Attack tree generation method and device

Abstract

The invention discloses an attack tree generation method and device, and the method comprises the steps: obtaining a data stream which is used for indicating a plurality of devices through which a target service flows in sequence; and generating an attack tree according to the data stream, the attack tree comprising a plurality of device nodes, each of the plurality of device nodes being configured to indicate one of the plurality of devices. In this way, the attack tree of the service (or called service or function) level type can be quickly and automatically generated, and the efficiency of network security risk analysis for the service (or called service or function) can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an attack tree generation method and device. Background Art

[0002] During the development of network security software, attack tree analysis of assets (e.g., devices, interfaces, etc.) helps network security developers understand the network security risks currently faced by the assets, thereby guiding network security developers to deploy mitigation measures to improve the security of assets; it can also help white hat hackers improve the efficiency of penetration testing of assets, thereby quickly identifying the network security risks of assets.

[0003] The current method of generating attack trees for assets is mainly manual drawing, which is not only inefficient, but also difficult to traverse all possible attack paths. Therefore, it cannot provide a good guide for the security architecture design of key assets such as services or businesses, nor can it comprehensively improve the network security of key assets under all known attack paths. Summary of the invention

[0004] The present application discloses an attack tree generation method and device, which can realize the rapid and automatic generation of attack trees for functions, services or businesses, which is beneficial to improving the efficiency of network security risk analysis and increasing the practicality of attack trees.

[0005] In a first aspect, the present application provides an attack tree generation method, the method comprising: obtaining a data flow, the data flow being used to indicate multiple devices through which a target service flows in sequence; generating an attack tree based on the data flow, wherein the attack tree comprises multiple device nodes, each of the multiple device nodes being used to indicate one device among the multiple devices.

[0006] Here, different device nodes indicate different devices.

[0007] The target service is a service, which can also be understood as a business or function. For example, the target service can be a function provided by the cockpit domain controller (CDC) in the vehicle, a function provided by the mobile data center (MDC) in the vehicle, or a service provided by the vehicle domain controller (VDC) in the vehicle. For another example, the target service can also be to read a file stored on a server in the network system.

[0008] Exemplarily, the target services on the vehicle include Bluetooth door opening, seat adjustment, window adjustment, trunk opening or closing, air conditioning opening or closing, headlight turning on, audio playback, video playback, text message sending, phone call making, etc.

[0009] Here, the data flow can be understood as the data flow of the control signal that realizes the target service. The control signal is different from the attack signal, and the control signal does not have the attack purpose. It should be noted that, more generally, signals that do not have the attack purpose can be understood as the control signal in this application.

[0010] Here, the data flow is used to indicate multiple devices through which the target service flows in sequence, which can be understood as: the data flow is associated with the multiple devices through which the target service flows in sequence, or the data flow is associated with the multiple devices through which the target service flows, or the data flow at least includes the multiple devices through which the target service flows, and no specific limitation is made here.

[0011] Here, each of the above-mentioned device nodes is used to indicate one of the multiple devices, which can be understood as each device node corresponding to one of the multiple devices, and different device nodes correspond to different devices. In the above method, a generation logic of attack tree based on data flow generation service level type is proposed, which comprehensively considers the security impact of each device through which the service data flow flows on the service, and can not only realize the rapid and automatic generation of attack trees for functions, services or businesses, but also the generated attack trees are more complete, which is also conducive to improving the efficiency of network security risk analysis for the service.

[0012] Optionally, the method further includes: controlling display of the attack tree.

[0013] By implementing the above implementation method, the generated attack tree can be displayed to the user intuitively and clearly, and can guide the security architecture design in the service scenario.

[0014] Optionally, the attack tree also includes at least one interface node corresponding to the first device node, and the attack tree also includes at least one attack method node corresponding to the interface node and at least one attack step node corresponding to the interface node; wherein, the first device node belongs to the multiple device nodes, the first device node indicates a first device among the multiple devices, the interface node is used to indicate a first interface of the first device, the attack step node is used to indicate an attack step implemented through the first interface, and the attack method node is used to indicate an attack method to which the attack step implemented through the first interface belongs.

[0015] Here, the first device node indicates the first device among the multiple devices, which can be understood as: the first device node corresponds to the first device among the multiple devices, or the first device node represents or indicates the first device among the multiple devices.

[0016] The interface node is used to indicate the first interface of the first device, which can be understood as: the interface node corresponds to the first interface of the first device, or the interface node represents or indicates the first interface of the first device.

[0017] The attack step node is used to indicate the attack step implemented through the first interface, which can be understood as: the attack step node corresponds to the attack step implemented through the first interface, or the attack step node represents or indicates the attack step implemented through the first interface.

[0018] The attack method node is used to indicate the attack method to which the attack step implemented through the first interface belongs, which can be understood as: the attack method node corresponds to the attack method described in the attack step implemented through the first interface, or the attack method node represents or indicates the attack method described in the attack step implemented through the first interface.

[0019] Here, since each attack method consists of attack steps, the attack method node and the attack step node can be one-to-one corresponding, that is, each attack method node corresponds to an attack step node. In this way, each attack method may consist of multiple attack steps. In this case, multiple attack steps are represented as an attack step node in the attack tree, which can effectively reduce the number of nodes contained in the attack tree and reduce the complexity of the attack tree.

[0020] Here, the first device may be a network side device, a terminal device, or a component in these devices (e.g., a chip, a device, etc.). Among them, the network side device may be, for example, a computing device (e.g., a server) deployed on the network side. The terminal device may be, for example, an intelligent transportation device (such as a car, a ship, a drone, a train, a van, a truck, etc.), an intelligent home device (such as a TV, a sweeping robot, an intelligent desk lamp, an audio system, an intelligent lighting system, an electrical control system, home background music, a home theater system, an intercom system, a video surveillance system, etc.), an intelligent manufacturing device (such as a robot, an industrial equipment, an intelligent logistics, an intelligent factory, etc.), a user device (such as a mobile phone, a computer, a tablet computer, a PDA, a desktop, a headset, an audio system, a wearable device, an in-vehicle device, a virtual reality device, an augmented reality device, etc.), etc.

[0021] The interface of the first device includes at least one of a physical interface and a software interface (or logical interface), wherein the physical interface refers to an interface for communicating (e.g., transmitting data, power, signals, etc.) between the first device and an external environment or other devices through a physical connection, and the physical interface may be, for example, a universal serial bus USB interface, a high definition multimedia interface (HDMI) interface, an Ethernet (abbreviated as eth) interface, etc. The software interface refers to an interface for communicating between the first device and an external environment or other devices through software, and the software interface may be, for example, an application programming interface, a network interface, a protocol interface, etc. It is understood that the interfaces of different devices may be different.

[0022] When implementing the above implementation, the attack tree also includes at least one of the attack method node and the attack step node and the interface node, so that based on the attack tree, multiple devices involved in the target service and the attack methods or attack steps that can be implemented through the interface of any device can be known. The attack tree is concise and intuitive, which is conducive to improving the efficiency of network security risk analysis for the service.

[0023] Optionally, the first device node is connected to the at least one interface node, and the interface node is connected to the at least one attack step node or the at least one attack method node.

[0024] Exemplarily, in the case where the attack tree includes attack method nodes and attack step nodes, for the interface nodes connected to the first device node, if each interface node is respectively connected to at least one attack method node corresponding to the interface node, then each attack method node is also connected to the attack step node corresponding to the attack method node; similarly, if each interface node is respectively connected to at least one attack step node corresponding to the interface node, then each attack step node is also connected to the attack method node corresponding to the attack step node.

[0025] By implementing the above implementation, a hierarchical connection relationship of device node-interface node-attack step node (or attack method node) in the attack tree is established, and the connection between the nodes in the attack tree is intuitive and clear.

[0026] Optionally, the attack tree further includes at least one threat scenario node corresponding to the first device node, wherein the threat scenario node is used to indicate a threat scenario of the target service.

[0027] Here, the threat scenario node is used to indicate the threat scenario of the target service, which can be understood as: the threat scenario node corresponds to the threat scenario of the target service, or the threat scenario node represents or indicates the threat scenario of the target service.

[0028] Here, the threat scenario of the target service is related to the damage scenario of the target service. For example, the threat scenario of the target service is used to describe the potential cause of the damage scenario of the target service, and can also be understood as the potential cause of the threat to the network security attributes of the target service.

[0029] Here, in the attack tree, the threat scenario nodes corresponding to different device nodes are the same.

[0030] When implementing the above implementation, the attack tree also includes a threat scenario node, and the user can quickly know the potential cause of the attack effect of the damage scenario of the target service.

[0031] Optionally, the threat scenario node is connected to the first device node and the at least one interface node respectively; or, the threat scenario node is connected to the interface node and at least one attack method node respectively; or, the threat scenario node is connected to the interface node and at least one attack step node respectively.

[0032] From the hierarchical relationship of the attack tree, the threat scenario node can be set between the device node and the interface node, that is, the threat scenario node is directly connected to the device node upward and directly connected to the interface node downward. In this case, the threat scenario nodes connected to the same device node in the attack tree have the same interface nodes connected to different threat scenario nodes.

[0033] From the hierarchical relationship of the attack tree, the threat scenario node can also be set between the interface node and the attack method node, that is, the threat scenario node is directly connected to the interface node upward and directly connected to the attack method node downward. Here, since the attack method is related to the interface and threat scenario of the device, the same interface of the device may correspond to different attack methods in different threat scenarios. Therefore, the attack method node connected to the threat scenario node can be part or all of the nodes in at least one attack method node corresponding to the above-mentioned interface node. In the attack tree, the threat scenario nodes connected to different interface nodes are the same.

[0034] From the hierarchical relationship of the attack tree, the threat scenario node can also be set between the interface node and the attack step node, that is, the threat scenario node is directly connected to the interface node upward and directly connected to the attack step node downward. Here, the same interface of the device may correspond to different attack steps in different threat scenarios. Therefore, the attack step node connected to the threat scenario node can be part or all of the at least one attack step node corresponding to the above-mentioned interface node.

[0035] Optionally, the attack tree further includes a root node, the root node is connected to the multiple device nodes respectively, and the root node is used to indicate a damage scenario of the target service.

[0036] Here, the root node is used to indicate the damage scenario of the target service, which can be understood as: the root node corresponds to the damage scenario of the target service, or the root node represents or indicates the damage scenario of the target service.

[0037] Here, the damage scenario is used to describe the damage effect achieved by attacking the target service. The damage scenario can be, for example, integrity damage, privacy damage, availability damage, etc. A damage scenario can correspond to at least one threat scenario, and a threat scenario can correspond to at least one damage scenario. Different damage scenarios may correspond to different threat scenarios.

[0038] When implementing the above implementation, the attack tree also includes a root node, through which the damage effect achieved by attacking the target service can be obtained.

[0039] Optionally, the attack tree also includes an intermediate node corresponding to the first device node, and the intermediate node is used to indicate that the damage scenario for achieving the target service requires the first device to pass verification by a second device, and the second device is the device through which the data flow flows after the first device, and the first device node is connected to the root node through the intermediate node.

[0040] Here, the intermediate node can also be understood as a post-condition that is required to be satisfied by the first device when implementing the damage scenario of the target service through the first device. The post-condition is, for example, that the first device passes the verification of the second device.

[0041] Here, the intermediate node is used to indicate that the damage scenario for achieving the target service requires the first device to be verified by the second device. It can be understood that: the intermediate node corresponds to the condition that the damage scenario for achieving the target service requires the first device to be verified by the second device, or the intermediate node indicates or represents that the damage scenario for achieving the target service requires the first device to be verified by the second device.

[0042] For example, the data flow of the door control indicates that the multiple devices that flow through in sequence to achieve the door control include a Bluetooth receiving module (such as an intelligent key module IKM), a gateway (such as a vehicle integrated unit VIU) and a door and window control electronic control unit (such as a door and window controller DWS), wherein VIU and DWS are the devices through which the data flow flows after IKM, and DWS is the device through which the data flow flows after VIU. Assuming that VIU needs to verify the data of IKM, the attack tree contains an intermediate node corresponding to IKM, which is used to indicate that the damage scenario to achieve the door control requires IKM to pass the verification of VIU.

[0043] Exemplarily, the method further includes: obtaining indication information, the indication information being used to indicate the establishment of an attack tree of a service level type; generating the attack tree according to the data flow, including: generating the attack tree according to the data flow in response to the indication information.

[0044] By implementing the above implementation, an attack tree of the service level type can also be automatically generated in response to the user's instruction information.

[0045] In a second aspect, the present application provides an attack tree generation method, the method comprising: indicating to a user the type of attack tree to be established, the type including at least one of a service level, a device level, and an interface level; receiving setting information of the user; generating the attack tree according to the setting information; wherein, when the setting information indicates the establishment of an attack tree of the service level type, the setting information also includes a data stream, the data stream is used to indicate a plurality of devices through which the target service flows in sequence, the attack tree includes a plurality of device nodes, each of the plurality of device nodes is used to indicate a device among the plurality of devices; and controlling the display of the attack tree.

[0046] Here, the target service, data flow, and device node can refer to the description of the corresponding content of the first aspect, which will not be repeated here.

[0047] Here, the user can be a user of network security tools, such as a network security developer, a white hat hacker, etc.

[0048] Exemplarily, the interface user's setting information includes: obtaining setting information input by the user through a touch screen; obtaining setting information input by the user through a button; obtaining setting information input by the user through a keyboard; obtaining setting information input by the user through voice; or obtaining setting information input by the user through gestures.

[0049] In the above method, the user is supported to independently select the type of attack tree to be established, the user's setting information is obtained through human-computer interaction, and the specified type of attack tree is automatically generated based on the setting information. This can meet the application requirements of attack trees in different scenarios, is conducive to guiding the security architecture design of services, devices or interfaces, and increases the practicality of attack trees.

[0050] Optionally, when the setting information indicates the establishment of an attack tree of the service level type, the attack tree also includes at least one first interface node corresponding to the first device node, and the attack tree also includes at least one first attack method node corresponding to the first interface node and at least one first attack step node corresponding to the first interface node; wherein, the first device node belongs to the multiple device nodes, the first device node indicates a first device among the multiple devices, the first interface node is used to indicate a first interface of the first device, the first attack step node is used to indicate an attack step implemented through the first interface, and the first attack method node is used to indicate the attack method to which the attack step implemented through the first interface belongs.

[0051] Optionally, the first device node is connected to the at least one first interface node, and the first interface node is connected to the at least one first attack step node or the at least one first attack method node.

[0052] Optionally, the attack tree further includes at least one first threat scenario node corresponding to the first device node, wherein the first threat scenario node is used to indicate a threat scenario of the target service.

[0053] Optionally, the first threat scenario node is respectively connected to the first device node and the at least one first interface node; or, the first threat scenario node is respectively connected to the first interface node and at least one first attack method node; or, the first threat scenario node is respectively connected to the first interface node and at least one first attack step node.

[0054] Optionally, the attack tree further includes a first root node, the first root node is used to indicate a damage scenario of the target service, and the first root node is connected to the multiple device nodes respectively.

[0055] The feature description of the attack tree of the service level type in the second aspect and the technical effect of the feature description can refer to the description of the corresponding content of the first aspect, which will not be repeated here.

[0056] Optionally, the method also includes: asking the user whether there is verification between the multiple devices; receiving feedback information, the feedback information indicating that a second device among the multiple devices verifies the first device, the second device being a device through which the data flow flows after the first device; in the attack tree, the first device node is connected to a first root node through an intermediate node, the first root node is used to indicate a damage scenario for the target service, and the intermediate node is used to indicate that the damage scenario for achieving the target service requires the first device to pass the verification of the second device.

[0057] Here, the intermediate node can refer to the description of the corresponding content of the first aspect, which will not be repeated here.

[0058] By implementing the above implementation, the setting of the intermediate nodes in the attack tree can be generated based on the user's feedback information, so that the generated attack tree is closer to reality and more applicable, which is conducive to improving the efficiency of network security risk analysis for services.

[0059] Optionally, when the setting information indicates establishing an attack tree of the device level type, the attack tree includes the at least one second interface node, and the attack tree also includes at least one second attack method node corresponding to the second interface node and at least one second attack step node corresponding to the second interface node; wherein the second interface node is used to indicate the second interface of the target device, the second attack step node is used to indicate the attack step implemented through the second interface, and the second attack method node is used to indicate the attack method to which the attack step implemented through the second interface belongs.

[0060] Here, the second interface node is used to indicate the second interface of the target device, which can be understood as: the second interface node corresponds to the second interface of the target device, or the second interface node represents or indicates the second interface of the target device.

[0061] The second attack step node is used to indicate the attack step implemented through the second interface, which can be understood as: the second attack step node corresponds to the attack step implemented through the second interface, or the second attack step node represents or indicates the attack step implemented through the second interface.

[0062] The second attack method node is used to indicate the attack method to which the attack step implemented through the second interface belongs. It can be understood that: the second attack method node corresponds to the attack method to which the attack step implemented through the second interface belongs, or the second attack method node represents or indicates the attack method to which the attack step implemented through the second interface belongs.

[0063] Here, the target device can be any device that the user needs to perform network security analysis on through the attack tree, for example, the target device is the device in the above data flow. The target device can be a network side device, a terminal device, or a component in these devices (such as a chip, a device, etc.). For the description of the network device and the terminal device, please refer to the description of the corresponding content of the first aspect, which will not be repeated here.

[0064] When implementing the above implementation method, the device-level attack tree includes at least one of the attack method node and the attack step node and the interface node, so that based on the attack tree, the interfaces involved in the target device and the attack methods or attack steps that can be implemented through any interface can be known. The attack tree is concise and intuitive, which is conducive to improving the efficiency of network security risk analysis for the device and can also guide the security architecture design of the device.

[0065] Optionally, the second interface node is connected to the at least one second attack method node, or the second interface node is connected to the at least one second attack step node.

[0066] Exemplarily, in the case where the device-level type attack tree includes attack method nodes and attack step nodes, if the second interface node is connected to at least one second attack method node, each second attack method node is also connected to the second attack step node corresponding to the second attack method node; if the second interface node is connected to at least one second attack step node, each second attack step node is also connected to the second attack method node corresponding to the second attack step node.

[0067] By implementing the above implementation, a hierarchical connection relationship of interface node-attack step node (or attack method node) in the attack tree of the device level type is established, and the connection between the nodes in the attack tree is intuitive and clear.

[0068] Optionally, the attack tree further includes a second root node, where the second root node is used to indicate a damage scenario of the target device, wherein the second root node is respectively connected to the at least one second interface node.

[0069] Here, the second root node is used to indicate the damage scenario of the target device, which can be understood as: the second root node corresponds to the damage scenario of the target device, or the second root node represents or indicates the damage scenario of the target device.

[0070] Here, the damage scenario of the target device describes the damage effect achieved by attacking the target device. The damage scenario may be, for example, integrity damage, privacy damage, availability damage, etc.

[0071] When implementing the above implementation, the device-level attack tree also includes a root node, through which the damage effect of attacking the target device can be obtained.

[0072] Optionally, the attack tree further includes at least one second threat scenario node corresponding to the second interface node, wherein the second threat scenario node is used to indicate a threat scenario of the target device.

[0073] Here, the second threat scenario node is used to indicate the threat scenario of the target device, which can be understood as: the second threat scenario node corresponds to the threat scenario of the target device, or the second threat scenario node represents or indicates the threat scenario of the target device.

[0074] Here, the threat scenario of the target device is related to the damage scenario of the target device. For example, the threat scenario of the target device is used to describe the potential cause of the damage scenario of the target device, and can also be understood as the potential cause of the threat to the network security attributes of the target device.

[0075] In the attack tree, different second interface nodes are connected to the same second threat scenario node.

[0076] When the above implementation is implemented, the attack tree also includes a threat scenario node, and the user can quickly know the potential cause of the attack effect of the damage scenario of the target device.

[0077] Optionally, the second threat scenario node is respectively connected to the second interface node and at least one of the second attack method nodes; or, the second threat scenario node is respectively connected to the second interface node and at least one of the second attack step nodes; or, the second threat scenario node is respectively connected to the second root node and the at least one second interface node, wherein the second root node is used to indicate the damage scenario of the target device.

[0078] From the hierarchical relationship of the attack tree, the second threat scenario node can be set between the second interface node and the second attack method node. Since the attack method is related to the interface and threat scenario of the device, the same interface of the device may correspond to different attack methods in different threat scenarios. Therefore, for any second threat scenario node connected to the second interface node, the second attack method node connected to the second threat scenario node can be part or all of the at least one second attack method node corresponding to the second interface node.

[0079] From the hierarchical relationship of the attack tree, the second threat scenario node can be set between the second interface node and the second attack step node. The same interface of the device may correspond to different attack steps in different threat scenarios. Therefore, for any second threat scenario node connected to the second interface node, the second attack step node connected to the second threat scenario node can be part or all of the at least one second attack step node corresponding to the second interface node.

[0080] From the hierarchical relationship of the attack tree, the second threat scenario node can be set between the second root node and the second interface node. In this case, different second threat scenario nodes in the attack tree are connected to the same second interface node.

[0081] It can be seen that in the device-level attack tree, the hierarchical connection between threat scenario nodes and other types of nodes is relatively flexible.

[0082] Optionally, when the setting information indicates establishing an attack tree of the interface level type, the attack tree includes at least one of at least one third attack step node and at least one third attack method node; wherein the third attack step node is used to indicate the attack step implemented through the target interface, and the third attack method node is used to indicate the attack method to which the attack step implemented through the target interface belongs.

[0083] Here, the third attack step node is used to indicate the attack step implemented through the target interface, which can be understood as: the third attack step node corresponds to the attack step implemented through the target interface, or the third attack step node represents or indicates the attack step implemented through the target interface.

[0084] The third attack method node is used to indicate the attack method to which the attack step implemented through the target interface belongs. It can be understood that: the third attack method node corresponds to the attack method to which the attack step implemented through the target interface belongs, or the third attack method node represents or indicates the attack method to which the attack step implemented through the target interface belongs.

[0085] Here, the target interface can be any interface that the user needs to perform network security analysis on through the attack tree, for example, the target interface can be the interface of the device in the above data flow. The target interface can be a physical interface or a software interface. The target interface can refer to the description of the corresponding content of the first aspect, and will not be repeated here.

[0086] By implementing the above implementation method, the interface-level attack tree includes at least one of an attack method node and an attack step node, so that based on the attack tree, any attack method or attack step that may be implemented through the target interface can be known, which is conducive to improving the efficiency of network security risk analysis for the interface and can also guide the security architecture design of the interface.

[0087] Optionally, the attack tree further includes a third root node, and the third root node is used to indicate a damage scenario of the target interface, wherein the third root node is respectively connected to the at least one third attack step node or the at least one third attack method node.

[0088] Here, the third root node is used to indicate the damage scenario of the target interface, which can be understood as: the third root node corresponds to the damage scenario of the target interface, or the third root node represents or indicates the damage scenario of the target interface.

[0089] By implementing the above implementation method, a hierarchical connection relationship such as the root node-attack step node (or attack method node) in the interface level type attack tree is established. The connection between the nodes in the attack tree is intuitive and clear, and the damage effect achieved by the attack target interface can be obtained through the root node.

[0090] Optionally, the attack tree further includes at least one third threat scenario node, wherein the third threat scenario node is used to indicate a threat scenario of the target interface.

[0091] Here, the third threat scenario node is used to indicate the threat scenario of the target interface, which can be understood as: the third threat scenario node corresponds to the threat scenario of the target interface, or the third threat scenario node represents or indicates the threat scenario of the target interface.

[0092] By implementing the above implementation, through the threat scenario node of the interface-level attack tree, the user can quickly know the potential cause of the attack effect of the damage scenario of the target interface.

[0093] Optionally, the third attack step node is connected to at least one of the third threat scenario nodes, respectively; or, the third attack method node is connected to at least one of the third threat scenario nodes, respectively; or, the third threat scenario node is connected to a third root node and at least one of the third attack step nodes, respectively; or, the third threat scenario node is connected to a third root node and at least one of the third attack method nodes, respectively; wherein, the third root node is used to indicate the damage scenario of the target interface.

[0094] From the hierarchical relationship of the attack tree, the third threat scenario node can be set at the last layer of the attack tree.

[0095] For example, the third threat scenario node is only connected to the third attack method node. Here, different third attack method nodes may be connected to different third threat scenario nodes, so the third threat scenario node connected to the third attack method node may be part or all of the at least one third threat scenario node.

[0096] For another example, the third threat scenario node is only connected to the third attack step node. Here, different third attack step nodes may be connected to different third threat scenario nodes, so the third threat scenario node connected to the third attack step node may be part or all of the at least one third threat scenario node.

[0097] From the perspective of the hierarchical relationship of the attack tree, the third threat scenario node may not be set at the last layer of the attack tree.

[0098] For example, the third threat scenario node is set between the third root node and the third attack method node. In this case, different third threat scenario nodes may be connected to different third attack method nodes, so for any third threat scenario node, the third attack method node connected to the third threat scenario node may be part or all of the at least one third attack method node.

[0099] For another example, the third threat scenario node is set between the third root node and the third attack step node. In this case, different third threat scenario nodes may be connected to different third attack step nodes, so for any third threat scenario node, the third attack step node connected to the third threat scenario node may be part or all of the at least one third attack step node.

[0100] In a third aspect, the present application provides a device for generating an attack tree, the device comprising: a receiving module for acquiring a data stream, the data stream being used to indicate a plurality of devices through which a target service flows in sequence; a processing module for generating an attack tree based on the data stream, wherein the attack tree comprises a plurality of device nodes, each of the plurality of device nodes being used to indicate a device among the plurality of devices.

[0101] Optionally, the processing device is further used to: control display of the attack tree.

[0102] Optionally, the attack tree also includes at least one interface node corresponding to the first device node, and the attack tree also includes at least one attack method node corresponding to the interface node and at least one attack step node corresponding to the interface node; wherein, the first device node belongs to the multiple device nodes, the first device node indicates a first device among the multiple devices, the interface node is used to indicate a first interface of the first device, the attack step node is used to indicate an attack step implemented through the first interface, and the attack method node is used to indicate an attack method to which the attack step implemented through the first interface belongs.

[0103] Optionally, the first device node is connected to the at least one interface node, and the interface node is connected to the at least one attack step node or the at least one attack method node.

[0104] Optionally, the attack tree further includes at least one threat scenario node corresponding to the first device node, wherein the threat scenario node is used to indicate a threat scenario of the target service.

[0105] Optionally, the threat scenario node is connected to the first device node and the at least one interface node respectively; or, the threat scenario node is connected to the interface node and at least one attack method node respectively; or, the threat scenario node is connected to the interface node and at least one attack step node respectively.

[0106] Optionally, the attack tree further includes a root node, the root node is connected to the multiple device nodes respectively, and the root node is used to indicate a damage scenario of the target service.

[0107] Optionally, the attack tree also includes an intermediate node corresponding to the first device node, and the intermediate node is used to indicate that the damage scenario for achieving the target service requires the first device to pass verification by a second device, and the second device is the device through which the data flow flows after the first device, and the first device node is connected to the root node through the intermediate node.

[0108] Exemplarily, the receiving module is further used to: obtain indication information, where the indication information is used to indicate the establishment of an attack tree of a service level type; and the processing module is specifically used to: generate the attack tree according to the data flow in response to the indication information.

[0109] In a fourth aspect, the present application provides a device for generating an attack tree, the device comprising: a display module, used to indicate to a user the type of attack tree to be established, the type including at least one of a service level, a device level and an interface level; a receiving module, used to receive setting information of the user; a processing module, used to generate the attack tree according to the setting information; wherein, when the setting information indicates to establish an attack tree of the service level type, the setting information also includes a data stream, the data stream is used to indicate a plurality of devices through which the target service flows in sequence, the attack tree includes a plurality of device nodes, each of the plurality of device nodes is used to indicate a device among the plurality of devices; the processing module is also used to control the display of the attack tree.

[0110] Optionally, when the setting information indicates the establishment of an attack tree of the service level type, the attack tree also includes at least one first interface node corresponding to the first device node, and the attack tree also includes at least one first attack method node corresponding to the first interface node and at least one first attack step node corresponding to the first interface node; wherein, the first device node belongs to the multiple device nodes, the first device node indicates a first device among the multiple devices, the first interface node is used to indicate a first interface of the first device, the first attack step node is used to indicate an attack step implemented through the first interface, and the first attack method node is used to indicate the attack method to which the attack step implemented through the first interface belongs.

[0111] Optionally, the first device node is connected to the at least one first interface node, and the first interface node is connected to the at least one first attack step node or the at least one first attack method node.

[0112] Optionally, the attack tree further includes at least one first threat scenario node corresponding to the first device node, wherein the first threat scenario node is used to indicate a threat scenario of the target service.

[0113] Optionally, the first threat scenario node is respectively connected to the first device node and the at least one first interface node; or, the first threat scenario node is respectively connected to the first interface node and at least one first attack method node; or, the first threat scenario node is respectively connected to the first interface node and at least one first attack step node.

[0114] Optionally, the attack tree further includes a first root node, the first root node is used to indicate a damage scenario of the target service, and the first root node is connected to the multiple device nodes respectively.

[0115] Optionally, the processing module is also used to: ask the user whether there is verification between the multiple devices; the receiving module is also used to receive feedback information, the feedback information indicating that a second device among the multiple devices verifies the first device, and the second device is a device through which the data flow flows after the first device; in the attack tree, the first device node is connected to the first root node through an intermediate node, the first root node is used to indicate a damage scenario for the target service, and the intermediate node is used to indicate that the damage scenario for achieving the target service requires the first device to pass the verification of the second device.

[0116] Optionally, when the setting information indicates establishing an attack tree of the device level type, the attack tree includes the at least one second interface node, and the attack tree also includes at least one second attack method node corresponding to the second interface node and at least one second attack step node corresponding to the second interface node; wherein the second interface node is used to indicate the second interface of the target device, the second attack step node is used to indicate the attack step implemented through the second interface, and the second attack method node is used to indicate the attack method to which the attack step implemented through the second interface belongs.

[0117] Optionally, the second interface node is connected to the at least one second attack method node, or the second interface node is connected to the at least one second attack step node.

[0118] Optionally, the attack tree further includes a second root node, where the second root node is used to indicate a damage scenario of the target device, wherein the second root node is respectively connected to the at least one second interface node.

[0119] Optionally, the attack tree further includes at least one second threat scenario node corresponding to the second interface node, wherein the second threat scenario node is used to indicate a threat scenario of the target device.

[0120] Optionally, the second threat scenario node is respectively connected to the second interface node and at least one of the second attack method nodes; or, the second threat scenario node is respectively connected to the second interface node and at least one of the second attack step nodes; or, the second threat scenario node is respectively connected to the second root node and the at least one second interface node, wherein the second root node is used to indicate the damage scenario of the target device.

[0121] Optionally, when the setting information indicates establishing an attack tree of the interface level type, the attack tree includes at least one of at least one third attack step node and at least one third attack method node; wherein the third attack step node is used to indicate the attack step implemented through the target interface, and the third attack method node is used to indicate the attack method to which the attack step implemented through the target interface belongs.

[0122] Optionally, the attack tree further includes a third root node, and the third root node is used to indicate a damage scenario of the target interface, wherein the third root node is respectively connected to the at least one third attack step node or the at least one third attack method node.

[0123] Optionally, the attack tree further includes at least one third threat scenario node, wherein the third threat scenario node is used to indicate a threat scenario of the target interface.

[0124] Optionally, the third attack step node is connected to at least one of the third threat scenario nodes, respectively; or, the third attack method node is connected to at least one of the third threat scenario nodes, respectively; or, the third threat scenario node is connected to a third root node and at least one of the third attack step nodes, respectively; or, the third threat scenario node is connected to a third root node and at least one of the third attack method nodes, respectively; wherein, the third root node is used to indicate the damage scenario of the target interface.

[0125] In a fifth aspect, the present application provides a device for generating an attack tree, the device comprising a processor and a memory, wherein the memory is used to store program instructions; the processor calls the program instructions in the memory so that the device executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect.

[0126] In a sixth aspect, the present application provides a computer-readable storage medium comprising computer instructions, which, when executed by a processor, implement the method of the above-mentioned first aspect or any possible implementation of the first aspect, or implement the above-mentioned second aspect or any possible implementation of the second aspect.

[0127] In the seventh aspect, the present application provides a computer program product, which, when executed by a processor, implements the method in the above-mentioned first aspect or any possible embodiment of the first aspect, or implements the method in the above-mentioned second aspect or any possible implementation manner of the second aspect.

[0128] Exemplarily, the computer program product may be a software installation package. BRIEF DESCRIPTION OF THE DRAWINGS

[0129] Figure 1 is a structural schematic diagram of a processing device provided in an embodiment of the present application;

[0130] Figure 2 is a flow chart of an attack tree generation method provided in an embodiment of the present application;

[0131] Figure 3 It is a schematic diagram of an attack tree of a service level type provided in an embodiment of the present application;

[0132] Figure 4 is a schematic diagram of an attack tree of another service level type provided in an embodiment of the present application;

[0133] Figure 5 is a schematic diagram of an attack tree of another service level type provided in an embodiment of the present application;

[0134] Figure 6 It is a flowchart of another attack tree generation method provided in an embodiment of the present application;

[0135] Figure 7 is a schematic diagram of a human-computer interaction interface provided in an embodiment of the present application;

[0136] Fig. 8A It is a schematic diagram of a device-level attack tree provided in an embodiment of the present application;

[0137] Figure 8B It is a schematic diagram of an interface-level attack tree provided in an embodiment of the present application;

[0138] Fig. 9 It is a structural diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0139] It should be noted that the prefixes such as "first" and "second" used in this application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. For example, if the described object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields". "First" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the described object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of described objects is not limited by the prefix and can be one or more. Taking "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes can be the same or different. For example, if the object being described is a "device", then the "first device" and the "second device" can be the same device, the same type of device, or different types of devices; for another example, if the object being described is "information", then the "first information" and the "second information" can be information of the same content or information of different contents. In short, the use of prefixes used to distinguish the described objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, refer to the description in the context of the claims or embodiments, and no unnecessary limitation should be constituted due to the use of such prefixes.

[0140] It should be noted that the description methods such as "at least one of a1, a2, ... and an" used in the embodiments of the present application include the situation where any one of a1, a2, ... and an exists alone, and also include any combination of any multiple of a1, a2, ... and an, and each situation can exist alone. For example, the description method of "at least one of a, b and c" includes the situation where a is alone, b is alone, c is alone, a combination of a and b, a combination of a and c, b and c, or a combination of abc.

[0141] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0142] See also Figure 1 , Figure 1 1 is a schematic diagram of a processing device provided in an embodiment of the present application. The processing device is used to generate an attack tree, which can be used to assist network security developers in designing a security architecture.

[0143] like Figure 1 As shown, the processing device includes a receiving module and a processing module, wherein the receiving module and the processing module can communicate with each other wirelessly or by wire. The processing device can be implemented by hardware, software, or a combination of hardware and software.

[0144] Exemplarily, the receiving module is used to obtain a data stream, wherein the data stream is used to indicate multiple devices that flow sequentially to implement a certain service, business or function; the processing module is used to generate an attack tree based on the data stream, wherein the attack tree includes multiple device nodes, and each of the multiple device nodes is used to indicate one of the multiple devices. In this case, the attack tree generated based on the data stream can also be called the attack tree of the service, business or function.

[0145] In some possible embodiments, in addition to supporting the generation of the above-mentioned service-level attack tree, the processing device also supports the generation of a device-level attack tree and an interface-level attack tree.

[0146] Exemplarily, the processing device also includes a display module, which is used to indicate to the user the type of attack tree to be established, which type includes at least one of service level, device level and interface level; the receiving module is used to receive the user's setting information; the processing module is used to generate an attack tree according to the setting information; and control the display of the attack tree; wherein, when the setting information indicates the establishment of an attack tree of the service level type, the setting information also includes a data flow, which is used to indicate multiple devices that flow through in sequence to achieve the target service, and the attack tree includes multiple device nodes, each of the multiple device nodes is used to indicate one of the above-mentioned multiple devices.

[0147] Here, the display module may be, for example, a display screen, and the display screen may be a liquid crystal display (LCD), an organic or inorganic light-emitting diode (OLED), an active matrix / organic light-emitting diode panel (AMOLED), etc.

[0148] In some possible embodiments, the processing device may not integrate the display module, but the device where the processing device is located is integrated with the display module. In this case, the processing module in the processing device can control the display type of the attack tree to be established and control the display of the generated attack tree through the display module, which is not specifically limited here.

[0149] Exemplarily, the processing device may be integrated into a network security tool, or may be deployed independently of the network security tool, which is not specifically limited herein.

[0150] The processing device provided in the embodiment of the present application can be applied to a variety of application scenarios, such as the following application scenarios: mobile internet (MI), industrial control, self-driving, transportation safety, Internet of Things (IoT), smart city, or smart home, etc.

[0151] It should be noted that Figure 1 This is only an exemplary architecture diagram, but not limited to Figure 1 The structure shown is only Figure 1 The form shown. Figure 1 It can also include Figure 1 In addition, the method provided in the embodiment of the present application can be applied to Figure 1 The processing device shown, of course, the method provided in the embodiment of the present application can also be applied to other processing devices, and the embodiment of the present application is not limited to this.

[0152] See also Figure 2 , Figure 2 is a flowchart of an attack tree generation method provided in an embodiment of the present application. The method can be applied to the above Figure 1 The processing device shown. The method includes but is not limited to the following steps:

[0153] S201: Acquire a data stream, where the data stream is used to indicate a plurality of devices through which a target service flows in sequence.

[0154] Here, the data flow is used to indicate multiple devices through which the target service flows in sequence, which can be understood as: the data flow is associated with the multiple devices through which the target service flows in sequence, or the data flow is associated with the multiple devices through which the target service flows, or the data flow at least includes the multiple devices through which the target service flows, and no specific limitation is made here.

[0155] Exemplarily, the target service may also be understood as a business or a function.

[0156] Taking a vehicle as an example, the target service can be a function provided by the cockpit domain controller (CDC) in the vehicle, a function provided by the mobile data center (MDC) in the vehicle, or a service provided by the vehicle domain controller (VDC) in the vehicle. Here, CDC is only an example of a hardware and software integrated platform for providing in-vehicle multimedia services in the vehicle, MDC is only an example of a hardware and software integrated platform for supporting intelligent driving in the vehicle, i.e., an in-vehicle computing platform, and VDC is only an example of a hardware and software integrated platform for supporting body control and chassis control in the vehicle.

[0157] Exemplarily, the target service on the vehicle may be Bluetooth door opening, seat adjustment, window adjustment, trunk opening or closing, air conditioning opening or closing, headlight turning on, audio playback, video playback, text message sending, phone call making, etc.

[0158] Taking the Bluetooth door opening service as an example, the Bluetooth door opening data flow is used to indicate that the multiple devices that implement the Bluetooth door opening service flow in sequence include: Bluetooth receiving module (such as IKM) -> gateway (such as vehicle integrated unit VIU) -> door and window control electronic control unit (such as DWS).

[0159] Taking a network system composed of multiple servers as an example, assuming that the target service is to read file 1 stored in server A, based on the routing configuration between the hosts in the network system, it can be known that file 1 is passed to server B via server C and then to server A. Therefore, the data flow of the target service can be expressed as server C->server B->server A.

[0160] In the embodiment of the present application, obtaining the data stream may include: receiving the data stream input by the user. Here, the user may be a user of the network security tool, such as a network security developer, a white hat hacker, and the like.

[0161] Exemplarily, the way in which the user inputs the data stream may be any one of the following ways: input through a touch screen, input through a keyboard, or input through voice.

[0162] In some possible embodiments, before acquiring the data flow, indication information may also be acquired, wherein the indication information is used to instruct to establish an attack tree of a service level type.

[0163] Exemplarily, obtaining the indication information may include: receiving the indication information input by the user. Here, the user may be a user of the network security tool, such as a network security developer. Further, the user may input the indication information in any of the following ways: input through a touch screen, input through a keyboard, input through a button, input through voice, or input through jewelry. Here, the introduction of the way in which the user inputs the indication information through the touch screen may refer to the following Figure 7 Related description of embodiments.

[0164] It is understandable that the data stream and the indication information may be sent separately through two different message bearers. In some possible embodiments, the data stream and the indication information may also be sent together through the same message bearer, which is not specifically limited here.

[0165] S202: Generate an attack tree according to the data stream, wherein the attack tree includes a plurality of device nodes, and each of the plurality of device nodes is used to indicate one device among the plurality of devices.

[0166] Here, each of the multiple device nodes is used to indicate one of the multiple devices, which also means that each of the multiple device nodes corresponds to one of the multiple devices.

[0167] Among them, in the attack tree, different device nodes indicate different devices.

[0168] For example, assuming that the data flow is used to indicate that multiple devices that flow through in sequence to achieve the target service include device 1, device 2 and device 3, accordingly, the attack tree includes three device nodes, namely device node 1, device node 2 and device node 3, wherein device node 1 is used to indicate device 1, device node 2 is used to indicate device 2, and device node 3 is used to indicate device 3.

[0169] Taking the above device node 1 being used to indicate device 1 as an example, device node 1 being used to indicate device 1 can be understood as: device node 1 corresponds to device 1, or device node 1 represents or indicates device 1.

[0170] In an embodiment of the present application, the attack tree also includes at least one interface node corresponding to device node one. For each interface node, the attack tree also includes at least one attack method node corresponding to the interface node and at least one attack step node corresponding to the interface node, wherein device node one belongs to the above-mentioned multiple device nodes, device node one is used to indicate device one among the above-mentioned multiple devices, the interface node is used to indicate the interface of device one, the attack step node is used to indicate the attack step implemented through the interface of device one, and the attack method node is used to indicate the attack method to which the attack step implemented through the interface of device one belongs.

[0171] Here, the device node one is used to indicate the device one among the above-mentioned multiple devices, which can be understood as: the device node one corresponds to the device one among the above-mentioned multiple devices, or the device node one represents or indicates the device one among the above-mentioned multiple devices.

[0172] The interface node is used to indicate the interface of the device one, which can be understood as: the interface node corresponds to the interface of the device one, or the interface node represents or indicates the interface of the device one.

[0173] The attack step node is used to indicate the attack step implemented through the interface of device one, which can be understood as: the attack step node corresponds to the attack step implemented through the interface of device one, or the attack step node represents or indicates the attack step implemented through the interface of device one.

[0174] The attack method node is used to indicate the attack method to which the attack step implemented through the interface of device one belongs. It can be understood that: the attack method node corresponds to the attack method to which the attack step implemented through the interface of device one belongs, or the attack method node represents or indicates the attack method to which the attack step implemented through the interface of device one belongs.

[0175] It can be seen that the above attack method nodes and attack step nodes can be one-to-one corresponding, that is, one attack method node corresponds to one attack step node.

[0176] Here, device 1 can be a network-side device, a terminal device, or a component in these devices (such as a chip, a device, etc.). Among them, the network-side device can be, for example, a computing device deployed on the network side (such as a server). The terminal device can be, for example, an intelligent transportation device (such as a car, a ship, a drone, a train, a van, a truck, etc.), an intelligent home device (such as a TV, a sweeping robot, an intelligent desk lamp, an audio system, an intelligent lighting system, an electrical control system, home background music, a home theater system, an intercom system, a video surveillance system, etc.), an intelligent manufacturing device (such as a robot, an industrial equipment, an intelligent logistics, an intelligent factory, etc.), a user device (such as a mobile phone, a computer, a tablet computer, a PDA, a desktop, a headset, an audio system, a wearable device, an in-vehicle device, a virtual reality device, an augmented reality device, etc.), etc.

[0177] Here, the interface of device 1 includes at least one of a physical interface and a software interface (or logical interface), wherein the physical interface refers to an interface for communication (e.g., data, power, signal, etc.) between device 1 and the external environment or other devices through physical connection, and the physical interface may be, for example, a universal serial bus USB interface, a high definition multimedia interface (HDMI) interface, an Ethernet (abbreviated as eth) interface, etc. The software interface refers to an interface for communication between device 1 and the external environment or other devices through software, and the software interface may be, for example, an application programming interface, a network interface, a protocol interface, etc. It is understandable that the interfaces of different devices may be different.

[0178] Here, the attack methods include but are not limited to relay attacks, man-in-the-middle attacks, brute force cracking, reconnection mechanisms, replay attacks, protocol stack vulnerability attacks, Btlejack (i.e., using Python to perform Bluetooth attacks) or other attack methods.

[0179] In one implementation, in the attack tree, device node 1 is respectively connected to at least one interface node corresponding to device node 1. For the interface nodes connected to device node 1, each interface node is respectively connected to at least one attack step node corresponding to the interface node, or each interface node is respectively connected to at least one attack method node corresponding to the interface node.

[0180] Exemplarily, in the case where the attack tree includes attack method nodes and attack step nodes, for the interface nodes connected to the device node, if each interface node is respectively connected to at least one attack method node corresponding to the interface node, then each attack method node is also connected to the attack step node corresponding to the attack method node. In some possible embodiments, the levels of the attack method nodes and the attack step nodes in the attack tree may also be interchangeable, which will not be described in detail here.

[0181] In some possible embodiments, the attack tree further includes a root node, wherein the root node is used to indicate a damage scenario of the target service. Further, the root node is respectively connected to the above-mentioned multiple device nodes. Here, the root node is used to indicate a damage scenario of the target service, which can be understood as: the root node corresponds to the damage scenario of the target service, or the root node represents or indicates the damage scenario of the target service.

[0182] Here, the damage scenario is used to describe the damage effect achieved by attacking the target service. The damage scenario can be, for example, integrity damage, privacy damage, availability damage, etc.

[0183] In some possible embodiments, the attack tree further includes at least one threat scenario node corresponding to the device node, wherein the threat scenario node is used to indicate the threat scenario of the target service. Here, the threat scenario nodes corresponding to different device nodes are the same. Here, the threat scenario node is used to indicate the threat scenario of the target service, which can be understood as: the threat scenario node corresponds to the threat scenario of the target service, or the threat scenario node represents or indicates the threat scenario of the target service.

[0184] Here, the threat scenario of the target service is related to the damage scenario of the target service. For example, the threat scenario of the target service is used to describe the potential cause of the damage scenario of the target service, and can also be understood as the potential cause of the threat to the network security attributes of the target service.

[0185] Exemplarily, one damage scenario may correspond to at least one threat scenario, and one threat scenario may correspond to at least one damage scenario. Different damage scenarios may correspond to different threat scenarios.

[0186] Taking the stride model to analyze threat scenarios as an example, the stride model divides security threats into six categories, namely snoofing (S), tampering (T), repudiation (R), information disclosure (I), denial of service (D), and elevation of privilege (E). Among them, S refers to the violation of user authentication information, T refers to the modification of system or user data with or without discovery, R refers to the ability of an untrusted user to be untracked when performing illegal operations, I refers to the destruction of user private or critical business information, D refers to making the system temporarily unavailable or unusable, and E refers to an unprivileged user gaining privileged access, thereby having sufficient authority to damage and destroy the entire system.

[0187] Further, in this case, when the damage scenario of the target service is integrity damage, the threat scenarios corresponding to the damage scenario include the above-mentioned S, T and E; when the damage scenario of the target service is availability damage, the threat scenarios corresponding to the damage scenario are D or E; when the damage scenario of the target service is privacy damage, the threat scenarios corresponding to the damage scenario are I and E. The threat analysis model is not limited to the stride model here. In some possible embodiments, PASTA, LINDDUN, Trike, VAST and other models can also be used for threat scenario analysis.

[0188] In one implementation, for the branch where the device node 1 is located in the attack tree, for any threat scenario node, the connection method of the threat scenario node can be any of the following:

[0189] Mode 1: The threat scenario node is connected to the device node 1 and at least one interface node corresponding to the device node 1 respectively.

[0190] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the device node and the interface node.

[0191] It can be understood that, for threat scenario nodes connected to the same device node in the attack tree, different threat scenario nodes are connected to the same interface node, that is, they are all connected to at least one interface node corresponding to the device node.

[0192] Mode 2: The threat scenario node is connected to an interface node and at least one attack method node corresponding to each device node.

[0193] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the interface node and the attack method node.

[0194] Since the attack method is related to the device interface and threat scenario, the same device interface may have different corresponding attack methods in different threat scenarios. Therefore, the attack method node connected to the threat scenario node is included in at least one attack method node corresponding to the interface node. In other words, the attack method node connected to the threat scenario node can be part or all of the at least one attack method node corresponding to the interface node.

[0195] Taking interface node 1 as an example, interface node 1 is used to indicate interface 1 of device 1. The attack method nodes corresponding to interface node 1 include attack method node 1, attack method node 2, attack method node 3 and attack method node 4. Assume that threat scenario node 1 is connected to interface node 1, attack method node 1 and attack method node 2 respectively, which means that the attack method indicated by attack method node 1 implemented through interface 1 can realize the threat scenario indicated by threat scenario node 1, and the attack method indicated by attack method node 2 implemented through interface 1 can also realize the threat scenario indicated by threat scenario node 1.

[0196] Mode 3: The threat scenario node is connected to an interface node and at least one attack step node corresponding to each device node.

[0197] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the interface node and the attack step node.

[0198] Since the attack method has a corresponding attack step, and the attack method is related to the two factors of the device interface and the threat scenario, the attack step is also related to the two factors of the device interface and the threat scenario. The same interface of the device may correspond to different attack steps in different threat scenarios. Therefore, the attack step node connected to the threat scenario node is included in at least one attack step node corresponding to the above interface node. In other words, the attack step node connected to the threat scenario node can be part or all of the at least one attack step node corresponding to the above interface node.

[0199] Taking interface node 1 as an example, interface node 1 is used to indicate interface 1 of device 1. The attack step nodes corresponding to interface node 1 include attack step node 1, attack step node 2, attack step node 3 and attack step node 4. Assume that threat scenario node 1 is connected to interface node 1, attack step node 1 and attack step node 2 respectively, which means that the attack step indicated by attack step node 1 implemented through interface 1 can realize the threat scenario indicated by threat scenario node 1, and the attack step indicated by attack step node 2 implemented through interface 1 can also realize the threat scenario indicated by threat scenario node 1.

[0200] Here, the connection method of the threat scenario node is not limited to the above three methods, and it can also be other methods, such as the threat scenario node is only connected to the attack step node or the attack method node, which is not specifically limited here.

[0201] See also Figure 3 , Figure 3 is a schematic diagram of an attack tree of a service level type provided in an embodiment of the present application. Assuming that the target service is door control, Figure 3The attack tree of the door control shown is generated based on the data flow of the door control. The data flow is used to indicate that the implementation of the door control service needs to flow through the three devices IKM, VIU and DWS in sequence.

[0202] Depend on Figure 3 It can be seen that the root node "Door control integrity destruction" is connected to the device node "IKM", the device node "VIU" and the device node "DWS" respectively. Taking one of the device nodes "IKM" as an example, the next level connection of the device node in the attack tree is described. The device node "IKM" is connected to the threat scenario node "S", the threat scenario node "T" and the threat scenario node "E" respectively. Taking the threat scenario node "S" as an example, the next level connection of the threat scenario node in the attack tree is described. The threat scenario node "S" is connected to the interface node "BLE", the interface node "JTAG", the interface node "CAN" and the interface node "UDSon CAN" respectively. Taking the interface node "BLE" as an example, the next level connection of the interface node in the attack tree is described. The interface node "BLE" is connected to the attack step node "1. The attacker forwards the Bluetooth signal of the user that has been monitored; 2. The attacker controls the target device outside the Bluetooth communication distance". Here, the number of attack step nodes connected to the interface node "BLE" is not limited.

[0203] Understandably, Figure 3 This is just an example of an attack tree for one service level type, but the attack tree that is not limited to a service level type is only Figure 3 In the form shown. Figure 3 In order to present the attack tree clearly, only one branch in the attack tree is shown in detail, namely the root node "Door control integrity breach" - device node "IKM" - threat scenario node "S" - interface node "BLE" - attack step node "1. The attacker forwards the Bluetooth signal of the user that has been monitored; 2. The attacker controls the target device outside the Bluetooth communication distance". Figure 3 The omission of other branches in the attack tree should not limit the presentation of other branches in the attack tree, and other branches can also be presented in detail using the presentation method of the aforementioned branches.

[0204] Exemplarily, the above-mentioned correspondence between damage scenarios and threat scenarios, the correspondence between devices and interfaces, the correspondence between threat scenarios and device interfaces, the correspondence between attack methods and attack steps, the correspondence between attack methods and device interfaces, the correspondence between attack steps and device interfaces, the correspondence between attack methods and device interfaces and threat scenarios, the correspondence between attack steps and device interfaces and threat scenarios, and other information can be pre-stored locally, such as in a local knowledge base, where the knowledge base can be used to generate an attack tree.

[0205] In one implementation, when generating Figure 3 When the attack tree is shown, a connection is first established between the root node and multiple device nodes indicated by the data stream based on the acquired data stream; then a connection is established between each threat scenario node and the interface node corresponding to the threat scenario node based on the correspondence between the threat scenario in the knowledge base and the damage scenario indicated by the root node, and the correspondence between the threat scenario and the interface of the device; then a connection is established between each interface node and the attack step node corresponding to the interface node based on the correspondence between the attack step in the knowledge base and the interface of the device and the threat scenario.

[0206] Understandably, for Figure 3 The attack tree shown can be varied in many ways.

[0207] For example, not limiting Figure 3 The multiple device nodes are arranged in sequence according to the device order through which the data flow flows. In some possible embodiments, Figure 3 The arrangement order of multiple device nodes in the device node may also be the device nodes "VIU", "DWS" and "IKM".

[0208] For example, Figure 3 The threat scenario node level can be deleted, that is, the device node is directly connected to the interface node.

[0209] For example, not limiting Figure 3 The threat scenario node can only be set between the device node and the interface node. For example, the threat scenario node can also be set between the interface node and the attack step node, or the threat scenario node can also be set after the attack step node, etc.

[0210] For example, Figure 3 The root node level can also be defaulted, for example, the root node is empty.

[0211] For example, Figure 3 The Attack Steps node can also be replaced by the Attack Methods node.

[0212] For example, in Figure 3 The attack tree may also include attack method nodes, in which case each attack step node is connected to its corresponding attack method node. Figure 4 , Figure 4 It is a schematic diagram of another service level type attack tree provided in an embodiment of the present application. Figure 4 Compared to Figure 3 , the difference is Figure 4 The attack tree shown in the figure adds the "attack method node" level, such as Figure 4It can be seen that under the branch of the device node "IKM", the interface node "BLE" is connected to multiple attack method nodes, including "relay attack", "man-in-the-middle attack", "Btlejack", "brute force cracking", "reconnection mechanism", etc. Taking the attack method node "relay attack" as an example to describe the next level connection of the attack method node, the attack method node "relay attack" is connected to the attack step node "1. The attacker forwards the Bluetooth signal of the user that has been monitored; 2. The attacker controls the target device outside the Bluetooth communication distance". Here, in order to highlight Figure 4 and Figure 3 The difference, in Figure 4 The newly added attack method node is marked with a rectangular frame, which does not limit the presentation method of the attack method node in the attack tree.

[0213] Understandably, Figure 4 This is just an example of an attack tree for one service level type, but the attack tree that is not limited to a service level type is only Figure 4 For Figure 4 For some variations of the attack tree shown above, please refer to Figure 3 The relevant description of the embodiment will not be repeated here.

[0214] In some possible embodiments, there may be a verification process between multiple devices indicated by the data flow. In this case, the attack tree also includes an intermediate node corresponding to device node one, wherein the intermediate node is used to indicate that the damage scenario for achieving the target service requires device one to pass the verification of device two, device two is the device through which the data flow flows after device one, and device node one is connected to the root node through the intermediate node. Here, the intermediate node is used to indicate that the damage scenario for achieving the target service requires device one to pass the verification of device two, which can be understood as: the intermediate node corresponds to the condition that the damage scenario for achieving the target service requires the first device to pass the verification of the second device, or the intermediate node indicates or represents that the damage scenario for achieving the target service requires the first device to pass the verification of the second device. In some possible embodiments, the above-mentioned "the first device passes the verification of the second device" can also be described as "the first device bypasses the verification of the second device", that is, "the first device bypasses the verification of the second device" can be used as another explanation of the first device passing the verification of the second device.

[0215] For example, the data flow of the door control is used to indicate that the devices that implement the door control in sequence include IKM, VIU and DWS. Assuming that VIU (equivalent to device two) needs to verify the data of IKM (equivalent to device one), when the attack entry is IKM, after completing the attack on IKM, it is necessary to pass the VIU verification to achieve the damage scenario of door control integrity destruction. In the attack tree, the device node "IKM" is connected to the root node through the intermediate node "bypass VIU verification". Here, the intermediate node "bypass VIU verification" can also be understood as a post-condition that must be met when implementing the damage scenario of the target service through the device IKM. In some possible embodiments, the above "bypass VIU verification" can also be described as "pass VIU verification".

[0216] For another example, if only DWS among the devices IKM, VIU and DWS needs to verify the data of VIU, then in the attack tree, the device node "IKM" needs to be connected to the root node through the intermediate node "Bypass DWS Verification", and the device node "VIU" needs to be connected to the root node through the intermediate node "Bypass DWS Verification".

[0217] Further, assuming that VIU needs to verify the data of IKM and DWS needs to verify the data of VIU, then in the above Figure 3 Based on this, we can add intermediate nodes to the branch where the corresponding device node is located, and the generated attack tree can be Figure 5 See Figure 5 , Figure 5 FIG. 1 is a schematic diagram of another attack tree of a service level type provided in an embodiment of the present application. Figure 3 , Figure 5 The attack tree shown has the "Intermediate Node" level added.

[0218] exist Figure 5 In the figure, there are two intermediate nodes between the device node "IKM" and the root node, namely "Bypass VIU Verification" and "Bypass DWS Verification", that is, the device node "IKM" is connected to the root node through the intermediate node "Bypass VIU Verification" and the intermediate node "Bypass DWS Verification" in turn; there is an intermediate node "Bypass DWS Verification" between the device node "VIU" and the root node, that is, the device node "VIU" is connected to the root node through the intermediate node "Bypass DWS Verification". It can be seen that Figure 5 The device node "DWS" is directly connected to the root node. This is because the device DWS is the last device that the data flow passes through, and no other device needs to verify it. Therefore, there is no intermediate node between the device node "DWS" and the root node. It can be understood that in order to highlight Figure 5 The intermediate nodes in the attack tree are marked with rectangular boxes, which should not limit the presentation of the intermediate nodes in the attack tree. Figure 5The attack tree shown is consistent with industry best practices, which illustrates the rationality of the generated attack tree.

[0219] Understandably, Figure 5 This is just an example of an attack tree for one service level type, but the attack tree that is not limited to a service level type is only Figure 5 For Figure 5 For some variations of the attack tree shown above, please refer to Figure 3 The relevant description of the embodiment will not be repeated here.

[0220] Optionally, in some possible embodiments, the following S203 may also be performed:

[0221] S203: Control display of the attack tree.

[0222] Exemplarily, the execution entity (e.g. Figure 1 If the processing device) is connected to a display, then controlling the display of the attack tree should be: controlling the display to display the attack tree.

[0223] Exemplarily, the execution entity (e.g. Figure 1 If the processing device is integrated with a display, the control of displaying the attack tree should be: displaying the attack tree through the display.

[0224] Here, the display may be a display screen, and the display screen may be a liquid crystal display (LCD), an organic or inorganic light-emitting diode (OLED), an active matrix / organic light-emitting diode panel (AMOLED), etc.

[0225] Here, the attack tree displayed on the display may be, for example, the above Figure 3 or Figure 4 or Figure 5 The attack tree shown in Figure 1. Figure 4 For example, by Figure 4 It can be seen that the attack tree has a total of six levels, among which the first level is used to present the root node, the second level is used to present the device nodes connected to the root node, the third level is used to present the threat scenario nodes connected to the device nodes, the fourth level is used to present the interface nodes connected to the threat scenario nodes, the fifth level is used to present the attack method nodes connected to the interface nodes, and the sixth level is used to present the attack step nodes connected to the attack method nodes.

[0226] Understandably, Figure 4This is only an example of displaying an attack tree of a service level type, and should not be used to limit the display of attack trees of service level types. Figure 4 The text descriptions of the leftmost nodes at each level can be removed, for example, or Figure 4 The attack method node level can be deleted (that is, it is displayed as above Figure 3 ), or Figure 4 The attack step node level can be deleted, or Figure 4 You can add an intermediate node (that is, the node shown above) between the root node shown in the first level and the device node shown in the second level. Figure 5 ), or Figure 4 The threat scenario node and the interface node can also exchange the hierarchical position (that is, the interface node is at the third level and the threat scenario node is at the fourth level), or other Figure 4 The deformation form of the attack tree shown is not specifically limited here.

[0227] It can be seen that the attack tree of the service, function or business is generated based on the data flow. The generation logic of the attack tree provided can not only realize the rapid and automatic generation of the attack tree of the function, service or business, but also make the generated attack tree more complete, intuitive and clear.

[0228] In the embodiment of the present application, not only is provided Figure 2 The method for generating the service-level attack tree shown in the embodiment can also provide a method for generating a device-level attack tree and an interface-level attack tree. Figure 6 , Figure 6 is a flowchart of another attack tree generation method provided in an embodiment of the present application, which can be applied to Figure 1 The processing device shown. The method includes but is not limited to the following steps:

[0229] S601: Indicating to a user the type of the attack tree to be established, where the type includes at least one of a service level, a device level, and an interface level.

[0230] Exemplarily, indicating to the user the type of the attack tree to be established includes: indicating to the user the type of the attack tree to be established through a human-computer interaction interface.

[0231] Here, the user can be a user of network security tools, such as a network security developer, a white hat hacker, etc.

[0232] See also Figure 7 , Figure 7 is a schematic diagram of a human-computer interaction interface provided in an embodiment of the present application. Figure 7 It can be seen that Figure 7A setting interface for an attack tree is shown, which includes an attack tree type selection interface and a configuration information interface for the corresponding type of attack tree. The attack tree type selection interface includes check boxes for selectable types (including service level, device level, and interface level). For example, when the user selects "Service Level", the attack tree setting interface presents a configuration information interface for the corresponding type of attack tree as a "Service Level-Configuration Information" interface, wherein the "Service Level-Configuration Information" interface includes an input box for the target service, an input box for the data flow, and an input box for the verification process between devices. Here, the target service can refer to the above Figure 2 The relevant description of the target service in Example S201 is not repeated here.

[0233] As you can see, Figure 3 The interface shown also has a "Cancel" key, a "Clear" key and a "Confirm" key, wherein the "Cancel" key indicates closing the current interface, the "Clear" key indicates a request to clear the user's setting information on the current interface, and the "Confirm" key indicates saving the user's setting information on the current interface.

[0234] Understandably, Figure 7 The attack tree setting interface shown is only an example, and does not limit the setting interface that provides the type selection of the attack tree to only Figure 7 In some possible embodiments, Figure 7 It can also be split into multiple display interfaces, for example, the above-mentioned attack tree type selection interface and the corresponding type of attack tree configuration information interface are displayed separately through two interfaces. In some possible embodiments, Figure 7 More or less information than currently shown may also be displayed.

[0235] For example, not limiting Figure 7 The interface shown provides three types of options. In some possible embodiments, only two or one type may be provided for the user to choose.

[0236] For example, Figure 7 The input box for the verification process between devices is optional. For example, if there is no verification process between any two devices among the multiple devices indicated by the data flow, Figure 7 The input box for the verification process between devices can be deleted.

[0237] For example, in Figure 7 In the example, the input box of the target service and the input box of the data flow can also be merged. For example, the input box of the target service is merged into the input box of the data flow, that is, the input box of the data flow can input not only the target service but also multiple devices that flow through in sequence to realize the target service.

[0238] For example, Figure 7 The "Service Level - Configuration Information" interface may also include at least one of an input box for the device's interface, an input box for the target service's damage scenario, an input box for the threat scenario corresponding to the damage scenario, an input box for the attack method corresponding to the device's interface, and an input box for the attack steps corresponding to the attack method.

[0239] Understandably, Figure 7 In the example, if the type of attack tree selected by the user is different, then Figure 7 The configuration information interface of the corresponding type of attack tree presented on the right side of the interface is different.

[0240] For example, when the user selects the attack tree type as "device level", the configuration information interface of the device-level attack tree includes at least an input box for the target device. Here, the target device can be any device that the user needs to perform network security analysis on through the attack tree. The target device can refer to the above Figure 2 Related description of device 1 in embodiment S202. In some possible embodiments, the target device may also be a device in the above data stream.

[0241] For another example, when the user selects the attack tree type as "interface level", the configuration information interface of the interface-level attack tree includes at least an input box for the target interface. Here, the target interface can be any interface that the user needs to perform network security analysis on through the attack tree. The interface can be a physical interface or a software interface. The target interface can refer to the above Figure 2 The interface of device 1 in embodiment S202 is described in detail. In some possible embodiments, the target interface may also be the interface of the device in the above data flow.

[0242] S602: Receive user setting information.

[0243] In one implementation, receiving the user's setting information includes:

[0244] Get the setting information entered by the user through the touch screen;

[0245] Get the setting information entered by the user through the button;

[0246] Get the setting information entered by the user through the keyboard;

[0247] Get the setting information input by the user through voice; or

[0248] Get the setting information entered by the user through gestures.

[0249] The setting information indicates the type of attack tree selected by the user.

[0250] Exemplarily, when the setting information indicates to establish an attack tree of a service level type, the setting information also includes a data flow, wherein the data flow is used to indicate a plurality of devices through which the target service flows in sequence.

[0251] Exemplarily, when the setting information indicates to establish a device-level attack tree, the setting information further includes identification information of the target device.

[0252] Exemplarily, when the setting information indicates to establish an interface-level attack tree, the setting information further includes identification information of the target interface.

[0253] The following is based on Figure 7 The following is an example of a user inputting corresponding setting information through a touch screen. Figure 7 In the example, it is assumed that the user selects the type of attack tree as "service level". In response to this selection, the "service level-configuration information" interface is presented on the right. On the "service level-configuration information" interface, the user enters "door control" in the input box of the target service and "device_IKM, device_VIU and device_DWS" in the input box of the data flow, but does not fill in the input box of the verification process between devices. After completing the above operations, click the "confirm" button. In this case, the user's setting information obtained includes that the type of attack tree to be established is service level, the target service is door control, and the multiple devices through which the data flow flows include device_IKM, device_VIU and device_DWS.

[0254] S603: Generate an attack tree according to the setting information.

[0255] Wherein, when the setting information indicates to establish an attack tree of a service level type, the setting information also includes a data flow, wherein the data flow is used to indicate a plurality of devices through which the target service flows in sequence, in which case the attack tree includes a plurality of device nodes, each of which is used to indicate one of the plurality of devices. Here, different device nodes indicate different devices.

[0256] In an embodiment of the present application, when the device information indicates the establishment of an attack tree of a service level type, the attack tree also includes at least one interface node one corresponding to the device node one, and for each interface node one, the attack tree also includes at least one attack method node one corresponding to the interface node one and at least one attack step node one corresponding to the interface node one; wherein, the device node one belongs to the above-mentioned multiple device nodes, the device node one is used to indicate the device one among the above-mentioned multiple devices, the interface node one is used to indicate the interface of the device one, the attack step node one is used to indicate the attack step implemented through the interface of the device one, and the attack method node one is used to indicate the attack method to which the attack step implemented through the interface of the device one belongs.

[0257] Exemplarily, in the attack tree of the service level type, device node 1 is respectively connected to at least one interface node 1 corresponding to device node 1. For each interface node 1 connected to device node 1, the interface node 1 is respectively connected to at least one attack step node 1 corresponding to the interface node 1, or the interface node 1 is respectively connected to at least one attack method node 1 corresponding to the interface node 1.

[0258] In one implementation, the attack tree also includes at least one threat scenario node one corresponding to the device node one, wherein the threat scenario node one is used to indicate a threat scenario of the target service.

[0259] Exemplarily, threat scenario node one is respectively connected to device node one and at least one interface node one corresponding to device node one; or, threat scenario node one is respectively connected to an interface node one corresponding to device node one and at least one attack method node one; or, threat scenario node one is respectively connected to an interface node one corresponding to device node one and at least one attack step node one.

[0260] In one implementation, the attack tree further includes a root node 1, wherein the root node 1 is used to indicate a damage scenario of the target service. Further, the root node 1 is connected to the above-mentioned multiple device nodes respectively.

[0261] In one implementation, the user may also be asked whether verification exists between multiple devices indicated by the data flow; feedback information is received, the feedback information indicating that device two among the multiple devices verifies device one, wherein device two is the device through which the data flow flows after device one; in this case, in the attack tree, device node one is connected to root node one through an intermediate node, root node one is used to indicate a damage scenario for the target service, and the intermediate node is used to indicate that the damage scenario for realizing the target service requires the first device to pass the verification of the second device.

[0262] For example, Figure 7 In the attack tree setting interface, the input box of "Verification process between devices" is displayed to ask the user whether there is verification between the multiple devices indicated by the data flow. If there is verification, the user will enter the corresponding information in the input box of "Verification process between devices", and the information is, for example, "VIU verifies IKM, and DWS verifies VIU". Accordingly, the connection method between the device node and the root node in the generated attack tree can refer to the above Figure 5 The device node is connected to the root node through the intermediate node.

[0263] It can be understood that when the setting information indicates to establish an attack tree of a service level type, the attack tree of the service level type can refer to the above Figure 2 For the sake of brevity of the specification, the description of the attack tree in the embodiment will not be repeated here.

[0264] In an embodiment of the present application, when the device information indicates the establishment of an attack tree of a device-level type, the attack tree includes at least one interface node two, and for each interface node two, the attack tree also includes at least one attack method node two corresponding to the interface node two and at least one attack step node two corresponding to the interface node two; wherein the interface node two is used to indicate the interface of the target device, the attack step node two is used to indicate the attack step implemented through the interface of the target device, and the attack method node two is used to indicate the attack method to which the attack step belongs implemented through the interface of the target device.

[0265] Here, the interface node 2 is used to indicate the interface of the target device, which can be understood as: the interface node 2 corresponds to the interface of the target device, or the interface node 2 represents or indicates the interface of the target device.

[0266] Attack step node two is used to indicate the attack step implemented through the interface of the target device, which can be understood as: attack step node two corresponds to the attack step implemented through the interface of the target device, or attack step node two represents or indicates the attack step implemented by the interface of the target device.

[0267] Attack method node two is used to indicate the attack method to which the attack step is implemented through the interface of the target device. It can be understood that: attack method node two corresponds to the attack method to which the attack step is implemented through the interface of the target device, or attack method node two represents or indicates the attack method to which the attack step is implemented through the interface of the target device.

[0268] Here, the target device can be any device that the user needs to perform network security analysis on through the attack tree, for example, the target device is the device in the above data stream. The target device can be a network side device, a terminal device, or a component in these devices (such as a chip, a device, etc.). Among them, the network side device can be, for example, a computing device deployed on the network side (such as a server). The terminal device can be, for example, an intelligent transportation device (such as a car, a ship, a drone, a train, a truck, a truck, etc.), an intelligent home device (such as a TV, a sweeping robot, an intelligent desk lamp, an audio system, an intelligent lighting system, an electrical control system, home background music, a home theater system, an intercom system, a video surveillance system, etc.), an intelligent manufacturing device (such as a robot, an industrial equipment, an intelligent logistics, an intelligent factory, etc.), a user device (such as a mobile phone, a computer, a tablet computer, a PDA, a desktop, a headset, an audio system, a wearable device, a vehicle-mounted device, a virtual reality device, an augmented reality device, etc.), etc.

[0269] Here, the attack method and attack steps can be referred to Figure 2 The description of the corresponding contents in Example S202 will not be repeated here.

[0270] Exemplarily, the interface node 2 is connected to at least one attack step node 2 corresponding to the interface node 2, or the interface node 2 is connected to at least one attack method node 2 corresponding to the interface node 2.

[0271] It can be understood that the attack method node 2 corresponds to the attack step node 2 one-to-one. In the case where the attack tree includes the attack step node 2 and the attack method node 2, assuming that the interface node 2 is connected to at least one attack step node 2 corresponding to the interface node 2, then each attack step node 2 is also connected to the attack method node 2 corresponding to the attack step node 2; assuming that the interface node 2 is connected to at least one attack method node 2 corresponding to the interface node 2, then each attack method node 2 is also connected to the attack step node 2 corresponding to the attack method node 2.

[0272] In one implementation, the attack tree further includes a root node 2, which is used to indicate a damage scenario of the target device, wherein the root node 2 is respectively connected to the at least one interface node 2. Here, the root node 2 is used to indicate a damage scenario of the target device, which can be understood as: the root node 2 corresponds to the damage scenario of the target device, or the root node 2 represents or indicates the damage scenario of the target device.

[0273] In one implementation, the attack tree further includes at least one threat scenario node 2 corresponding to the interface node 2, wherein the threat scenario node 2 is used to indicate the threat scenario of the target device. Here, the threat scenario node 2 is used to indicate the threat scenario of the target device, which can be understood as: the threat scenario node 2 corresponds to the threat scenario of the target device, or the threat scenario node 2 represents or indicates the threat scenario of the target device.

[0274] Here, the threat scenario of the target device is related to the damage scenario of the target device. For example, the threat scenario of the target device is used to describe the potential cause of the damage scenario of the target device, and can also be understood as the potential cause of the threat to the network security attribute of the target device.

[0275] Exemplarily, one damage scenario may correspond to at least one threat scenario, and one threat scenario may correspond to at least one damage scenario. Different damage scenarios may correspond to different threat scenarios.

[0276] For example, in the device-level attack tree, for any threat scenario node 2, the connection mode of the threat scenario node 2 may be any of the following:

[0277] Mode 1: The threat scenario node 2 is respectively connected to an interface node 2 and at least one of the above attack step nodes 2.

[0278] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the interface node and the attack step node.

[0279] It can be understood that, considering that the attack step is related to the two factors of the interface of the device and the threat scenario of the device, for the threat scenario node 2 connected to the same interface node 2 in the attack tree, the attack step node 2 connected to different threat scenario nodes 2 may be different. Here, the attack step node 2 connected to the threat scenario node 2 may be part or all of the at least one attack step node 2.

[0280] Mode 2: The threat scenario node 2 is respectively connected to an interface node 2 and at least one of the above-mentioned attack method nodes 2.

[0281] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the interface node and the attack method node.

[0282] It can be understood that the attack method is also related to the two factors of the device interface and the device threat scenario. For the threat scenario node 2 connected to the same interface node 2 in the attack tree, the attack method node 2 connected to different threat scenario nodes 2 may be different. Here, the attack method node 2 connected to the threat scenario node 2 can be part or all of the at least one attack method node 2 mentioned above.

[0283] Mode 3: Threat scenario node 2 is respectively connected to root node 2 and at least one interface node 2, wherein root node 2 is used to indicate a damage scenario of a target device.

[0284] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the root node and the interface node. In the attack tree, different threat scenario nodes 2 are connected to the same interface node 2, that is, they are all connected to at least one interface node 2 corresponding to the target device.

[0285] See also Fig. 8A , Fig. 8A Schematic diagram of a device-level attack tree provided in an embodiment of the present application. Assume that the target device is an IKM, that is, Fig. 8A The attack tree of the device IKM is shown. Fig. 8AIt can be seen that the root node “IKM integrity destruction” is connected to the threat scenario node “S”, the threat scenario node “T” and the threat scenario node “E” respectively. The threat scenario node “S” is taken as an example to describe the next-level connection of the threat scenario node in the attack tree. The threat scenario node “S” is connected to the interface node “BLE”, the interface node “JTAG”, the interface node “CAN” and the interface node “UDS on CAN” respectively. The interface node “BLE” is taken as an example to describe the next-level connection of the interface node in the attack tree. The interface node “BLE” is connected to the attack method node “Relay Attack”, the attack method node “Man-in-the-Middle Attack”, the attack method node “Btlejack”, the attack method node “Brute Force Cracking” and the attack method node “Reconnection Mechanism”. The attack method node “Relay Attack” is taken as an example to describe the next-level connection of the attack method node in the attack tree. The attack method node “Relay Attack” is connected to the attack step node “1. The attacker forwards the Bluetooth signal of the user that has been monitored; 2. The attacker controls the target device outside the Bluetooth communication distance”.

[0286] Understandably, Fig. 8A This is just an example of a device-level attack tree, but the attack tree is not limited to device-level types. Fig. 8A In the form shown. Fig. 8A In order to clearly present the attack tree, only one branch in the attack tree is shown in detail based on the connection mode of root node-threat scenario node-interface node-attack method node-attack step node. Fig. 8A The omission of other branches in the attack tree should not limit the presentation of other branches in the attack tree, and other branches can also be presented in detail using the presentation method of the aforementioned branches.

[0287] For example, when generating Fig. 8A When the attack tree of the device level type shown is established, the root node is first established; then the connection between the root node and the threat scenario node is established based on the correspondence between the threat scenario in the knowledge base and the damage scenario of the target device indicated by the root node; then the connection between the threat scenario node and the interface node is established based on the correspondence between the target device and the interface in the knowledge base; then the connection between the interface node and the attack method node is established based on the correspondence between the attack method and the interface of the device and the threat scenario in the knowledge base; finally, the connection between the attack method node and the attack step node is established based on the correspondence between the attack method and the attack step in the knowledge base. Here, the knowledge base can refer to the description of the corresponding content in the above embodiment, which will not be repeated here.

[0288] Understandably, for Fig. 8A The attack tree shown can be varied in many ways.

[0289] For example, in Fig. 8A In the example, you can delete the root node level, the threat scenario node level, the attack method node level, or the attack step node level.

[0290] For example, in Fig. 8A In the example, the level where the attack method node is located can be swapped with the level where the attack step node is located.

[0291] For example, in Fig. 8A In the embodiment, the threat scenario node is not limited to being set only between the root node and the interface node. In some possible embodiments, the threat scenario node can also be set between the interface node and the attack method node, that is, the threat scenario node is directly connected to the interface node upward and directly connected to the attack method node downward; or, the threat scenario node can also be set between the interface node and the attack step node, that is, the threat scenario node is directly connected to the interface node upward and directly connected to the attack step node downward.

[0292] In an embodiment of the present application, when the device information indicates the establishment of an interface level type attack tree, the attack tree includes at least one attack step node three and at least one attack method node three; wherein the attack step node three is used to indicate the attack step implemented through the target interface, and the attack method node three is used to indicate the attack method to which the attack step implemented through the target interface belongs.

[0293] Here, the attack step node three is used to indicate the attack step implemented through the target interface, which can be understood as: the attack step node three corresponds to the attack step implemented through the target interface, or the attack step node three represents or indicates the attack step implemented through the target interface.

[0294] Attack method node three is used to indicate the attack method to which the attack step implemented through the target interface belongs, which can be understood as: attack method node three corresponds to the attack method to which the attack step implemented through the target interface belongs, or attack method node three represents or indicates the attack method to which the attack step implemented through the target interface belongs.

[0295] Here, the target interface can be any interface that the user needs to perform network security analysis on through the attack tree. For example, the target interface can be the interface of the device in the above data flow. The target interface can be a physical interface or a software interface. The target interface can refer to the above Figure 2 The description related to the interface of device 1 in Example S202 will not be repeated here.

[0296] In one implementation, the attack tree further includes a root node 3, wherein the root node 3 is used to indicate the damage scenario of the target interface, wherein the root node 3 is respectively connected to the at least one attack step node 3, or the root node 3 is respectively connected to the at least one attack method node 3. Here, the root node 3 is used to indicate the damage scenario of the target interface, which can be understood as: the root node 3 corresponds to the damage scenario of the target interface, or the root node 3 represents or indicates the damage scenario of the target interface.

[0297] In one implementation, the attack tree also includes at least one threat scenario node three, wherein the threat scenario node three is used to indicate the threat scenario of the target interface. Here, the threat scenario and damage scenario can refer to the description of the corresponding content above, and will not be repeated here. Here, the threat scenario node three is used to indicate the threat scenario of the target interface, which can be understood as: the threat scenario node three corresponds to the threat scenario of the target interface, or the threat scenario node three represents or indicates the threat scenario of the target interface.

[0298] Exemplarily, the threat scenario node three is set at the last layer of the attack tree, and for any attack method node three in the attack tree, the attack method node three is respectively connected to at least one of the above-mentioned threat scenario nodes three. Here, the threat scenario nodes three connected to different attack method nodes three may be different, so the threat scenario node three connected to the attack method node three may be part or all of the nodes in the above-mentioned at least one threat scenario node three.

[0299] Exemplarily, the threat scenario node three is set at the last layer of the attack tree, and for any attack step node three in the attack tree, the attack step node is respectively connected to at least one of the above-mentioned threat scenario nodes three. Here, the threat scenario nodes three connected to different attack step nodes three may be different, so the threat scenario node three connected to the attack step node three may be part or all of the above-mentioned at least one threat scenario node three.

[0300] Exemplarily, the threat scenario node three may not be set at the last layer of the attack tree. In this case, for any threat scenario node three, the connection mode of the threat scenario node three may be any one of the following:

[0301] Mode 1: Threat scenario node three is respectively connected to root node three and at least one of the above attack method nodes three.

[0302] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the root node and the attack method node. In the attack tree, different threat scenario nodes three may be connected to different attack method nodes three, so the attack method node three connected to the threat scenario node three may be part or all of the nodes in the at least one attack method node three.

[0303] Mode 2: Threat scenario node three is respectively connected to root node three and at least one of the above attack step nodes three.

[0304] In this case, from the hierarchical relationship of the attack tree, the threat scenario node is set between the root node and the attack step node. In the attack tree, different threat scenario nodes three may be connected to different attack step nodes three, so the attack step node three connected to the threat scenario node three may be part or all of the nodes in the at least one attack step node three.

[0305] See also Figure 8B , Figure 8B Schematic diagram of an interface-level attack tree provided in an embodiment of the present application. Assume that the target interface is BLE, that is, Figure 8B Figure 1 shows the attack tree for the BLE interface. Figure 8B It can be seen that the root node “BLE integrity destruction” is connected to the threat scenario node “S”, the threat scenario node “T” and the threat scenario node “E” respectively. The threat scenario node “S” is taken as an example to describe the next level connection of the threat scenario node in the attack tree. The threat scenario node “S” is connected to the attack method node “relay attack”, the attack method node “man-in-the-middle attack”, the attack method node “Btlejack”, the attack method node “brute force cracking” and the attack method node “reconnection mechanism” respectively. The attack method node “relay attack” is taken as an example to describe the next level connection of the attack method node in the attack tree. The attack method node “relay attack” is connected to the attack step node “1. The attacker forwards the Bluetooth signal of the user that has been monitored; 2. The attacker controls the target device outside the Bluetooth communication distance”.

[0306] Understandably, Figure 8B This is just an example of an interface-level attack tree, but it does not limit the interface-level attack tree to only Figure 8B In the form shown. Figure 8B In order to clearly present the attack tree, only one branch in the attack tree is shown in detail based on the connection mode of root node-threat scenario node-attack method node-attack step node. Figure 8B The omission of other branches in the attack tree should not limit the presentation of other branches in the attack tree, and other branches can also be presented in detail using the presentation method of the aforementioned branches.

[0307] For example, when generating Figure 8BWhen an attack tree of the interface level type is shown, a root node is first established; then a connection is established between the root node and the threat scenario node based on the correspondence between the threat scenario in the knowledge base and the damage scenario of the target interface indicated by the root node; then a connection is established between the threat scenario node and the attack method node based on the correspondence between the attack method in the knowledge base and the target interface and the threat scenario; finally, a connection is established between the attack method node and the attack step node based on the correspondence between the attack method and the attack step in the knowledge base. Here, the knowledge base can refer to the description of the corresponding content in the above embodiment, which will not be repeated here.

[0308] Understandably, for Figure 8B The attack tree shown can be varied in many ways.

[0309] For example, in Figure 8B In the example, you can delete the root node level, the threat scenario node level, the attack method node level, or the attack step node level.

[0310] For example, in Figure 8B In the example, the level where the attack method node is located can be swapped with the level where the attack step node is located.

[0311] For example, in Figure 8B In the present invention, it is not limited that the threat scenario node can only be set between the root node and the attack method node. In some possible embodiments, the threat scenario node can also be set between the root node and the attack step node, that is, the threat scenario node is directly connected to the root node upward and directly connected to the attack step node downward; or, the threat scenario node can also be set at the last layer of the attack tree, which is not specifically limited here.

[0312] S604: Control display of the attack tree.

[0313] For example, based on Figure 7 After the attack tree setting interface obtains the setting information input by the user, an attack tree is generated and displayed. Further, the attack tree of the service level type can be, for example, the above Figure 3 , Figure 4 or Figure 5 As shown, the device-level attack tree can be, for example, Fig. 8A As shown, the interface level attack tree can be, for example, Figure 8B shown.

[0314] Here, the display process of the attack tree can be referred to Figure 2 The description of Example S203 is not repeated here.

[0315] It can be seen that a manual interaction interface is provided to display multiple types of attack trees to users, supporting users to independently select the type of attack tree to be established. The user's setting information for the attack tree is input through human-computer interaction, and the corresponding type of attack tree is automatically generated based on the setting information. This is not only conducive to improving the generation efficiency of the attack tree, but also can meet the application requirements of the attack tree in different scenarios.

[0316] In the implementation of this application, Figure 1 The processing device shown can be implemented by hardware, software or a combination of hardware and software.

[0317] For example, Figure 1 The processing device shown can be used to implement Figure 2 The method described in the embodiment. Figure 2 In the embodiment, the receiving module may be used to execute S201, and the processing module may be used to execute S202 and S203.

[0318] For example, Figure 1 The processing device shown can also be used to implement Figure 6 The method described in the embodiment. Figure 2 In the embodiment, the display module may be used to execute S601, the receiving module may be used to execute S602, and the processing module may be used to execute S603 and S604.

[0319] It should be understood that the above Figure 1The division of the modules in the processing device shown is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. In addition, the modules in the device can be implemented in the form of a processor calling software; for example, the device includes a processor, the processor is connected to a memory, the memory stores instructions, and the processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of the modules of the device, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory inside the device or a memory outside the device. Alternatively, the modules in the device can be implemented in the form of hardware circuits, and the functions of some or all modules can be realized by designing the hardware circuits, and the hardware circuits can be understood as one or more processors; for example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC), and the functions of some or all modules above are realized by designing the logical relationship of the components in the circuit; for another example, in another implementation, the hardware circuit can be realized by a programmable logic device (PLD), taking a field programmable gate array (FPGA) as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by configuring the configuration file, so as to realize the functions of some or all modules above. All modules of the above devices can be realized in the form of a processor calling software, or in the form of hardware circuits, or in part by a processor calling software, and the rest by hardware circuits.

[0320] In the embodiment of the present application, the processor is a circuit with signal processing capability. In one implementation, the processor can be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP), etc.; in another implementation, the processor can realize certain functions through the logical relationship of the hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by a processor as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the processor loads a configuration document to implement the process of hardware circuit configuration, which can be understood as the process of the processor loading instructions to implement the functions of some or all of the above modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0321] It can be seen that each module in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0322] In addition, the modules in the above device can be fully or partially integrated together, or can be implemented independently. In one implementation, these modules are integrated together and implemented in the form of a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of the modules of the device. The type of the at least one processor may be different, for example, including a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0323] See also Fig. 9 , Fig. 9 Schematic diagram of a computing device provided in an embodiment of the present application. Fig. 9As shown, the computing device 40 includes: a processor 401, a communication interface 402, a memory 403 and a bus 404. The processor 401, the memory 403 and the communication interface 402 communicate with each other via the bus 404. It should be understood that the present application does not limit the number of processors and memories in the computing device 40.

[0324] In one implementation, the computing device 40 may be a network-side device or a component in a network-side device (e.g., a chip or an integrated circuit, etc.). The network-side device may be, for example, a computing device deployed on the network side (e.g., a server for generating an attack tree). The network-side device may be deployed in a cloud environment or an edge environment, which is not specifically limited herein.

[0325] The bus 404 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 The bus 404 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 404 may include a path for transmitting information between various components of the computing device 40 (eg, the memory 403, the processor 401, and the communication interface 402).

[0326] The processor 401 can refer to the related description of the processor in the above embodiment, which will not be repeated here.

[0327] The memory 403 is used to provide a storage space, and the storage space can store data such as an operating system and a computer program. The memory 403 can be a random access memory (RAM), an erasable programmable read only memory (EPROM), a read-only memory (ROM), or a portable read-only memory (CD-ROM), etc., or a combination of multiple types. The memory 403 can exist alone or be integrated into the processor 401.

[0328] The communication interface 402 may be used to provide information input or output for the processor 401. Alternatively, the communication interface 402 may be used to receive data sent externally and / or send data externally, and may be a wired link interface such as an Ethernet cable, or a wireless link interface (such as Wi-Fi, Bluetooth, general wireless transmission, etc.). Alternatively, the communication interface 402 may also include a transmitter (such as a radio frequency transmitter, an antenna, etc.) coupled to the interface, or a receiver, etc.

[0329] In some possible embodiments, when the computing device 40 further includes a display 405. The display 405 is connected or coupled to the processor 401 via a bus 404. The display 405 can be used to indicate to the user the type of attack tree to be established and to display the generated attack tree. The display 405 can be a display screen, and the display screen can be a liquid crystal display (LCD), an organic or inorganic light-emitting diode (OLED), an active matrix organic light-emitting diode panel (AMOLED), etc.

[0330] The processor 401 in the computing device 40 is used to read the computer program stored in the memory 403 to execute the aforementioned method, for example Figure 2 or Figure 6 The described attack tree generation method.

[0331] In one possible design, the computing device 40 may be a processor for executing Figure 2 The processor 401 may be used to read one or more computer programs stored in the memory to perform the following operations:

[0332] Acquire a data stream through a receiving module, where the data stream is used to indicate multiple devices that flow sequentially to achieve a target service;

[0333] An attack tree is generated according to the data stream, wherein the attack tree includes a plurality of device nodes, and each of the plurality of device nodes is used to indicate one device among the plurality of devices.

[0334] In one possible design, the computing device 40 may be a processor for executing Figure 6 The processor 401 may be used to read one or more computer programs stored in the memory to perform the following operations:

[0335] Indicating to a user, through a display module, a type of attack tree to be established, the type comprising at least one of a service level, a device level, and an interface level;

[0336] By receiving the setting information of the user of the module interface;

[0337] Generate an attack tree according to the setting information; and control the display of the attack tree.

[0338] In the above-mentioned embodiments of this invention, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. In addition, in the various embodiments of this application, if there is no special explanation and logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other. The technical features in different embodiments can be combined to form a new embodiment according to their internal logical relationship.

[0339] It should be noted that, a person skilled in the art can see that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electrically-erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0340] The essence of the technical solution of the present application or the part that makes the contribution or all or part of the technical solution can be embodied in the form of a software product. The computer program product is stored in a storage medium and includes a number of instructions for enabling a device (which can be a personal computer, a server, or a network device, a robot, a single-chip microcomputer, a chip, a robot, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.

Claims

1. A method for generating an attack tree, characterized in that: The method comprises: Acquire a data stream, where the data stream is used to indicate a plurality of devices through which a target service is sequentially passed; An attack tree is generated according to the data flow, wherein the attack tree includes a plurality of device nodes, and each of the plurality of device nodes is used to indicate one device among the plurality of devices.

2. The method according to claim 1, characterized in that The method further comprises: Controls display of the attack tree.

3. The method according to claim 1 or 2, characterized in that: The attack tree further includes at least one interface node corresponding to the first device node, and the attack tree further includes at least one of at least one attack method node corresponding to the interface node and at least one attack step node corresponding to the interface node; Among them, the first device node belongs to the multiple device nodes, the first device node indicates a first device among the multiple devices, the interface node is used to indicate a first interface of the first device, the attack step node is used to indicate an attack step implemented through the first interface, and the attack method node is used to indicate an attack method to which the attack step implemented through the first interface belongs.

4. The method according to claim 3, characterized in that: The first device node is connected to the at least one interface node, and the interface node is connected to the at least one attack step node or the at least one attack method node.

5. The method according to claim 3 or 4, characterized in that: The attack tree also includes at least one threat scenario node corresponding to the first device node, wherein the threat scenario node is used to indicate a threat scenario of the target service.

6. The method according to claim 5, characterized in that The threat scenario node is connected to the first device node and the at least one interface node respectively; or, The threat scenario node is connected to the interface node and at least one of the attack method nodes respectively; or, The threat scenario node is connected to the interface node and at least one of the attack step nodes respectively.

7. The method according to any one of claims 1 to 6, characterized in that: The attack tree also includes a root node, which is connected to the multiple device nodes respectively, and the root node is used to indicate a damage scenario of the target service.

8. The method according to claim 7, characterized in that The attack tree also includes an intermediate node corresponding to the first device node, and the intermediate node is used to indicate that the damage scenario for implementing the target service requires the first device to pass verification by a second device, and the second device is a device through which the data flow flows after the first device, and the first device node is connected to the root node through the intermediate node.

9. A method for generating an attack tree, characterized in that: The method comprises: Indicating to a user the type of attack tree to be established, the type comprising at least one of a service level, a device level, and an interface level; Receiving setting information of the user; Generate the attack tree according to the setting information; wherein, when the setting information indicates to establish the attack tree of the service level type, the setting information also includes a data flow, the data flow is used to indicate a plurality of devices through which the target service flows in sequence, the attack tree includes a plurality of device nodes, and each of the plurality of device nodes is used to indicate one of the plurality of devices; Controls display of the attack tree.

10. The method according to claim 9, characterized in that When the setting information indicates to establish an attack tree of the service level type, the attack tree further includes at least one first interface node corresponding to the first device node, and the attack tree further includes at least one of at least one first attack method node corresponding to the first interface node and at least one first attack step node corresponding to the first interface node; Among them, the first device node belongs to the multiple device nodes, the first device node indicates a first device among the multiple devices, the first interface node is used to indicate a first interface of the first device, the first attack step node is used to indicate an attack step implemented through the first interface, and the first attack method node is used to indicate an attack method to which the attack step implemented through the first interface belongs.

11. The method according to claim 10, characterized in that The first device node is connected to the at least one first interface node, and the first interface node is connected to the at least one first attack step node or the at least one first attack method node.

12. The method according to claim 10 or 11, characterized in that: The attack tree also includes at least one first threat scenario node corresponding to the first device node, wherein the first threat scenario node is used to indicate a threat scenario of the target service.

13. The method according to claim 12, characterized in that The first threat scenario node is connected to the first device node and the at least one first interface node respectively; or, The first threat scenario node is connected to the first interface node and at least one of the first attack method nodes respectively; or, The first threat scenario node is connected to the first interface node and at least one of the first attack step nodes respectively.

14. The method according to any one of claims 9 to 13, characterized in that: The attack tree also includes a first root node, which is used to indicate a damage scenario of the target service, and the first root node is connected to the multiple device nodes respectively.

15. The method according to any one of claims 9 to 14, characterized in that: The method further comprises: Asking the user whether there is verification between the multiple devices; receiving feedback information, where the feedback information instructs a second device among the multiple devices to verify the first device, where the second device is a device through which the data flow flows after the first device; In the attack tree, the first device node is connected to the first root node through an intermediate node, the first root node is used to indicate a damage scenario for the target service, and the intermediate node is used to indicate that the damage scenario for achieving the target service requires the first device to pass verification by the second device.

16. The method according to claim 9, characterized in that When the setting information indicates to establish the attack tree of the device level type, the attack tree includes the at least one second interface node, and the attack tree also includes at least one of at least one second attack method node corresponding to the second interface node and at least one second attack step node corresponding to the second interface node; Among them, the second interface node is used to indicate the second interface of the target device, the second attack step node is used to indicate the attack step implemented through the second interface, and the second attack method node is used to indicate the attack method to which the attack step implemented through the second interface belongs.

17. The method according to claim 16, characterized in that The second interface node is connected to the at least one second attack method node, or the second interface node is connected to the at least one second attack step node.

18. The method according to claim 16 or 17, characterized in that The attack tree further includes a second root node, wherein the second root node is used to indicate a damage scenario of the target device. The second root node is connected to the at least one second interface node respectively.

19. The method according to any one of claims 16 to 18, characterized in that: The attack tree also includes at least one second threat scenario node corresponding to the second interface node, wherein the second threat scenario node is used to indicate a threat scenario of the target device.

20. The method according to claim 19, characterized in that The second threat scenario node is respectively connected to the second interface node and at least one of the second attack method nodes; or, The second threat scenario node is respectively connected to the second interface node and at least one of the second attack step nodes; or, The second threat scenario node is connected to the second root node and the at least one second interface node respectively, wherein the second root node is used to indicate a damage scenario of the target device.

21. The method according to claim 9, characterized in that When the setting information indicates to establish the attack tree of the interface level type, the attack tree includes at least one of at least one third attack step node and at least one third attack method node; The third attack step node is used to indicate the attack step implemented through the target interface, and the third attack method node is used to indicate the attack method to which the attack step implemented through the target interface belongs.

22. The method according to claim 21, characterized in that The attack tree further includes a third root node, and the third root node is used to indicate a damage scenario of the target interface. The third root node is respectively connected to the at least one third attack step node or the at least one third attack method node.

23. The method according to claim 21 or 22, characterized in that The attack tree also includes at least one third threat scenario node, wherein the third threat scenario node is used to indicate a threat scenario of the target interface.

24. The method according to claim 23, characterized in that The third attack step nodes are respectively connected to at least one of the third threat scenario nodes; or, The third attack method nodes are respectively connected to at least one of the third threat scenario nodes; or, The third threat scenario node is respectively connected to the third root node and at least one of the third attack step nodes; or, The third threat scenario node is respectively connected to the third root node and at least one of the third attack method nodes; in, The third root node is used to indicate a damage scenario of the target interface.

25. A device for generating an attack tree, characterized in that: The device comprises: A receiving module, used to obtain a data stream, wherein the data stream is used to indicate a plurality of devices through which the target service flows in sequence; A processing module is used to generate an attack tree according to the data flow, wherein the attack tree includes a plurality of device nodes, and each device node of the plurality of device nodes is used to indicate one device among the plurality of devices.

26. A device for generating an attack tree, characterized in that: The device comprises: A display module, used to indicate to the user the type of the attack tree to be established, wherein the type includes at least one of a service level, a device level, and an interface level; A receiving module, used for receiving setting information of the user; A processing module, configured to generate the attack tree according to the setting information; wherein, when the setting information indicates to establish the attack tree of the service level type, the setting information further includes a data flow, the data flow indicates a plurality of devices through which the target service flows in sequence, the attack tree includes a plurality of device nodes, each of the plurality of device nodes is used to indicate one of the plurality of devices; The processing module is also used to control the display of the attack tree.

27. A device for generating an attack tree, characterized in that: The device comprises at least one processor and an interface circuit, wherein the processor is used to execute instructions and / or data interaction through the interface circuit, so that the device executes the method according to any one of claims 1 to 8 or claims 9 to 24.

28. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method according to any one of claims 1-8 or 9-24.

Images