| CPC H04L 63/1433 (2013.01) [H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/1441 (2013.01)] | 39 Claims |

|
1. A system for detecting security vulnerabilities in at least one of cyber-physical systems (CPSs) and Internet of Things (IoT) devices, the system comprising one or more processors configured to:
construct an attack directed acyclic graph (DAG) unique to each CPS or IoT device of the devices, each attack DAG comprising a first plurality of nodes, each node of the first plurality representing a system-level operation of the device, a plurality of paths, each path representing an attack vector of the device, and a second plurality of nodes, each node of the second plurality representing an exploit goal of the device;
generate an aggregate attack DAG from a classification of each device and a location of each device in network topology specified by a system administrator, where classification comprises at least one of a purpose and physical limitation of the device;
calculate a vulnerability score and exploit risk score for each node in the aggregate attack DAG; and
optimize placement of defenses to reduce an adversary score of the aggregate attack DAG.
|