Systems and methods for applying attack tree models and physics-based models for detecting cyber-physical threats

A system comprising:

• a non-transitory storage medium storing a plurality of computer program instructions;
• and
• a processor electrically coupled to the non-transitory storage medium and configured to execute the plurality of computer program instructions to:
• receive a plurality of notifications containing log data from a plurality of devices of a distributed network infrastructure;
• identify one or more cyber threats based on the notifications being represented in an attack tree, wherein a file of the attack tree includes a first identifier of a first physical configuration and a second identifier of a second physical configuration of the plurality of devices, and wherein the file of the attack tree includes nodes corresponding to external test results of a status of a first device of the first physical configuration and external test results of a status of a second device of the second physical configuration;
• verify the one or more cyber threats using a physics-based model of the distributed network infrastructure by determining that one or more notifications from the first device of the plurality of notifications associated with the threat are consistent with other notifications from the second device of the plurality of notifications in accordance with the physics-based model, the other notifications including the status of the second device collected using external testing;
• and
• in response to verifying the one or more cyber threats using the physics-based model of the distributed network infrastructure, detect one or more cyber attacks on the distributed network infrastructure to determine an impact on the distributed network infrastructure.