# US 12,306,959 B2 · Threat model chaining and attack simulation systems and related methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,306,959 B2 - Document ID: US12306959B2 - Status: Granted - Kind: B2 - Application number: 18/497,355 - Filed: 2023-10-30 - Published: 2024-10-03 - Granted: 2025-05-20 - Earliest claimed: 2017-05-17 - Assignees: ThreatModeler Software Inc. - Applicants: ThreatModeler Software Inc. - Inventors: Anuraag Agarwwal; Pratik Anil Thakker - Web page: https://patentgrep.com/patent/US12306959B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/563: {by source code analysis} - G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30) - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2119/02: Reliability analysis or reliability optimisation; Failure analysis, e.g. worst case scenario performance, failure mode and effects analysis [FMEA] - G06F 2221/034: Test or assess a computer or a system - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods for determining one or more security threats associated with code in a code file are described. The method includes analyzing the code file to identify one or more properties, of a plurality of properties associated with one or more resources included in the code file. For each property of the identified one or more properties, the method further includes identifying a value for the property defined in the code file, and determining whether a security threat is associated with the property based on the identified value for the property and information regarding security threats associated with one or more values of the plurality of properties. ## Claims ### Claim 1 A threat model chaining method, comprising: providing one or more databases, the one or more databases storing: a plurality of threat model components, each threat model component defining one or more elements of systems, applications, or processes; and a plurality of threat models, each threat model associated with at least one threat model component of the plurality of threat model components; providing one or more interfaces, including a diagram interface, configured to be displayed on one or more end user computing devices communicatively coupled with the one or more databases; configuring the diagram interface to display a relational diagram of one of a system, an application, or a process, using visual representations of at least one first threat model component, the relational diagram defining a first threat model based on the at least one first threat model component; and configuring the diagram interface to, in response to receiving one or more first user inputs, add at least one second threat model component to the displayed relational diagram and thereby update the first threat model by adding at least one second threat model associated with the at least one second threat model component to the first threat model, wherein the at least one second threat model component is not a part of the first threat model before being added, wherein the at least one second threat model component comprises a predefined interrelated group of two or more elements of the system, the application, or the process, and wherein the at least one second threat model component changes a composition of the system, the application, or the process. ### Claim 2 (depends on 1) The threat model chaining method of claim 1, further comprising configuring the diagram interface to, in response to receiving a user selection of one threat model component of the at least one first threat model component or the at least one second threat model component, visually display attack paths of all threats associated with the selected threat model component. ### Claim 3 (depends on 2) The threat model chaining method of claim 2, wherein the one or more databases further store a plurality of compensating controls, each compensating control designed to mitigate at least one threat identified in at least one threat model of the plurality of threat models, the method further comprising configuring the diagram interface to, in response to receiving a user toggle of a first compensating control of the selected threat model component to an on state, toggle all attack paths, of the displayed attack paths, mitigatable by the first compensating control to a mitigated display state. ### Claim 4 (depends on 3) The threat model chaining method of claim 3, further comprising configuring the diagram interface to, in response to receiving a user toggle of the first compensating control to an off state, toggle all the attack paths mitigatable by the first compensating control to an unmitigated display state. ### Claim 5 (depends on 3) The threat model chaining method of claim 3, further comprising configuring the diagram interface to, in response to receiving a second user selection to remove the first compensating control from the updated first threat model, toggle all the attack paths mitigatable by the first compensating control to an unmitigated display state. ### Claim 6 (depends on 2) The threat model chaining method of claim 2, wherein the selected threat model component includes a plurality of elements, the method further comprising configuring the diagram interface to, in response to receiving a second user selection corresponding to one or more elements of the plurality of elements, visually display only attack paths of all threats associated with the selected one or more elements. ### Claim 7 (depends on 2) The threat model chaining method of claim 2, further comprising configuring the diagram interface to, in response to receiving a second user selection to alter a profile of an attacking component, alter the visually displayed attack paths. ### Claim 8 (depends on 1) The threat model chaining method of claim 1, further comprising, in response to receiving one or more second user inputs, storing one or more additional threat model components in the one or more databases, and storing one or more additional threat models associated with the one or more additional threat model components in the one or more databases. ### Claim 9 (depends on 1) The threat model chaining method of claim 1, wherein at least one element of the two or more elements of the at least one second threat model component is another threat model component of the plurality of threat model components, and wherein the at least one second threat model associated with the at least one second threat model component includes another threat model associated with the another threat model component, thereby defining nested threat models. ### Claim 10 A threat model chaining system, comprising: one or more memory devices configured to store one or more databases, the one or more databases storing: a plurality of threat model components, each threat model component defining one or more elements of systems, applications, or processes; and a plurality of threat models, each threat model associated with at least one threat model component of the plurality of threat model components; and one or more computing devices communicatively coupled with the one or more memory devices storing the one or more databases, the one or more computing devices configured to: display, on one or more displays of the one or more computing devices one or more input interfaces including a diagram interface, wherein the diagram interface is configured to display a relational diagram of one of a system, an application, or a process, using visual representations of at least one first threat model component, the relational diagram defining a first threat model based on the at least one first threat model component; and in response to receiving one or more first user inputs, add at least one second threat model component to the displayed relational diagram and thereby update the first threat model by adding at least one second threat model associated with the at least one second threat model component to the first threat model, wherein the at least one second threat model component is not a part of the first threat model before being added, wherein the at least one second threat model component comprises a predefined interrelated group of two or more elements of the system, the application, or the process, and wherein the at least one second threat model component changes a composition of the system, the application, or the process. ### Claim 11 (depends on 10) The threat model chaining system of claim 10, wherein the diagram interface is further configured to, in response to receiving a user selection of one threat model component of the at least one first threat model component or the at least one second threat model component, visually display attack paths of all threats associated with the selected threat model component. ### Claim 12 (depends on 10) The threat model chaining system of claim 10, wherein the one or more computing devices are further configured to, in response to receiving one or more second user inputs, storing one or more additional threat model components in the one or more databases, and storing one or more additional threat models associated with the one or more additional threat model components in the one or more databases. ### Claim 13 (depends on 11) The threat model chaining system of claim 11, wherein the one or more databases further store a plurality of compensating controls, each compensating control designed to mitigate at least one threat identified in at least one threat model of the plurality of threat models, and wherein the diagram interface is further configured to, in response to receiving a user toggle of a first compensating control of the selected threat model component to an on state, toggle all attack paths, of the displayed attack paths, mitigatable by the first compensating control to a mitigated display state. ### Claim 14 (depends on 13) The threat model chaining system of claim 13, wherein the diagram interface is further configured to, in response to receiving a user toggle of the first compensating control to an off state, toggle all the attack paths mitigatable by the first compensating control to an unmitigated display state. ### Claim 15 (depends on 13) The threat model chaining system of claim 13, wherein the diagram interface is further configured to, in response to receiving a second user selection to remove the first compensating control from the updated first threat model, toggle all the attack paths mitigatable by the first compensating control to an unmitigated display state. ### Claim 16 (depends on 11) The threat model chaining system of claim 11, wherein the selected threat model component includes a plurality of elements, and wherein the diagram interface is further configured to, in response to receiving a second user selection corresponding to one or more elements of the plurality of elements, visually display only attack paths of all threats associated with the selected one or more elements. ### Claim 17 (depends on 11) The threat model chaining system of claim 11, wherein the diagram interface is further configured to, in response to receiving a second user selection to alter a profile of an attacking component, alter the visually displayed attack paths. ### Claim 18 (depends on 10) The threat model chaining system of claim 10, wherein at least one element of the two or more elements of the at least one second threat model component is another threat model component of the plurality of threat model components, and wherein the at least one second threat model associated with the at least one second threat model component includes another threat model associated with the another threat model component, thereby defining nested threat models.