US 12,437,081 B2
Offline platform information technology cyber-physical risk mitigation
Ronald Fernandes, College Station, TX (US); Andrew Stephenson, Beavercreek, OH (US); and Richard J. Mayer, College Station, TX (US)
Assigned to Knowledge Based Systems, Inc., College Station, TX (US)
Filed by Knowledge Based Systems, Inc., College Station, TX (US)
Filed on Sep. 12, 2023, as Appl. No. 18/465,859.
Claims priority of provisional application 63/376,001, filed on Sep. 16, 2022.
Prior Publication US 2024/0095372 A1, Mar. 21, 2024
Int. Cl. G06F 21/57 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for offline platform information technology (PIT) cyber-physical risk assessment and mitigation comprising:
at least one processor; and
memory comprising instruction that, when executed by the at least one processor, cause the at least one processor to perform operations to:
obtain, through analyst input and ingest of various external data sources, system configuration data for a PIT computing system, wherein the PIT computing system comprises a self-contained mission-critical system of interconnected computing, memory, sensory, and effector elements;
generate, without requiring access to the PIT computing system, a cyber-physical model for the PIT computing system using the system configuration data, wherein the cyber-physical model hierarchically and topologically models the PIT computing system down to individual hardware and software component levels;
generate an attack path and mitigation data set from vulnerability data and mitigation data, wherein the attack path comprises a sequence of exploitable control and communication relationships between PIT computing system components that an attacker could traverse from an entry point to a target component within the PIT computing system;
generate a risk profile for the PIT computing system by evaluating the attack path and mitigation data set using the cyber-physical model without requiring access to the PIT computing system; and
automatically determine appropriate security mitigation actions based on a vulnerability detected in the risk profile.