# US 2014/0157417 A1 · Methods and systems for architecture-centric threat modeling, analysis and visualization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157417 A1 - Document ID: US20140157417A1 - Status: Published application - Kind: A1 - Application number: 13/690,517 - Filed: 2012-11-30 - Published: 2014-06-05 - Earliest claimed: 2012-11-30 - Assignees: The Boeing Company - Inventors: Brian Christopher Grubel; Dion Stephen David Reid - Web page: https://patentgrep.com/patent/US20140157417A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for use in architecture-centric threat modeling are described. One example system includes a display device, a memory device for storing a plurality of attributes for each of a plurality of network objects, and a processor communicatively coupled to the memory device. The processor is programmed to receive a user selection of at least a first network object and a second network object from the plurality of network objects; create a network architecture including the first network object and the second network object; associate the stored plurality of attributes with the selected network objects in the network architecture; display, on the display device, a graphical representation of the created network architecture; receive, from the user, at least one dataflow attribute associated with at least one of the first and second network objects; and store the at least one dataflow attribute to said memory device as an attribute of at least one of the plurality of network objects. ## Claims ### Claim 1 A system for use in network architecture threat modeling, said system comprising: a display device; a memory device for storing a plurality of attributes for each of a plurality of network objects; and a processor communicatively coupled to said memory device, said processor programmed to: receive a user selection of at least a first network object and a second network object from the plurality of network objects; create a network architecture including and linking the first network object and the second network object; associate the stored plurality of attributes with the selected network objects in the network architecture; display, on the display device, a graphical representation of the created network architecture; receive, from the user, at least one dataflow attribute associated with at least one of the first and second network objects; and store the at least one dataflow attribute to said memory device as an attribute of at least one of the plurality of network objects. ### Claim 2 (depends on 1) A system in accordance with claim 1, wherein said processor is configured to store the network architecture in said memory device as a network template in response to a user selection. ### Claim 3 (depends on 1) A system in accordance with claim 1, wherein the graphical representation of the created network architecture is a user selected one of a plurality of graphical representations. ### Claim 4 (depends on 3) A system in accordance with claim 3, wherein the plurality of graphical representations includes one or more graphical representations selected from a data flow diagram, an object hierarchy, an actor diagram by object, and an object only connection diagram, a threat tree, a hierarchical connection diagram, a physical diagram, and a logical connection diagram. ### Claim 5 (depends on 1) A system in accordance with claim 1, wherein said memory device stores at least one network template including a plurality of selected network objects. ### Claim 6 (depends on 5) A system in accordance with claim 5, wherein the user selection of at least a first network object and a second network object from the plurality of network objects comprises selecting the at least one network template. ### Claim 7 (depends on 1) A system in accordance with claim 1, wherein said processor is further configured to receive, from the user, at least one threat finding associated with at least a portion of the network architecture. ### Claim 8 (depends on 7) A system in accordance with claim 7, wherein said processor is further configured to store the threat finding associated with the portion of the network architecture. ### Claim 9 A method for use in network architecture threat modeling, said method comprising: receiving, by a computing device, a user selection of at least a first network object and a second network object from a plurality of network objects stored in a memory device; creating, by the computing device, a network architecture including the first network object and the second network object; associating, by the computing device, a plurality of attributes of the selected network objects stored in the memory device with the network architecture; displaying, on a display device, a graphical representation of the created network architecture; receiving, from the user, at least one dataflow attribute associated with at least one of the first and second network objects; and storing the at least one dataflow attribute to the memory device as an attribute of at least one of the plurality of network objects. ### Claim 10 (depends on 9) A method in accordance with claim 9, further comprising storing the network architecture in the memory device as a network template. ### Claim 11 (depends on 9) A method in accordance with claim 9, wherein displaying, on a display device, a graphical representation of the created network architecture comprises displaying a user selected one of a plurality of graphical representations of the network architecture. ### Claim 12 (depends on 11) A method in accordance with claim 11, wherein displaying a user selected one of a plurality of graphical representations comprises displaying a graphical representation of the network architecture selected from a data flow diagram, an object hierarchy, an actor diagram by object, and an object only connection diagram, a threat tree, a hierarchical connection diagram, a physical diagram, and a logical connection diagram. ### Claim 13 (depends on 9) A method in accordance with claim 9, wherein receiving, by a computing device, a user selection of at least a first network object and a second network object from a plurality of network objects stored in a memory device comprises receiving a selection of at least one network template stored in the memory device, the network template including the first network object and the second network object. ### Claim 14 (depends on 9) A method in accordance with claim 9, further comprising receiving at least one threat finding associated with at least a portion of the network architecture. ### Claim 15 (depends on 14) A method in accordance with claim 14, further comprising storing, to the memory device, the threat finding associated with the portion of the network architecture. ### Claim 16 A computer readable medium having embodied thereon nontransitory computer executable instructions that, when executed by a processor, cause the processor to: create a network architecture in response to a user input, the network architecture including at least a first network object and a second network object stored on a memory device; associate a stored plurality of attributes with the selected first and second network objects; display, on the display device, a graphical representation of the created network architecture; and store at least one dataflow attribute received from the user to the memory device as an attribute of at least one of the first and second network objects. ### Claim 17 (depends on 16) A computer readable medium in accordance with claim 16, wherein said instructions, when executed by the processor, cause the processor to store the network architecture in the memory device as a network template in response to a user selection. ### Claim 18 (depends on 16) A computer readable medium in accordance with claim 16, wherein said instructions, when executed by the processor, cause the processor to create the network architecture by retrieving a network template stored in the memory device. ### Claim 19 (depends on 16) A computer readable medium in accordance with claim 16, wherein said instructions, when executed by the processor, cause the processor to receive, from the user, at least one threat finding associated with at least a portion of the network architecture. ### Claim 20 (depends on 19) A computer readable medium in accordance with claim 19, wherein said instructions, when executed by the processor, cause the processor to store to the memory device the threat finding associated with the portion of the network architecture.