Automated attack path analysis and evaluation method and device based on large language model

Abstract

The present disclosure provides an automated attack path analysis and assessment method and device based on a large language model. The method comprises: first, determining the system architecture to be analyzed, and determining the attack entry and attack exit, constructing a label tree, and extracting the target information of each label node in the label tree; using the large language model to analyze the potential attack surface and attack purpose of each label node in the label tree; then obtaining the domain knowledge corresponding to the system architecture to be analyzed, and then generating an attack tree based on the target information of each label node, the corresponding potential attack surface, the attack purpose, and the domain knowledge; finally, evaluating the feasibility of the attack tree and scoring it based on the large language model, and optimizing the target attack tree. This embodiment overcomes the problems of subjectivity, update difficulty, and information abstraction of traditional threat database-based methods, and at the same time has cross-domain application capabilities, and is suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

Description

Technical Field

[0001] The present disclosure relates to the technical field of large language models, and in particular to a method and device for automated attack path analysis and evaluation based on a large language model. Background Art

[0002] With the rapid advancement of automotive technology, new modules and sensors such as ADAS, TBOX, gateways, autonomous driving, millimeter wave (mmWave) and LiDAR are being integrated into vehicles. These sensors, interconnected through in-vehicle networks, enhance vehicle functionality but also increase the complexity and cybersecurity risks of vehicle systems, making them more vulnerable to attacks. To address this, the United Nations WP29 R155e regulation was introduced in 2021, mandating that OEMs and Tier 1 suppliers establish a Cybersecurity Management System (CSMS) throughout the vehicle lifecycle. However, the regulation lacks specific details for CSMS construction, creating implementation challenges. Subsequently, the ISO 21434 standard emerged, providing framework guidance for automotive cybersecurity management.

[0003] Related technologies have proposed automatically generating attack paths based on threat databases. However, this automated approach has limitations in the automotive safety field. For example, building the database is time-consuming and labor-intensive, relying on expert experience and subjectivity; it struggles to analyze down to the micro-component level, resulting in insufficient analysis when updates are frequent; and the method lacks generalizability, being applicable only to automotive applications and lacking support for cross-industry and global regulatory interaction. Consequently, related technologies are insufficient in addressing the TARA requirements for low-level components and the full lifecycle safety of these components. Summary of the Invention

[0004] The disclosed embodiments at least provide a method and device for automated attack path analysis and evaluation based on a large language model. By using a large language model to perform automated TARA attack path analysis at the component level or the overall system level throughout the entire life cycle, the method overcomes the subjectivity, update difficulty, and information abstraction problems of traditional threat database-based methods. The method combines the large language model to obtain domain information to achieve reasoning for specific scenarios, and has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, and so on.

[0005] The present disclosure provides an automated attack path analysis and assessment method based on a large language model, including:

[0006] Obtaining a system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, a threat scenario corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; determining an attack entry and an attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed;

[0007] Determine, according to a path finding algorithm, a label tree consisting of a plurality of label nodes based on the plurality of components to be analyzed, the attack entry and the attack exit, and extract target information of each label node in the label tree;

[0008] For each label node in the label tree, determine the potential attack surface corresponding to each label node based on the target information of the label node and the large language model, and determine the attack purpose corresponding to each label node based on the threat scenario corresponding to each label node based on the large language model;

[0009] Acquire domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree based on target information of each label node, potential attack surface corresponding to each label node, attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path;

[0010] The attack tree is subjected to feasibility calculation and score calculation based on the large language model, and the attack tree is updated based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

[0011] In some possible embodiments, the system architecture to be analyzed further includes connection relationships between components to be analyzed; and determining, based on the multiple components to be analyzed, the attack entry and the attack exit according to the path finding algorithm, a label tree consisting of multiple label nodes includes:

[0012] Determine a label graph based on the connection relationships between the components to be analyzed, the multiple components to be analyzed, the attack entry, and the attack exit;

[0013] According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

[0014] In some possible embodiments, the system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and extracting target information of each tag node in the tag tree includes:

[0015] An associated label node connected to the label node is determined based on the label tree, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

[0016] In some possible embodiments, generating an attack tree based on the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge includes:

[0017] For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template;

[0018] For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and the prompt template corresponding to the label node;

[0019] For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node;

[0020] An attack tree is generated based on the attack purpose, attack steps, and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic nodes, and the logic nodes are connected to each attack step.

[0021] In some possible embodiments, generating an attack tree based on the attack objectives, attack steps, and logic nodes corresponding to each label node includes:

[0022] For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0023] The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0024] In some possible embodiments, merging the processed attack subtrees includes:

[0025] For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree is a special attack step;

[0026] In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of the various attack subtrees.

[0027] In some possible embodiments, performing feasibility calculation and score calculation on the attack tree based on the large language model includes:

[0028] Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

[0029] The present disclosure provides an automated attack path analysis and evaluation device based on a large language model, including:

[0030] An architecture acquisition module is configured to acquire a system architecture to be analyzed, wherein the system architecture to be analyzed includes a plurality of components to be analyzed, a threat scenario corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; and determine an attack entry and an attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed;

[0031] a label tree determination module, configured to determine, based on a path finding algorithm and the plurality of components to be analyzed, attack entry points, and attack exit points, a label tree consisting of a plurality of label nodes, and extract target information of each label node in the label tree;

[0032] an information determination module for determining, for each label node in the label tree, a potential attack surface corresponding to each label node based on target information of the label node and a large language model, and determining, based on the large language model and a threat scenario corresponding to each label node, an attack purpose corresponding to each label node;

[0033] An attack tree generation module, configured to acquire domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree based on the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path;

[0034] An attack tree evaluation module is configured to perform feasibility calculation and score calculation on the attack tree based on the large language model, and update the attack tree based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

[0035] In some possible embodiments, the system architecture to be analyzed further includes connection relationships between components to be analyzed; and the tag tree determination module is specifically configured to:

[0036] Determine a label graph based on the connection relationships between the components to be analyzed, the multiple components to be analyzed, the attack entry, and the attack exit;

[0037] According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

[0038] In some possible embodiments, the system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and the information determination module is specifically configured to:

[0039] An associated label node connected to the label node is determined based on the label tree, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

[0040] In some possible embodiments, the attack tree generation module is specifically configured to:

[0041] For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template;

[0042] For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and the prompt template corresponding to the label node;

[0043] For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node;

[0044] An attack tree is generated based on the attack purpose, attack steps, and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic nodes, and the logic nodes are connected to each attack step.

[0045] In some possible embodiments, the attack tree generation module is further configured to:

[0046] For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0047] The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0048] In some possible embodiments, the attack tree generation module is further configured to:

[0049] For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree is a special attack step;

[0050] In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of the various attack subtrees.

[0051] In some possible embodiments, the attack tree evaluation module is specifically configured to:

[0052] Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

[0053] An embodiment of the present disclosure provides a computer device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor and the memory communicate via the bus. When the machine-readable instructions are executed by the processor, the automated attack path analysis and evaluation method based on a large language model as described in any possible implementation method described above is performed.

[0054] An embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for automated attack path analysis and evaluation based on a large language model as described in any of the above possible implementations is implemented.

[0055] The automated attack path analysis and evaluation method and device based on a large language model provided in the embodiments of the present disclosure uses a large language model to perform automated TARA attack path analysis at the component level or the overall system level throughout the entire life cycle, thereby overcoming the subjectivity, update difficulties, and information abstraction problems of traditional threat database-based methods. It also combines the large language model to obtain domain information to achieve specific scenario reasoning, and has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

[0056] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings that need to be cited in the embodiments. The drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and, together with the specification, are used to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without inventive effort.

[0058] Figure 1 A schematic diagram of a TARA program provided by an embodiment of the present disclosure is shown;

[0059] Figure 2 A flowchart of an automated attack path analysis and evaluation based on a large language model provided by an embodiment of the present disclosure is shown;

[0060] Figure 3 A flowchart of a label tree construction method in the large language model-based automated attack path analysis and assessment method provided by an embodiment of the present disclosure is shown;

[0061] Figure 4 A schematic diagram of constructing a label tree in the automated attack path analysis and assessment method based on a large language model provided by an embodiment of the present disclosure is shown;

[0062] Figure 5 A flowchart of a method for generating an attack tree in the automated attack path analysis and evaluation method based on a large language model provided by an embodiment of the present disclosure is shown;

[0063] Figure 6 A schematic diagram of a method for generating an attack subtree in the large language model-based automated attack path analysis and evaluation method provided by an embodiment of the present disclosure is shown;

[0064] Figure 7 A schematic diagram of a method for merging attack subtrees in an automated attack path analysis and evaluation method based on a large language model provided by an embodiment of the present disclosure is shown;

[0065] Figure 8 A schematic diagram of an automated attack path analysis and assessment based on a large language model provided by an embodiment of the present disclosure is shown;

[0066] Figure 9 A schematic diagram of the structure of an automated attack path analysis and evaluation device based on a large language model provided by an embodiment of the present disclosure is shown;

[0067] Figure 10A schematic structural diagram of a computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the disclosure for which protection is sought, but merely represents selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present disclosure.

[0069] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0070] The term "and / or" herein simply describes an association relationship, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, and the existence of B alone. In addition, the term "at least one" herein refers to any combination of at least two of any one or more of a plurality of items. For example, "at least one of A, B, and C" can represent any one or more elements selected from the set consisting of A, B, and C.

[0071] With the rapid advancement of automotive technology, new modules and sensors are increasingly being integrated into vehicles. These include advanced driver assistance systems, TBOX, gateways, autonomous vehicles, millimeter-wave radar, and lidar. These components are interconnected via in-vehicle networks, increasing complexity and expanding the potential attack surface, making the system more vulnerable. The increasing number of cyberattacks targeting IVNs in recent years has highlighted the urgent need for strong cybersecurity measures. To address this, the UN WP29 R155e regulation, released in 2021, mandates that OEMs and Tier 1 suppliers establish a cybersecurity management system (CSMS) throughout the vehicle lifecycle. However, the regulation lacks specific details for CSMS construction, posing implementation challenges. Subsequently, the ISO 21434 standard emerged, providing framework guidance for automotive cybersecurity management.

[0072] Here, to facilitate understanding of this embodiment, the concept of Threat Analysis and Risk Assessment (TARA) provided by the ISO 21434 standard core is first introduced in detail. Figure 1 Figure 1 shows a schematic diagram of the TARA process provided by the present disclosure. TARA consists of seven procedures (the order of which is flexible) for identifying and assessing cybersecurity threats and risks. TARA's implementation procedures include asset identification, threat scenario identification, impact rating, attack path analysis, attack feasibility assessment, risk value determination, and risk treatment decision-making. Specifically, asset identification involves determining the asset and its cybersecurity attributes (confidentiality, integrity, and availability) and assessing the potential damage scenarios that could result if attacked. Threat scenario identification describes potential threats and vulnerabilities, including the target asset, the attributes violated by the threat, and the potential damage scenarios that could result. For example, an attack on the search history in an in-vehicle infotainment system could potentially leak personal information and could correspond to multiple damage scenarios. Impact rating primarily assesses damage scenarios from four perspectives: security, finance, operations, and privacy. Attack path analysis primarily identifies potential attack paths or attack trees for each threat scenario, including both top-down and bottom-up approaches. Attack feasibility assessment evaluates the feasibility of attack paths based on attack potential, CVSS scores, or attack vectors. Risk assessment assesses the risk of a threat scenario by combining an impact rating and an attack feasibility rating, ranging from 1 (lowest) to 5 (highest). Finally, the risk treatment decision considers risk response measures, such as acceptance or mitigation. Of these, attack path analysis and attack feasibility rating are the most time-consuming and technically demanding steps.

[0073] Research has found that related technologies that automatically generate attack paths based on threat databases have limitations in the automotive safety field. For example, building a database is time-consuming and labor-intensive, relying on expert experience and subjectivity; it struggles to detail components down to the microscopic level, leading to insufficient analysis when updates are frequent; and the method lacks generalizability, being applicable only to automotive applications and lacking support for cross-industry and global regulatory interaction. Consequently, these technologies are insufficient in addressing the TARA requirements and full lifecycle safety of low-level components.

[0074] Based on the above research, an embodiment of the present disclosure provides an automated attack path analysis and evaluation method and device based on a large language model, including: first, obtaining the system architecture to be analyzed; and determining the attack entry and attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed; secondly, according to the path finding algorithm, a label tree consisting of multiple label nodes is determined based on multiple components to be analyzed, attack entry and attack exit, and the target information of each label node in the label tree is extracted; then, for each label node in the label tree, according to the target information of the label node, the potential attack surface corresponding to each label node is determined based on the large language model, and the attack purpose corresponding to each label node is determined based on the threat scenario corresponding to each label node based on the large language model; and the domain knowledge corresponding to the system architecture to be analyzed is obtained based on the large language model, and an attack tree is generated based on the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node and the domain knowledge; finally, feasibility calculation and score calculation are performed on the attack tree based on the large language model, and the attack tree is updated based on the calculation results to obtain a target attack tree.

[0075] In the disclosed embodiment, a large language model is used to perform automated analysis of TARA attack paths at the component level or the overall system level throughout the entire life cycle, thereby overcoming the subjectivity, update difficulty, and information abstraction problems of traditional threat database-based methods. The large language model is combined to obtain domain information to achieve specific scenario reasoning, and the system has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

[0076] To facilitate understanding of this embodiment, we first provide a detailed introduction to the subject that executes the automated attack path analysis and assessment method based on a large language model provided in this embodiment. The subject that executes the automated attack path analysis and assessment method based on a large language model provided in this embodiment is a computer device. The computer device can be a server. The server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, big data, and artificial intelligence platforms.

[0077] The following describes in detail the automated attack path analysis and evaluation method based on a large language model provided by the embodiment of the present application in conjunction with the accompanying drawings. Figure 2 FIG. 2 is a flow chart of an automated attack path analysis and evaluation method based on a large language model provided by an embodiment of the present disclosure. The method includes the following steps S201 to S205:

[0078] S201, obtaining a system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, a threat scenario corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; and determining an attack entry and an attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed.

[0079] Here, the system architecture to be analyzed primarily includes multiple components to be analyzed, the threat scenarios corresponding to each component to be analyzed, the connection information corresponding to each component to be analyzed, the connection relationships between the components to be analyzed, and the description information corresponding to each component to be analyzed. Taking the analysis of the attack path of the TBOX component, an onboard communication module in a car, as an example, the connection information corresponding to the TBOX component to be analyzed can be expressed as follows: the TBOX component is connected to other gateway components via an Ethernet channel, and the TBOX component receives external data via a Wi-Fi interface; the connection relationships between the TBOX component and other components can be expressed as follows: the TBOX component is connected to the onboard network and to onboard sensors; and the description information can be expressed as follows: the TBOX component runs an embedded operating system such as Linux or Android Automotive, supports remote firmware updates and vehicle management applications, and can ensure efficient data processing and secure communications, among other hardware and software information.

[0080] Specifically, threat scenarios are used to describe potential threats and vulnerabilities, including the target assets, the property violated by the threat, and the damage scenarios that will result. They are also the ultimate goal of the attacker. For example, in a vehicle scenario, threat scenarios may include remote control attacks, where an attacker may invade the vehicle's onboard systems through the vehicle's wireless communication interface (such as Wi-Fi or Bluetooth) and remotely control the vehicle's braking or acceleration systems, potentially causing an accident; or navigation system hijacking, where an attacker tampers with the vehicle's navigation system to provide false route information, causing the driver to deviate from the correct path, increasing the risk of getting lost or safety hazards; as well as other types of threat scenarios (such as in-vehicle entertainment system vulnerabilities and in-vehicle data leaks). According to ISO 21434 TARA regulations, each threat scenario must undergo an attack path analysis, that is, each threat scenario corresponds to an attack tree.

[0081] In some other embodiments, if targeting the drone sector, threat scenarios may include signal jamming hijacking (i.e., an attacker interferes with a drone's communication or GPS signals, forcing the drone to lose contact with the operator and subsequently hijack the drone for illegal operation or deviation from its route), malware attacks (e.g., an attacker implants malware or viruses into a drone's control system, potentially causing drone malfunction, data leakage, or even complete control system failure), or other types of threat scenarios. For other sectors, threat scenarios are defined based on actual circumstances and are not specifically limited here.

[0082] It is understandable that after obtaining the system architecture to be analyzed, it is necessary to determine the attack entry and attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed. The attack entry refers to the starting point for the attacker to enter the target system or network; the attack exit is the key system component that the attacker relies on to achieve their ultimate goal (such as data theft, privilege escalation, etc.). Specifically, the attack entry where the attack may occur is determined based on the connection information corresponding to each component to be analyzed. For example, if there is a Wi-Fi interface on the TBOX component, then this Wi-Fi interface can be used as the entrance to the car system, so the attack entry of this system is this Wi-Fi interface. The attack exit is also determined based on the threat scenario. For example, if the threat scenario is "obtaining root permissions on the gateway to obtain sensitive user information," the system's attack exit is the gateway.

[0083] S202 , determining a label tree consisting of multiple label nodes based on the multiple components to be analyzed, attack entrances, and attack exits according to a path finding algorithm, and extracting target information of each label node in the label tree.

[0084] Specifically, refer to Figure 3 As shown, when constructing a label tree according to the path finding algorithm, the following steps S2021 to S2022 may be included:

[0085] S2021: Determine a label graph based on the connection relationships between the components to be analyzed, the multiple components to be analyzed, the attack entry, and the attack exit.

[0086] It's understandable that because the system architecture to be analyzed contains all kinds of information about all components to be analyzed, the amount of information is huge and the structure is complex, making it difficult to process and calculate. Therefore, in order to more concisely represent each component to be analyzed and the relationship between each component to be analyzed, attack entry points, and attack exit points, each component to be analyzed, attack entry points, and attack exit points can be used as different types of labels to serve as concise representations of their respective information. When it is necessary to obtain detailed information about a component to be analyzed, or to explore the relationship between components or between components and attack entry points / exits, these labels can be used as indexes to quickly retrieve and obtain complete information. This not only improves the efficiency of data processing, but also enhances the flexibility and accuracy of data analysis and security assessment.

[0087] For example, after setting labels for each analysis component, attack entry, and attack exit, a label graph is constructed based on these labels. Figure 4 Taking the label graph shown in the figure as an example, A1 and A2 are components to be analyzed, M is the attack exit determined based on the threat scenario, and N1 and N2 are attack entry points. The label graph is constructed based on the connection relationships between the labels. Specifically, component A1 to be analyzed is connected to component A2 to be analyzed. Component A1 to be analyzed is also connected to attack entry points N1 and N2, as well as attack exit point M. Attack exit point M is connected to attack entry point N2.

[0088] S2022: Determine, based on the label graph and a minimum path search algorithm, multiple minimum paths from the attack entry to the attack exit; and determine a label tree based on the multiple minimum paths.

[0089] Here, the minimum path finding algorithm is an algorithm used to find the shortest path from one node to another in a graph. Common algorithms include the Dijkstra algorithm. In order to fully consider all paths and reflect the possible attack surface of each label node, the algorithm will merge the repeated parts of the found paths to construct a tree structure with the attack target as the root node - the label tree. Figure 4As shown, the label graph is traversed by a path finding algorithm, and the solved path is processed to obtain a label tree. In the label tree, only the component A1 to be analyzed that is connected to the attack entry N1, N2 and the attack exit M is retained, and the component A2 to be analyzed that has no connection relationship with the attack entry N1, N2 and the attack exit M is discarded. At the same time, the connection relationship between the attack exit M and the attack entry N2 is discarded, and finally the label tree shown in the figure is obtained. In the embodiment of the present disclosure, this label tree can not only describe the degree of association between a single label and its adjacent labels in detail at the local level, but also help to extract key information in the label mapping process; at the same time, from a global perspective, the hierarchical structure of the label tree provides a useful framework and guidance for the subsequent merging of attack subtrees to construct a more complex and systematic attack tree hierarchical relationship.

[0090] In some other embodiments, the path finding algorithm may also be an A* algorithm, a Bellman-Ford algorithm, etc., which is not specifically limited here.

[0091] It is understandable that when dealing with complex network topologies, the system architecture to be analyzed is huge and may exceed the token limit challenge of the large language model. In addition, it has been found that when analyzing the potential attack of a certain label, the information of labels that are too far away from this label node is not helpful. When redundant secondary information is also provided to the large language model, it may not only cause a waste of tokens, but also cause the large language model to be unfocused in analysis, ignore some of the main information, and cause incomplete analysis. In order to address these problems, in the embodiment of the present disclosure, according to the hierarchical structure of the label tree, the large language model can be used recursively to generate potential attack methods for each label node in the tree separately, and it is necessary to extract the main information for each label node in the system architecture to be analyzed, strip off the secondary information, and provide it to the large language model, while avoiding inputting all the nodes of the entire label tree at once. It is worth noting that when extracting the main information of each label node, it is necessary to avoid losing the main information while removing the secondary information, otherwise it will also cause the large language model to lack the necessary information support during analysis. Specifically, when extracting the main information of each label node, the associated label node connected to the label node can be determined based on the label tree, and the description information corresponding to the label node and the description information corresponding to the associated label node are used as the target information corresponding to the label node (that is, the main information corresponding to the label node). Figure 4 In the label tree shown, the target information about the label node A1 of the component to be analyzed can be represented as the description information corresponding to the label nodes N1, N2 and M plus the description information of the component to be analyzed A1 itself.

[0092] S203, for each label node in the label tree, determine the potential attack surface corresponding to each label node based on the large language model according to the target information of the label node, and determine the attack purpose corresponding to each label node based on the large language model according to the threat scenario corresponding to each label node.

[0093] Here, the Large Language Model (LLM) is an important technological breakthrough in the field of artificial intelligence in recent years. By training on large-scale text data, it can understand and generate natural language text and has strong semantic understanding and reasoning capabilities.

[0094] Specifically, for each labeled node, a large language model is used to contextually understand the corresponding target information, identifying security issues related to that node, including potential vulnerabilities, configuration weaknesses, and exposed services. This step is achieved by leveraging the large language model's ability to understand and analyze massive amounts of security data. Based on this contextual understanding, the large language model can then infer the potential attack surface against that node. This attack surface may include specific attack methods, vulnerability exploitation methods, and potential intrusion paths. Furthermore, after identifying the potential attack surface, it is necessary to further determine the attacker's likely objectives. This helps to more accurately assess the severity and urgency of the threat and formulate appropriate response strategies. Specifically, the large language model is guided and utilized to conduct in-depth analysis of the corresponding threat scenario, inferring the attacker's likely objectives, which may include data theft, service disruption, system damage, and ransomware. By understanding the attacker's motivations and intentions, the potential impact of the threat can be more accurately assessed.

[0095] S204: Acquire domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge.

[0096] Here, when analyzing the system architecture to be analyzed, the large language model can be used to extract professional knowledge related to the field to which the system architecture to be analyzed belongs (such as the automotive industry, financial industry, etc.), including but not limited to industry standards, technical specifications, common vulnerability patterns, attack methods and their impacts, etc.

[0097] Specifically, refer to Figure 5 As shown, when generating the attack tree, the following steps S2041 to S2044 may be included:

[0098] S2041 , for each label node, generating a prompt template corresponding to the label node according to the potential attack surface, attack purpose, and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template.

[0099] It is understandable that in the field of artificial intelligence, especially when dealing with tasks involving natural language processing and knowledge enhancement, large language models such as the GPT series, BERT, etc., have demonstrated powerful text generation, understanding and reasoning capabilities. However, these models may perform poorly when dealing with tasks in specific fields or complex scenarios due to a lack of domain knowledge or contextual information. In order to improve the accuracy and efficiency of large language models on specific tasks, an effective method is to enhance the decision-making process of the model through knowledge guidance. Therefore, in the present disclosure, when using a large language model to generate an attack tree, a corresponding prompt template is first generated for each label node. The prompt template includes the potential attack surface, attack purpose and domain knowledge corresponding to each label node. By providing these prompt templates as input or guidance information to the large language model, the purpose of its knowledge guidance can be achieved. When the model processes tasks, these templates will serve as additional context or constraints to guide the model to more accurately understand and generate content related to the label node. In this way, not only the performance of the model on specific tasks is improved, but also the transparency and controllability of the model are enhanced.

[0100] S2042 : For each label node, determine an attack step corresponding to the attack purpose of the label node based on the large language model and the prompt template corresponding to the label node.

[0101] For example, the attack objective corresponding to each labeled node might fall into a broad category (e.g., data theft, system sabotage). A detailed analysis is needed to achieve this objective, deriving specific attack steps. In practice, the attacker would need to take a series of specific steps to achieve this goal. For example, considering the in-vehicle infotainment system as a labeled node, the corresponding attack objective could be to steal sensitive data from the system. Using a large language model, the attack steps can be represented as follows: the attacker first scans and discovers the IP address and open ports of the in-vehicle infotainment system, identifying the system version and vulnerabilities. They then exploit these vulnerabilities to gain access to the system and implant malware to control the system. The attacker then accesses and extracts sensitive data from the system, such as communication logs and navigation history, and transmits this data to a server under their control via covert communication, while simultaneously clearing system logs to conceal their tracks. Ultimately, the attacker can use the stolen data to commit fraud or attempt to gain further control of other vehicle systems.

[0102] S2043 : For each label node, perform a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node.

[0103] It can be understood that logical correlation analysis involves an in-depth analysis of the causal relationships, sequence, and dependencies between attack steps to determine which steps are necessary and which are optional, and how they together form a coherent attack path. Based on logical correlation analysis, key logical nodes in the attack path can be identified. These logical nodes are often turning points, decision points, or bottlenecks between attack steps, and have a significant impact on the success of the attack. For example, in an attack path against a vehicle control system, the privilege escalation step may be a key logical node, as it determines whether the attacker can further control the vehicle system.

[0104] S2044: Generate an attack tree based on the attack purpose, attack steps, and logic nodes corresponding to each label node.

[0105] Here, based on the attack target, attack steps, and logical nodes corresponding to each label node, the attack tree includes at least one attack path, whose root node is the attack purpose, the attack purpose is connected to the logical node, and the logical node is connected to each attack step. Specifically, after obtaining the attack purpose, attack steps, and logical nodes corresponding to each label node, generating the attack tree may include the following (1) to (2):

[0106] (1) For each label node, generate an attack subtree based on the attack purpose, attack steps, and logic nodes corresponding to the label node;

[0107] (2) The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0108] It is understandable that for each label node, a corresponding attack subtree is generated. The attack subtree is a tree structure built around a single label node and centered around its attack purpose. Its root node is the attack purpose, which is connected to the logical node, and the logical node is connected to each attack step. Because large language models sometimes provide answers that appear reasonable but may actually be wrong, this may affect the rationality of the attack path. In addition, different manufacturers may assume different constraints on the attack path, such as "not considering social engineering attacks." Therefore, the present disclosure prunes the attack subtree by setting corresponding rules to delete unreasonable attack steps.

[0109] At the same time, the present disclosure also proposes to guide the large language model to distinguish the attack targets of each attack step, indicating whether the attack target is the software or hardware inside the system, or the system's external interface, referring to Figure 6 As shown in Figure 1, the attack subtree generated by the large language model based on the target information and threat scenario of a certain label consists of attack objectives, logical nodes, and attack steps. The corresponding attack steps have different attack targets (i.e., attack targets are internal software or hardware of the system and attack targets are external interfaces of the system). Since the attack targets are internal software or hardware of the system, the attack needs to be implemented through the external interface. Therefore, when merging attack subtrees, we only focus on the attack targets of the system's external interfaces. Therefore, depending on the attack targets, the specific steps for merging attack subtrees include the following (a) to (b):

[0110] (a) for each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree is a special attack step;

[0111] (b) When the attack step belongs to a special attack step, determine the target component corresponding to the special attack step, and determine the target label node corresponding to the target component; connect the attack subtree corresponding to the target label node with the special attack step to achieve the merging of the various attack subtrees.

[0112] It can be understood that the special attack steps in the present disclosure are represented as attack targets that are external interfaces of the system. For each attack subtree represented by a label node, its attack steps are checked one by one to determine the special attack step. Then, for each step marked as a special attack step, its associated target component needs to be clarified, that is, the component involved in the implementation of the attack step, and its corresponding target label node is determined based on the target component. Then, the attack subtree corresponding to the target label node is connected to the special attack step to construct a complete attack tree. This attack tree will comprehensively and progressively reflect the complete attack path, providing a solid foundation for our risk assessment and security protection strategy. Figure 7 As shown in the figure, taking the attack subtree of label a and the attack subtree of label b as an example, among which, the step marked as a special attack step in the attack step corresponding to the attack subtree of label a is associated with the label node b, then the attack subtree corresponding to label b is connected to the special attack step of label a to complete the merger of the subtrees of label a and label b. The same method is used for other subtrees until all subtrees are merged.

[0113] S205 , performing feasibility calculation and score calculation on the attack tree based on the large language model, and updating the attack tree based on the calculation results to obtain a target attack tree.

[0114] Exemplarily, after generating the attack tree, the present disclosure also proposes using a large language model to perform an attack feasibility assessment on the attack paths in the attack tree. The purpose is to determine which attacks are more likely to occur, thereby providing priority guidance for the implementation of risk mitigation measures, giving priority to and processing these attack paths, and reasonably allocating limited security resources accordingly. Specifically, the large language model is used to obtain the evaluation regulations corresponding to the system architecture to be analyzed, and the rules for attack feasibility assessment in the regulations are extracted as prompt words, allowing the large language model to learn the evaluation criteria. The large language model is then used to perform a feasibility calculation on the attack tree, and based on the calculation results and scoring rules, the score corresponding to the number of attacks is determined and the evaluation reasons are given. The attack tree is then updated based on the calculation results and the corresponding evaluation reasons to obtain a target attack tree. The target attack tree includes at least one target attack path, and the target attack path includes the attack path and the evaluation results.

[0115] The automated attack path analysis and evaluation method and device based on a large language model provided in the embodiments of the present disclosure uses a large language model to perform automated TARA attack path analysis at the component level or the overall system level throughout the entire life cycle, thereby overcoming the subjectivity, update difficulties, and information abstraction problems of traditional threat database-based methods. It also combines the large language model to obtain domain information to achieve specific scenario reasoning, and has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

[0116] Next, combine Figure 8 The automated attack path analysis and evaluation method based on the large language model proposed in this disclosure is described in detail as a whole. First, the system architecture to be analyzed is obtained (including multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, connection information corresponding to each component to be analyzed, connection relationships between components to be analyzed, and description information corresponding to each component to be analyzed). Then, the attack entry is determined according to the connection relationship corresponding to the components to be analyzed, and the attack exit is determined according to the threat scenario. Furthermore, the attack route is extracted according to each system architecture to be analyzed and its corresponding attack entry and attack exit to generate a label tree. Secondly, the target information corresponding to each label node in the label tree is extracted according to the label tree, and the attack steps are generated based on the target information and threat scenarios corresponding to each label node based on the large language model. At the same time, the attack steps are logically correlated using the large language model to determine the logical nodes. Then, the attack subtrees are generated according to the attack objectives, attack steps, and logical nodes corresponding to each label node, and the attack subtrees are merged according to the attack steps corresponding to each attack subtree to generate an attack tree. Finally, the generated attack tree is evaluated and scored based on the large language model to obtain the final target attack tree.

[0117] Those skilled in the art will understand that in the above-mentioned method of the specific implementation method, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0118] Based on the same inventive concept, the embodiments of the present disclosure also provide an automated attack path analysis and evaluation device based on a large language model corresponding to the automated attack path analysis and evaluation method based on a large language model. Since the principle of solving the problem by the device in the embodiments of the present disclosure is similar to the above-mentioned automated attack path analysis and evaluation method based on a large language model in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0119] Reference Figure 9 FIG. 1 is a schematic diagram of an automated attack path analysis and evaluation device 900 based on a large language model provided by an embodiment of the present disclosure, the device comprising:

[0120] The architecture acquisition module 901 is configured to acquire a system architecture to be analyzed, wherein the system architecture to be analyzed includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; and determine attack entry points and attack exit points based on the threat scenarios corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed.

[0121] A label tree determination module 902 is configured to determine, based on the plurality of components to be analyzed, attack entry points, and attack exit points, a label tree consisting of a plurality of label nodes according to a path finding algorithm, and extract target information of each label node in the label tree;

[0122] An information determination module 903 is configured to determine, for each label node in the label tree, a potential attack surface corresponding to each label node based on the target information of the label node and a large language model, and to determine an attack objective corresponding to each label node based on the large language model and a threat scenario corresponding to each label node;

[0123] Attack tree generation module 904 is configured to obtain domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree based on the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path;

[0124] The attack tree evaluation module 905 is used to perform feasibility calculation and score calculation on the attack tree based on the large language model, and update the attack tree based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

[0125] In some possible embodiments, the system architecture to be analyzed further includes connection relationships between components to be analyzed; and the tag tree determination module 902 is specifically configured to:

[0126] Determine a label graph based on the connection relationships between the components to be analyzed, the multiple components to be analyzed, the attack entry, and the attack exit;

[0127] According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

[0128] In some possible embodiments, the system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and the information determination module 903 is specifically configured to:

[0129] An associated label node connected to the label node is determined based on the label tree, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

[0130] In some possible embodiments, the attack tree generation module 904 is specifically configured to:

[0131] For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template;

[0132] For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and the prompt template corresponding to the label node;

[0133] For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node;

[0134] An attack tree is generated based on the attack purpose, attack steps, and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic nodes, and the logic nodes are connected to each attack step.

[0135] In some possible embodiments, the attack tree generation module 904 is further configured to:

[0136] For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0137] The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0138] In some possible embodiments, the attack tree generation module 904 is further configured to:

[0139] For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree is a special attack step;

[0140] In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of the various attack subtrees.

[0141] In some possible embodiments, the attack tree evaluation module 905 is specifically configured to:

[0142] Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

[0143] Based on the same technical concept, the embodiment of the present disclosure also provides a computer device. Figure 10 1 is a schematic diagram of the structure of a computer device 1000 provided in an embodiment of the present disclosure, including a processor 1001, a memory 1002, and a bus 1003. The memory 1002 is used to store execution instructions and includes a memory 10021 and an external memory 10022. The memory 10021 is also referred to as internal memory and is used to temporarily store operation data in the processor 1001 and data exchanged with an external memory 10022 such as a hard disk. The processor 1001 exchanges data with the external memory 10022 through the memory 10021.

[0144] In the embodiment of the present application, the memory 1002 is specifically used to store application code for executing the solution of the present application, and the execution is controlled by the processor 1001. That is, when the computer device 1000 is running, the processor 1001 communicates with the memory 1002 via the bus 1003, so that the processor 1001 executes the application code stored in the memory 1002, thereby performing the method described in any of the aforementioned embodiments.

[0145] Among them, the memory 1002 can be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0146] The processor 1001 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0147] It should be understood that the structures illustrated in the embodiments of the present application do not constitute a specific limitation on the computer device 1000. In other embodiments of the present application, the computer device 1000 may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0148] The present disclosure also provides a computer-readable storage medium storing a computer program that, when executed by a processor, executes the steps of the method for automated attack path analysis and assessment based on a large language model described in the above method embodiment. The storage medium can be either volatile or non-volatile, computer-readable.

[0149] The embodiments of the present disclosure also provide a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the automated attack path analysis and evaluation method based on a large language model described in the above method embodiment. For details, please refer to the above method embodiment and will not be repeated here.

[0150] The computer program product may be implemented in hardware, software, or a combination thereof. In one embodiment, the computer program product is implemented as a computer storage medium. In another embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0151] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed system and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0152] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0153] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0154] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0155] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The scope of protection of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed in the present disclosure, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure shall be subject to the scope of protection of the claims.

Claims

1. An automated attack path analysis and evaluation method based on a large language model, characterized in that: include: Obtaining a system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, a threat scenario corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; determining an attack entry and an attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed; Determine, according to a path finding algorithm, a label tree consisting of a plurality of label nodes based on the plurality of components to be analyzed, the attack entry and the attack exit, and extract target information of each label node in the label tree; For each label node in the label tree, determine the potential attack surface corresponding to each label node based on the target information of the label node and the large language model, and determine the attack purpose corresponding to each label node based on the threat scenario corresponding to each label node based on the large language model; Acquire domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree based on target information of each label node, potential attack surface corresponding to each label node, attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path; The attack tree is subjected to feasibility calculation and score calculation based on the large language model, and the attack tree is updated based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

2. The method according to claim 1, characterized in that The system architecture to be analyzed also includes the connection relationship between each component to be analyzed; the path finding algorithm is used to determine a label tree consisting of multiple label nodes based on the multiple components to be analyzed, the attack entry and the attack exit, including: Determine a label graph based on the connection relationships between the components to be analyzed, the multiple components to be analyzed, the attack entry, and the attack exit; According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

3. The method according to claim 1, characterized in that The system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and extracting target information of each tag node in the tag tree includes: An associated label node connected to the label node is determined based on the label tree, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

4. The method according to claim 1, wherein Generating an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge includes: For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template; For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and the prompt template corresponding to the label node; For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node; An attack tree is generated based on the attack purpose, attack steps, and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic nodes, and the logic nodes are connected to each attack step.

5. The method according to claim 4, characterized in that Generating an attack tree based on the attack objectives, attack steps, and logic nodes corresponding to each label node includes: For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node; The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

6. The method according to claim 5, characterized in that The merging of the processed attack subtrees includes: For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree is a special attack step; In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of the various attack subtrees.

7. The method according to claim 1, characterized in that The performing feasibility calculation and score calculation on the attack tree based on the large language model includes: Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the attack tree is determined based on the calculation result and a preset scoring rule.

8. An automated attack path analysis and evaluation device based on a large language model, characterized in that: include: An architecture acquisition module is configured to acquire a system architecture to be analyzed, wherein the system architecture to be analyzed includes a plurality of components to be analyzed, a threat scenario corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; and determine an attack entry and an attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed; a label tree determination module, configured to determine, based on a path finding algorithm and the plurality of components to be analyzed, attack entry points, and attack exit points, a label tree consisting of a plurality of label nodes, and extract target information of each label node in the label tree; an information determination module for determining, for each label node in the label tree, a potential attack surface corresponding to each label node based on target information of the label node and a large language model, and determining, based on the large language model and a threat scenario corresponding to each label node, an attack purpose corresponding to each label node; An attack tree generation module, configured to acquire domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree based on the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path; An attack tree evaluation module is configured to perform feasibility calculation and score calculation on the attack tree based on the large language model, and update the attack tree based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images