# US 10,320,828 B1 · Evaluation of security in a cyber simulator

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,828 B1
- Document ID: US10320828B1
- Status: Granted
- Kind: B1
- Application number: 14/870,053
- Filed: 2015-09-30
- Granted: 2019-06-11
- Earliest claimed: 2015-09-30
- Assignees: EMC IP Holding Company LLC
- Applicants: EMC Corporation
- Inventors: Philip Derbeko; Alon Grubshtein; Anton Pavlinov
- Web page: https://patentgrep.com/patent/US10320828B1

## CPC

- H04L 63/1433: {Vulnerability analysis}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A System, Computer Program Product, and Computer-executable method for testing a production system, the System, Computer Program Product, and Computer-executable method including receiving information related to the production system, receiving production data from the production system, creating a virtual production system based off the production system using the received information and the received production data, and analyzing the production system by performing tests on the virtual production system.

## Claims

### Claim 1

A computer-executable method for testing a production system, the computer-executable method comprising:
receiving information related to the production system;
receiving production data from the production system, wherein the production data comprises a plurality of data files indicative of one or more operating states of the production system;
creating a virtual production system, wherein the virtual production system is a replica of the production system using the received information and the received production data, wherein the virtual production system is enabled to be a computing environment with one or more data storage systems and one or more network devices;
analyzing the production system by performing tests on the virtual production system; and
providing a simulation to facilitate training on management of the production system using the virtual production system;
wherein analyzing comprises providing a security score and a business continuity score based on the tests;
wherein the production data comprises production data associated with a particular timeframe of usage of the production system; and
wherein the one or more operating states of the production system comprise at least a current operating state of the production system.

### Claim 2 (depends on 1)

The computer-executable method of claim 1, wherein performing tests comprises:
creating at least one scenario; and
executing the at least one scenario utilizing the virtual production system.

### Claim 3 (depends on 2)

The computer-executable method of claim 2, wherein the at least one scenario includes releasing at least one threat into the virtual production system.

### Claim 4 (depends on 3)

The computer-executable method of claim 3, wherein the at least one threat is malware.

### Claim 5 (depends on 3)

The computer-executable method of claim 3, wherein the at least one threat is a cyber-attack.

### Claim 6

A system, comprising:
a production system; and
computer-executable program logic encoded in memory of one or more computers enabled to test the production system, wherein the computer-executable program logic is configured for the execution of:
receiving information related to the production system;
receiving production data from the production system, wherein the production data comprises a plurality of data files indicative of one or more operating states of the production system;
creating a virtual production system, wherein the virtual production system is a replica of the production system using the received information and the received production data, wherein the virtual production system is enabled to be a computing environment with one or more data storage systems and one or more network devices;
analyzing the production system by performing tests on the virtual production system; and
providing a simulation to facilitate training on management of the production system using the virtual production system;
wherein analyzing comprises providing a security score and a business continuity score based on the tests;
wherein the production data comprises production data associated with a particular timeframe of usage of the production system; and
wherein the one or more operating states of the production system comprise at least a current operating state of the production system.

### Claim 7 (depends on 6)

The system of claim 6, wherein performing tests comprises:
creating at least one scenario; and
executing the at least one scenario utilizing the virtual production system.

### Claim 8 (depends on 7)

The system of claim 7, wherein the at least one scenario includes releasing at least one threat into the virtual production system.

### Claim 9 (depends on 8)

The system of claim 8, wherein the at least one threat is malware.

### Claim 10 (depends on 8)

The system of claim 8, wherein the at least one threat is a cyber-attack.

### Claim 11

A computer program product for testing a production system,
the computer program product comprising:
a non-transitory computer readable medium encoded with computer-executable code, the code configured to enable the execution of:
receiving information related to the production system;
receiving production data from the production system, wherein the production data comprises a plurality of data files indicative of one or more operating states of the production system;
creating a virtual production system, wherein the virtual production system is a replica of the production system using the received information and the received production data, wherein the virtual production system is enabled to be a computing environment with one or more data storage systems and one or more network devices;
analyzing the production system by performing tests on the virtual production system; and
providing a simulation to facilitate training on management of the production system using the virtual production system;
wherein analyzing comprises providing a security score and a business continuity score based on the tests;
wherein the production data comprises production data associated with a particular timeframe of usage of the production system; and
wherein the one or more operating states of the production system comprise at least a current operating state of the production system.

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein performing tests comprises:
creating at least one scenario; and
executing the at least one scenario utilizing the virtual production system.

### Claim 13 (depends on 12)

The computer program product of claim 12, wherein the at least one scenario includes releasing at least one threat into the virtual production system.

### Claim 14 (depends on 13)

The computer program product of claim 13, wherein the at least one threat is malware.

### Claim 15 (depends on 13)

The computer program product of claim 13, wherein the at least one threat is a cyber-attack.