# US 10,320,827 B2 · Automated cyber physical threat campaign analysis and attribution

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,827 B2
- Document ID: US10320827B2
- Status: Granted
- Kind: B2
- Application number: 15/791,058
- Filed: 2017-10-23
- Published: 2018-06-07
- Granted: 2019-06-11
- Earliest claimed: 2015-10-28
- Assignees: Fractal Industries, Inc.
- Applicants: Fractal Industries, Inc.
- Inventors: Jason Crabtree; Andrew Sellers; Ian MacLeod
- Web page: https://patentgrep.com/patent/US10320827B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system for automated cyber physical threat campaign analysis and attribution, comprising a multi-dimensional time series and graph hybrid data server, an automated planning service module, and a directed computation graph module. A dataset is gathered from a monitored network and aggregated into a cyber-physical systems graph. Cyberattack simulations on the monitored network are made using exogenously collected data as input. Metrics are generated based on the cyber-physical systems graph and results from the cyberattack simulations, and the generated metrics are used to develop a threat profile.

## Claims

### Claim 1

A system for automated cyber physical threat campaign analysis and attribution, comprising:
a multi-dimensional time series and graph hybrid data server comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
create a dataset based at least in part by data gathered from a monitored network and exogenous data collected from published threat intelligence feeds and extracted from public-facing websites; and
aggregate the dataset into a cyber-physical systems graph;
an automated planning service module comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
receive the dataset from the multi-dimensional time series data server; and
conduct a plurality of cyberattack simulations on the monitored network with the dataset as input data, wherein the plurality of cyberattack simulations comprises cyberattacks from substantially all points of the monitored network; and
a directed computation graph module comprising a memory, a processor, and a plurality of programming instructions stored in the memory thereof and operable on the processor thereof, wherein the programmable instructions, when operating on the processor, cause the processor to:
receive the cyber-physical systems graph from the multi-dimensional time series and graph hybrid data server;
generate a plurality of metrics based at least in part by the cyber-physical systems graph;
continuously monitor the plurality of metrics for changes, anomalies, or specific critical thresholds; and
analyze results from the cyberattack simulations and the generated metrics to develop a threat profile and to identify at least one threat actor or one threat campaign; and
send an alert to an external system or organization based on the analysis.

### Claim 2 (depends on 1)

The system of claim 1, wherein a threat actor is identified using the threat profile.

### Claim 3 (depends on 1)

The system of claim 1, wherein a threat campaign is identified using the threat profile.

### Claim 4 (depends on 1)

The system of claim 1, wherein a current attack phase is determined using the threat profile.

### Claim 5 (depends on 1)

The system of claim 1, wherein the threat profile is further developed through additional analysis iterations.

### Claim 6 (depends on 1)

The system of claim 1, wherein at least a portion of the dataset is based on network telemetry.

### Claim 7 (depends on 1)

The system of claim 1, wherein at least a portion of the dataset is based on endpoint data.

### Claim 8 (depends on 1)

The system of claim 1, wherein at least a portion of the data is based on security system information.

### Claim 9 (depends on 1)

The system of claim 1, wherein at least a portion of the data is based application and performance data.

### Claim 10

A method for automated cyber physical threat campaign analysis and attribution, comprising the steps of:
(a) creating a dataset based at least in part by data gathered from a monitored network and exogenous sources, using a multi-dimensional time series and graph hybrid data server;
(b) aggregating the dataset into a cyber-physical systems graph, using the multi-dimensional time series data server;
(c) receiving the dataset from the multi-dimensional time series data server, using an automated planning service module;
(d) conducting a plurality of cyberattack simulations on the monitored network with the dataset as input data, using the automated planning service module, wherein the plurality of cyberattack simulations comprises cyberattacks from substantially all points of the monitored network;
(e) receiving the cyber-physical systems graph from the multi-dimensional time series data server, using a directed computation graph module;
(f) generating a plurality of metrics based at least in part by the cyber-physical systems graph; and
(g) analyzing results from the cyberattack simulations, and the generated metrics to develop a threat profile;
(h) continuously monitoring the plurality of metrics for changes, anomalies, or specific critical thresholds;
(i) identifying at least one threat actor or one threat campaign; and
(j) sending an alert to an external system or organization based on the analysis of step (g).

### Claim 11 (depends on 10)

The method of claim 10, wherein a threat actor is identified using the threat profile.

### Claim 12 (depends on 10)

The method of claim 10, wherein a threat campaign is identified using the threat profile.

### Claim 13 (depends on 10)

The method of claim 10, wherein a current attack phase is determined using the threat profile.

### Claim 14 (depends on 10)

The method of claim 10, wherein the threat profile is further developed through additional analysis iterations.

### Claim 15 (depends on 10)

The method of claim 10, wherein at least a portion of the dataset is based on network telemetry.

### Claim 16 (depends on 10)

The method of claim 10, wherein at least a portion of the dataset is based on endpoint data.

### Claim 17 (depends on 10)

The method of claim 10, wherein at least a portion of the data is based on security system information.

### Claim 18 (depends on 10)

The method of claim 10, wherein at least a portion of the data is based application and performance data.