Systems and methods for cyber-physical threat modeling

A system comprising:

• a non-transitory storage medium storing a plurality of computer program instructions;
• and
• a processor electrically coupled to the non-transitory storage medium and configured to execute the plurality of computer program instructions to:
• instantiate a first sub attack tree generated at a first cyber-physical system within a distributed network infrastructure, the first sub attack tree being based upon a first physical configuration of the first cyber-physical system;
• instantiate a second sub attack tree generated at a second cyber-physical system within the distributed network infrastructure, the second sub attack tree being based upon a second physical configuration of the second cyber-physical system wherein the second physical configuration is distinct from the first physical configuration;
• generate a machine-readable markup file of an attack tree of the distributed network infrastructure, the attack tree containing the first sub attack tree and the second sub attack tree, and the machine-readable markup file containing a first identifier of the first sub attack tree and a second identifier of the second sub attack tree;
• receive electronic notifications of alerts from a plurality of devices in the first and second cyber-physical systems;
• and
• detect one or more attacks on the distributed network infrastructure based upon the alerts by executing a logic of the attack tree, wherein executing the logic of the attack tree comprises traversing the first sub attack tree based on the first identifier, the second sub attack tree based on the second identifier, and a parent node hierarchically above the first and second sub attack trees to determine an impact on the distributed network infrastructure based upon the alerts.