metrics based at least in part by the cyber-physical systems graph;
• continuously monitor the plurality of metrics for changes, anomalies, or specific critical thresholds;
• and
• analyze results from the cyberattack simulations and the generated metrics to develop a threat profile and to identify at least one threat actor or one threat campaign;
• and
• send an alert to an external system or organization based on the analysis.