# US 12,120,146 B1 · Systems and methods for applying attack tree models and physics-based models for detecting cyber-physical threats > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,146 B1 - Document ID: US12120146B1 - Status: Granted - Kind: B1 - Application number: 17/816,884 - Filed: 2022-08-02 - Granted: 2024-10-15 - Earliest claimed: 2019-10-23 - Assignees: Architecture Technology Corporation - Applicants: Architecture Technology Corporation - Inventors: Martiros Shakhzadyan; Judson Powers; Matthew A. Stillerman - Web page: https://patentgrep.com/patent/US12120146B1 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and products may comprise an analytic server, which improves security of a unified system of distributed network infrastructure comprising a plurality of cyber-physical systems. The analytic server may instantiate a sub attack tree for each cyber-physical system within the unified system. The analytic server may determine how the interconnection of the plurality of cyber-physical systems may affect the unified system security. The analytic server may monitor systems and receive electronic notifications of alerts in real-time from devices in the plurality of cyber-physical systems. The analytic server may follow the logic of the attack tree model by traversing the attack tree from bottom up and determine how the alerts from the cyber-physical systems may affect the distributed network infrastructure as a whole. The analytic server may generate reports comprising a list of the prioritized attacks and recommendation actions to mitigate the attacks. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, at a computer, a plurality of notifications containing log data from a plurality of devices of a distributed network infrastructure; identifying, by the computer, one or more cyber threats based on one or more of the plurality of notifications being represented in an attack tree, wherein a file of the attack tree includes a first identifier of a first physical configuration and a second identifier of a second physical configuration of the plurality of devices, and wherein the file of the attack tree includes nodes corresponding to external test results of a status first device of the first physical configuration and external test results of a status of a second device of the second physical configuration; verifying, by the computer, the one or more cyber threats using a physics-based model of the distributed network infrastructure, by determining that one or more notifications from the first device of the plurality of notifications associated with the threat are consistent with other notifications from the second device of the plurality of notifications in accordance with the physics-based model, the other notifications including the status of the second device collected using external testing; and in response to verifying the one or more cyber threats using the physics-based model of the distributed network infrastructure, detecting, by the computer, one or more cyber attacks on the distributed network infrastructure to determine an impact on the distributed network infrastructure. ### Claim 2 (depends on 1) The computer-implemented method according to claim 1, wherein verifying the one or more threats using the physics-based model includes determining whether the one or more threats are physically feasible. ### Claim 3 (depends on 1) The computer-implemented method according to claim 1, wherein verifying the one or more threats using the physics-based model includes determining whether the one or more of the plurality of notifications on which the one or more threats are based satisfy an aberrance threshold such that they are represented in the attack tree. ### Claim 4 (depends on 1) The computer-implemented method according to claim 1, further comprising: calculating, by the computer, an impact score for each of the one or more attacks. ### Claim 5 (depends on 4) The computer-implemented method according to claim 4, further comprising: ranking and prioritizing, by the computer, the one or more attacks based on the corresponding impact scores. ### Claim 6 (depends on 1) The computer-implemented method according to claim 1, further comprising: generating, by the computer in real-time, a report in a dashboard comprising a prioritized list of the one or more attacks. ### Claim 7 (depends on 1) The computer-implemented method according to claim 1, further comprising: generating, by the computer, a report comprising recommendation actions for mitigating the one or more attacks. ### Claim 8 (depends on 1) The computer-implemented method according to claim 1, wherein the attack tree is in a hierarchical structure comprising a root node and one or more child nodes, the root node representing a higher-level operating condition of an attack, and each of the one or more child nodes representing a lower-level operating condition of the attack. ### Claim 9 (depends on 8) The computer-implemented method according to claim 8, wherein verifying the one or more threats using the physics-based model includes traversing the attack tree model from the one or more child nodes to respective parent nodes according to the physics-based model. ### Claim 10 A system comprising: a non-transitory storage medium storing a plurality of computer program instructions; and a processor electrically coupled to the non-transitory storage medium and configured to execute the plurality of computer program instructions to: receive a plurality of notifications containing log data from a plurality of devices of a distributed network infrastructure; identify one or more cyber threats based on the notifications being represented in an attack tree, wherein a file of the attack tree includes a first identifier of a first physical configuration and a second identifier of a second physical configuration of the plurality of devices, and wherein the file of the attack tree includes nodes corresponding to external test results of a status of a first device of the first physical configuration and external test results of a status of a second device of the second physical configuration; verify the one or more cyber threats using a physics-based model of the distributed network infrastructure by determining that one or more notifications from the first device of the plurality of notifications associated with the threat are consistent with other notifications from the second device of the plurality of notifications in accordance with the physics-based model, the other notifications including the status of the second device collected using external testing; and in response to verifying the one or more cyber threats using the physics-based model of the distributed network infrastructure, detect one or more cyber attacks on the distributed network infrastructure to determine an impact on the distributed network infrastructure. ### Claim 11 (depends on 10) The system according to claim 10, wherein verifying the one or more threats using the physics-based model includes determining whether the one or more threats are physically feasible. ### Claim 12 (depends on 10) The system according to claim 10, wherein verifying the one or more threats using the physics-based model includes determining whether the one or more of the plurality of notifications on which the one or more threats are based satisfy an aberrance threshold such that they are represented in the attack tree. ### Claim 13 (depends on 10) The system according to claim 10, wherein the processor is further configured to execute the instructions to: calculate, by the computer, an impact score for each of the one or more attacks. ### Claim 14 (depends on 10) The system according to claim 10, wherein the processor is further configured to execute the instructions to: rank and prioritize, by the computer, the one or more attacks based on the corresponding impact scores. ### Claim 15 (depends on 10) The system according to claim 10, wherein the processor is further configured to execute the instructions to: generate, by the computer in real-time, a report in a dashboard comprising a prioritized list of the one or more attacks. ### Claim 16 (depends on 10) The system according to claim 10, wherein the processor is further configured to execute the instructions to: generate, by the computer, a report comprising recommendation actions for mitigating the one or more attacks. ### Claim 17 (depends on 10) The system according to claim 10, wherein the attack tree is in a hierarchical structure comprising a root node and one or more child nodes, the root node representing a higher-level operating condition of an attack, and each of the one or more child nodes representing a lower-level operating condition of the attack. ### Claim 18 (depends on 10) The system according to claim 10, wherein verifying the one or more threats using the physics-based model includes traversing the attack tree model from the one or more child nodes to respective parent nodes according to the physics-based model.