Determining a security patch for a cyberattack by executing simulations of different security protocols

A method for determining a security patch for a malicious network traffic, comprising:

• storing information associated with a first malicious network traffic;
• receiving, from a user device, sensor data that indicates physical or digital attributes of the user device, comprising at least one of a fan speed, an electricity consumption, or an electromagnetic field generated by the user device;
• comparing the sensor data with a baseline machine state, wherein the baseline machine state indicates baseline physical or digital attributes of the user device under a condition when no malicious network traffic is present;
• determining, based at least in part upon the comparison, the first malicious network traffic by detecting a deviation from the baseline machine state of the user device;
• communicating the first malicious network traffic to a first testing computing device;
• triggering execution of a first security protocol on the first testing computing device, wherein the first security protocol is configured to implement a first software instruction to address an effect of the first malicious network traffic on the first testing computing device;
• communicating the first malicious network traffic to a second testing computing device;
• triggering execution of a second security protocol on the second testing computing device, wherein the second security protocol is configured to implement a second software instruction to address the effect of the first malicious network traffic on the second testing computing device;
• determining that the first software instruction is configured to counter the effect of the first malicious network traffic by removing a security vulnerability in a piece of code associated with an operating system of the first testing computing device;
• determining that the second software instruction is associated with an anomaly;
• and
• in response to determining that the first software instruction is configured to counter the effect of the first malicious network traffic and that the second software instruction is associated with the anomaly:
• communicating the first security protocol to one or more user devices;
• and
• communicating an instruction that causes the first security protocol to be executed on the one or more user devices.

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to:

• store information associated with a first malicious network traffic;
• receive, from a user device, sensor data that indicates physical or digital attributes of the user device, comprising at least one of a fan speed, an electricity consumption, or an electromagnetic field generated by the user device;
• compare the sensor data with a baseline machine state, wherein the baseline machine state indicates baseline physical or digital attributes of the user device under a condition when no malicious network traffic is present;
• determine, based at least in part upon the comparison, the first malicious network traffic by detecting a deviation from the baseline machine state of the user device;
• communicate the first malicious network traffic to a first testing computing device;
• trigger execution of a first security protocol on the first testing computing device, wherein the first security protocol is configured to implement a first software instruction to address an effect of the first malicious network traffic on the first testing computing device;
• communicate the first malicious network traffic to a second testing computing device;
• trigger execution of a second security protocol on the second testing computing device, wherein the second security protocol is configured to implement a second software instruction to address the effect of the first malicious network traffic on the second testing computing device;
• determine that the first software instruction is configured to counter the effect of the first malicious network traffic by removing a security vulnerability in a piece of code associated with an operating system of the first testing computing device;
• determine that the second software instruction is associated with an anomaly;
• and
• in response to determining that the first software instruction is configured to counter the effect of the first malicious network traffic and that the second software instruction is associated with the anomaly:
• communicate the first security protocol to one or more user devices;
• and
• communicate an instruction that causes the first security protocol to be executed on the one or more user devices.