A threat tree construction method and device

Abstract

The application discloses a threat tree construction method and device, relates to the technical field of network security, and can quickly and effectively mine potential vulnerabilities of a system. The method comprises the following steps: receiving input data for threat modeling of a target scene; determining threat modeling data associated with the input data from each source data included in a multi-scene threat modeling data set based on one of a similarity method and a causality method, to obtain a first-level data set; determining a second-level data set associated with the first-level data set from the source data based on the other of the similarity method and the causality method; cross using the similarity method and the causality method, layer by layer determining a next-level data set associated with a previous-level data set until an instruction for ending threat modeling is received; and constructing a threat tree model with the target scene as a root node, and each data in the previous-level data set and each data in the next-level data set as a root node of each level of child nodes.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for constructing a threat tree. Background Technology

[0002] In the age of network information, the internet has penetrated every aspect of people's work and life, and its security issues have attracted widespread attention from society and academia. One of the core issues of information security is the vulnerability inherent in computer systems. Malicious attackers can exploit these vulnerabilities to escalate privileges, access unauthorized system resources, and even modify sensitive data. Typically, potential vulnerabilities in a system can be identified by constructing a threat tree.

[0003] In related technologies, users manually construct threat trees using threat modeling. This method of manually constructing threat trees is merely a simple record of the construction process, and threat modeling cannot quickly and effectively uncover potential vulnerabilities in the system. Summary of the Invention

[0004] This invention provides a method and apparatus for constructing a threat tree, which can quickly and effectively uncover potential vulnerabilities in a system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a method for constructing a threat tree, the method comprising:

[0007] Receive input data from users to perform threat modeling of target scenarios;

[0008] Based on one of the similarity method and the causal relationship method, threat modeling data associated with the input data is determined from the various source data included in the pre-defined multi-scenario threat modeling dataset, thus obtaining the first-level dataset; wherein, the similarity method is used to determine the similarity between the input data and each source data, and the causal relationship method is used to determine the causal relationship between the input data and each source data;

[0009] Based on another method among similarity methods and causal relationship methods, determine the second-level dataset associated with the first-level dataset from the source data;

[0010] By using similarity and causal relationship methods in combination, the next level dataset associated with the previous level dataset is determined layer by layer until an instruction to end threat modeling is received;

[0011] Construct a threat tree model with the target scenario as the root node, and each data point in the upper-level dataset and each data point in the lower-level dataset as the root child nodes.

[0012] The threat tree construction method provided by this invention, when performing threat modeling in a target scenario, uses one of the similarity method and the causal relationship method to determine the threat modeling data associated with the input data corresponding to the target scenario from various source data, obtaining the first-level dataset. Then, using the other of the two methods, the second-level dataset associated with the first-level dataset is determined again from various source data. Since the source data in the associated hierarchical datasets determined by the similarity method and the causal relationship method are different, the two methods can be used interchangeably to determine the next-level dataset associated with the previous-level dataset layer by layer when determining subsequent hierarchical datasets, until the instruction to end threat modeling is received. Finally, a threat tree model is constructed with the target scenario as the root node, and each data point in the previous-level dataset and each data point in the next-level dataset as the root child nodes of each level. This method of using different methods to determine hierarchical datasets automatically filters the next-level datasets associated with the input data or the previous-level dataset from various source data from different perspectives. Compared to related technologies that rely entirely on manual decision-making to construct threat trees, the threat tree model in this invention, derived from input data and datasets filtered from different perspectives at various levels, includes a more comprehensive range of threat paths. This model can reflect different threat scenarios to the system in the target context and possesses a degree of predictability. Using a more comprehensive threat tree model in the target context allows for a more thorough, rapid, and effective discovery of system vulnerabilities. Furthermore, this threat tree model can provide inexperienced users with different attack strategies, guiding them through the process of uncovering system vulnerabilities in the target context.

[0013] In one possible implementation, the aforementioned source data are located in source data groups of corresponding categories. These source data groups are grouped according to data categories, which include threat points, methods, tools, vulnerabilities, and scenario information.

[0014] In one possible implementation, determining the similarity between the input data and each source data includes:

[0015] Determine the first text embedding vector for each source data and the target text embedding vector for the input data;

[0016] Determine the distance value between each first text embedding vector and the target text embedding vector;

[0017] Based on the distance value, determine the similarity between the input data and each source data.

[0018] In one possible implementation, the above-mentioned similarity-based method determines the first-level dataset from the various source data included in the pre-defined multi-scenario threat modeling dataset, including:

[0019] Sort the similarity between the input data and each source data in each source data group in descending order to obtain the first association list between each source data group and the input data.

[0020] The first N source data are determined from each of the first association lists to obtain the first-level dataset, where N is a positive integer.

[0021] In one possible implementation, the method for constructing the threat tree, prior to determining the threat modeling data associated with the input data, further includes:

[0022] Based on the graph structure composed of various source data, determine whether there is a causal relationship between the input data and each source data. The graph structure is used to indicate the relationship between the various source data.

[0023] If the source data and the input data have a causal relationship, then the source data is determined to be the target source data.

[0024] In one possible implementation, determining whether there is a causal relationship between the input data and the various source data based on the graph structure composed of the source data includes:

[0025] From the graph structure described above, determine the input information associated with each source data to obtain the input label corresponding to each source data, and from the graph structure described above, determine the output information associated with the input data to obtain the output label corresponding to the input data.

[0026] Based on the input and output labels, determine whether there is a causal relationship between the input data and each source data.

[0027] In one possible implementation, the number of input labels and output labels is at least one. Determining whether there is a causal relationship between the input data and each source data based on the input and output labels includes:

[0028] Determine the similarities and differences between each input label corresponding to each source data and each output label corresponding to the input data;

[0029] If an input label and an output label of the source data are the same, then a causal relationship is determined between the source data and the input data.

[0030] If all input labels and all output labels are different, then it is determined that there is no causal relationship between the source data and the input data.

[0031] In one possible implementation, the above-mentioned causal relationship-based method determines the first-level dataset from the various source data included in the pre-defined multi-scenario threat modeling dataset, including:

[0032] For each target source data that has a causal relationship with the input data, determine the number of input labels of the target source data that are the same as the output labels of the input data;

[0033] The number of target source data in each source data group is sorted in descending order to obtain a second association list between each source data group and the input data.

[0034] The first N source data are determined from each of the second association lists to obtain the first-level dataset, where N is a positive integer.

[0035] In one possible implementation, after constructing a threat tree model with the target scenario as the root node, each data point in the upper-level dataset and each data point in the lower-level dataset as the root node and child nodes at each level, the method for constructing the threat tree further includes:

[0036] Receive user marking operations on multiple target nodes in the threat tree model, where the target nodes can be any node among the root node and child nodes;

[0037] The attack tree is obtained based on the relationships between multiple target nodes in the threat tree model.

[0038] In one possible implementation, the above-mentioned input data for receiving user threat modeling of the target scenario includes:

[0039] The threat modeling editor's interactive interface receives scenario description data input by the user and uses this scenario description data as input data for the user to perform threat modeling on the target scenario.

[0040] The format of scene description data should include at least natural language and graph structure.

[0041] In a second aspect, the present invention provides a threat tree construction apparatus, the threat tree construction apparatus comprising:

[0042] The acquisition unit is used to receive input data from the user for threat modeling of the target scenario;

[0043] The determination unit is used to determine the threat modeling data associated with the input data from various source data included in a pre-defined multi-scenario threat modeling dataset, based on one of the similarity method and the causal relationship method, to obtain the first-level dataset. The similarity method is used to determine the similarity between the input data and each source data, while the causal relationship method is used to determine the causal relationship between the input data and each source data. Based on the other of the similarity method and the causal relationship method, the second-level dataset associated with the first-level dataset is determined from the source data. The similarity method and the causal relationship method are used interchangeably to determine the next-level dataset associated with the previous-level dataset, layer by layer, until an instruction to end threat modeling is received.

[0044] The building unit is used to construct a threat tree model with the target scenario as the root node and each data point in the upper-level dataset and the lower-level dataset as the root child nodes.

[0045] In one possible implementation, the aforementioned source data are located in source data groups of corresponding categories. These source data groups are grouped according to data categories, which include threat points, methods, tools, vulnerabilities, and scenario information.

[0046] In one possible implementation, the aforementioned determining unit is specifically used for:

[0047] Determine the first text embedding vector for each source data and the target text embedding vector for the input data;

[0048] Determine the distance value between each first text embedding vector and the target text embedding vector;

[0049] Based on the distance value, determine the similarity between the input data and each source data.

[0050] In one possible implementation, the aforementioned determining unit is specifically used for:

[0051] Sort the similarity between the input data and each source data in each source data group in descending order to obtain the first association list between each source data group and the input data.

[0052] The first N source data are determined from each of the first association lists to obtain the first-level dataset, where N is a positive integer.

[0053] In one possible implementation, the determining unit is further configured to determine whether there is a causal relationship between the input data and each source data based on the graph structure composed of each source data, wherein the graph structure is used to indicate the correlation between each source data; if there is a causal relationship between the source data and the input data, then the source data is determined to be the target source data.

[0054] In one possible implementation, the aforementioned determining unit is specifically used for:

[0055] From the graph structure described above, determine the input information associated with each source data to obtain the input label corresponding to each source data, and from the graph structure described above, determine the output information associated with the input data to obtain the output label corresponding to the input data.

[0056] Based on the input and output labels, determine whether there is a causal relationship between the input data and each source data.

[0057] In one possible implementation, the number of the aforementioned input labels and the aforementioned output labels is at least one. The aforementioned determining unit is specifically used for:

[0058] Determine the similarities and differences between each input label corresponding to each source data and each output label corresponding to the input data;

[0059] If an input label and an output label of the source data are the same, then a causal relationship is determined between the source data and the input data.

[0060] If all input labels and all output labels are different, then it is determined that there is no causal relationship between the source data and the input data.

[0061] In one possible implementation, the aforementioned determining unit is specifically used for:

[0062] For each target source data that has a causal relationship with the input data, determine the number of input labels of the target source data that are the same as the output labels of the input data;

[0063] The number of target source data in each source data group is sorted in descending order to obtain a second association list between each source data group and the input data.

[0064] The first N source data are determined from each of the second association lists to obtain the first-level dataset, where N is a positive integer.

[0065] In one possible implementation, the aforementioned building unit is also used to receive user marking operations on multiple target nodes in the threat tree model, where the target nodes are any nodes among the root node and child nodes;

[0066] The attack tree is obtained based on the relationships between multiple target nodes in the threat tree model.

[0067] In one possible implementation, the aforementioned acquisition unit is specifically used for:

[0068] The threat modeling editor's interactive interface receives scenario description data input by the user and uses this scenario description data as input data for the user to perform threat modeling on the target scenario.

[0069] The format of scene description data should include at least natural language and graph structure.

[0070] Thirdly, the present invention provides a threat tree construction apparatus, comprising a processor and a memory. The memory stores computer program code, including computer instructions. When the processor executes the computer instructions, the threat tree construction apparatus performs a threat tree construction method as described in the first aspect and any possible implementation thereof.

[0071] Fourthly, the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed on a threat tree construction apparatus, cause the threat tree construction apparatus to perform a threat tree construction method as described in the first aspect or any of the possible implementations of the first aspect. Attached Figure Description

[0072] Figure 1 One of the structural schematic diagrams of the threat tree construction device provided in an embodiment of the present invention;

[0073] Figure 2 This is one of the flowcharts illustrating the method for constructing a threat tree according to an embodiment of the present invention;

[0074] Figure 3 This is a second schematic flowchart illustrating the method for constructing a threat tree according to an embodiment of the present invention.

[0075] Figure 4 The third schematic flowchart of the threat tree construction method provided in this embodiment of the invention;

[0076] Figure 5 This is a second schematic diagram of the structure of the threat tree construction device provided in an embodiment of the present invention. Detailed Implementation

[0077] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0078] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more. Furthermore, the use of "based on" or "according to" implies openness and inclusiveness, because processes, steps, calculations, or other actions "based on" or "according to" one or more of the stated conditions or values ​​may in practice be based on additional conditions or beyond the stated values.

[0079] To cultivate the risk assessment capabilities of inexperienced users and enable them to quickly and effectively uncover potential system vulnerabilities, this invention provides a method and apparatus for constructing a threat tree. This method leverages the knowledge and experience of experienced users to guide inexperienced users in discovering and exploiting both known and unknown vulnerabilities in the system.

[0080] Figure 1 One of the structural diagrams of a threat tree construction device, such as Figure 1 As shown, the threat tree construction apparatus may include: a processor 11, a memory 12, a communication interface 13, and a bus 14. The processor 11, the memory 12, and the communication interface 13 can be connected via the communication bus 14.

[0081] Processor 11 is the control center of the threat tree construction device. It can be a single processor 11 or a collective term for multiple processing elements. For example, processor 11 can be a general-purpose central processing unit (CPU) or other general-purpose processors 11. Among them, the general-purpose processor 11 can be a microprocessor 11 or any conventional processor 11.

[0082] As one embodiment, processor 11 may include one or more CPUs, for example, Figure 1 CPU0 and CPU1 are shown.

[0083] The memory 12 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0084] In one possible implementation, the memory 12 can exist independently of the processor 11. The memory 12 can be connected to the processor 11 via a bus 14 and is used to store instructions or program code. When the processor 11 calls and executes the instructions or program code stored in the memory 12, it can implement the threat tree construction method provided in the following embodiments of the present invention.

[0085] In another possible implementation, the memory 12 can also be integrated with the processor 11.

[0086] Communication interface 13 is used for the threat tree construction device to connect with other devices via a communication network, which may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. Communication interface 13 may include a receiving unit for receiving data and a sending unit for sending data.

[0087] Bus 14 can be an Industry Standard Architecture (ISA) bus 14, a Peripheral Component Interconnect (PCI) bus 14, or an Extended Industry Standard Architecture (EISA) bus 14, etc. This bus 14 can be divided into an address bus 14, a data bus 14, a control bus 14, etc. For ease of representation, Figure 1 The bus 14 is represented by a single thick line, but this does not mean that there is only one bus 14 or only one type of bus 14.

[0088] It should be pointed out that, Figure 1 The structure shown does not constitute a limitation on the means of constructing this threat tree, except... Figure 1 In addition to the components shown, the means of constructing the threat tree may include more or fewer components than illustrated, or combine certain components, or arrange the components differently.

[0089] The threat tree construction method provided in this embodiment of the invention is executed by a threat tree construction device. This threat tree construction device can be a terminal device, a CPU within the terminal device, a control module within the terminal device used for constructing the threat tree, or a client within the terminal device used for constructing the threat tree. This embodiment of the invention uses the execution of the threat tree construction method by a terminal device as an example to illustrate the threat tree construction method provided by this invention.

[0090] The method for constructing a threat tree according to an embodiment of the present invention will now be described with reference to the accompanying drawings.

[0091] like Figure 2 As shown, the threat tree construction method provided in this embodiment of the invention includes the following steps 201-205.

[0092] 201. Receive input data from users for threat modeling of the target scenario.

[0093] 202. Based on one of the similarity method and the causal relationship method, the threat modeling data associated with the input data is determined from the various source data included in the preset multi-scenario threat modeling dataset to obtain the first-level dataset.

[0094] Optionally, the source data can be stored as natural language data in the database of the terminal device. Each source data is located in a corresponding source data group, which is grouped according to data category. The data grouping categories include threat points, methods, tools, vulnerabilities, and scenario information.

[0095] For example, a threat point refers to a potential security risk identified by experienced users. A technique refers to a common operation or execution method used to handle a specific situation during an attack or defense process; techniques can include the specific steps of the operation, which users can follow to complete the operation. Tools refer to various types of software and other tools used in the field of cybersecurity. A vulnerability refers to a flaw in the specific implementation of hardware, software, protocols, or security policies that allows attackers to access or damage the system without authorization. Scenario information refers to a description of information about a common specific attack or defense scenario.

[0096] For example, potential threats to the system include the possibility of it being compromised. Using network scanning and sniffing toolkits (Network Mapper, Nmap) to scan for Internet Protocol (IP) is a common practice and can be considered a technique.

[0097] Optionally, similarity methods are used to determine the similarity between the input data and each source data. Causal relationship methods are used to determine the causal relationship between the input data and each source data. The specific processes of similarity methods and causal relationship methods, as well as their application processes, are described below.

[0098] In one possible implementation, determining the similarity between input data and each source data using a similarity method may include the following steps: First, determine a first text embedding vector for each source data and a target text embedding vector for the input data. Then, determine the distance value between each first text embedding vector and the target text embedding vector, and determine the similarity between the input data and each source data based on each distance value.

[0099] For example, a Natural Language Processing (NLP) model can be used to process each source data in each source data group in the database to obtain a first text embedding vector for each source data in each source data group, and all the first text embedding vectors can be stored in the database. When the terminal device receives the input data, it uses an NLP model to process the input data to obtain the target text embedding vector.

[0100] It should be noted that the smaller the distance between a first text embedding vector and a target text embedding vector, the higher the similarity between the source data and the input data corresponding to the first text embedding vector, that is, the stronger the correlation between the source data and the input data.

[0101] In one embodiment, after determining the similarity between the source data and the input data corresponding to each first text embedding vector, for each source data group, the similarity between the input data and each source data in each source data group is sorted in descending order to obtain a first association list between each source data group and the input data. The first N source data are determined from each first association list to obtain the first-level dataset, where N is a positive integer.

[0102] In other words, N source data points with strong relevance to the input data are selected from each source data group. These N source data points form the first-level dataset. Based on this process, multiple source data points related to the input data can be identified from the multi-scenario threat modeling dataset in the database. Furthermore, these source data points are sorted in descending order of similarity, making the relationship between these source data points and the input data readily apparent. That is, it can be determined which source data points in the multi-scenario threat modeling dataset are most likely to pose a threat to the system in the target scenario corresponding to the input data, and the magnitude of this threat.

[0103] Optionally, before determining the causal relationship between the input data and each source data using a causal relationship method to identify the threat modeling data associated with the input data, the threat tree construction method provided in this embodiment of the invention can determine whether there is a causal relationship between the input data and each source data based on a graph structure composed of each source data. If there is a causal relationship between the source data and the input data, then the source data is determined to be the target source data. The graph structure is used to indicate the association between each source data.

[0104] In one embodiment, determining whether there is a causal relationship between input data and each source data based on a graph structure composed of source data may include the following steps: First, determining the input information associated with each source data from the graph structure to obtain the input label corresponding to each source data, and determining the output information associated with the input data from the graph structure to obtain the output label corresponding to the input data. A source data may include at least one output label, and input data may include at least one input label. Then, determining whether there is a causal relationship between the input data and each source data based on the input labels and output labels.

[0105] It should be noted that determining the graph structure based on the input and output labels is only one method to obtain the graph structure.

[0106] For example, when determining the causal relationship between input data and each source data based on input and output labels, firstly, it is necessary to determine the similarities and differences between the input labels and output labels corresponding to each source data. Then, based on these differences, it is determined whether each source data has a causal relationship with the input data. Specifically, if one input label and one output label of a source data are the same, then the source data is determined to have a causal relationship with the input data. If all input labels and all output labels of a source data are different, then the source data is determined to have no causal relationship with the input data.

[0107] In one possible implementation, based on a causal relationship approach, determining the first-level dataset from the various source data included in a pre-defined multi-scenario threat modeling dataset may include the following steps: First, for each target source data that has a causal relationship with the input data, it is necessary to determine the number of input labels for the target source data that are identical to the output labels of the input data. The aforementioned numbers for each target source data in each source data group are then sorted in descending order to obtain a second association list between each source data group and the input data. Finally, the first N source data are determined from each of the second association lists to obtain the first-level dataset, where N is a positive integer.

[0108] In other words, the more times the input labels of a source data point are identical to the output labels of the output data, the higher the correlation between the source data and the input labels. Based on causal relationship methods, it is possible to determine which source data points in the multi-scenario threat modeling dataset are most likely to pose a threat to the system in the target scenario corresponding to the input data, and the magnitude of the probability that these data points pose a threat to the system.

[0109] 203. Another method based on similarity and causal relationship methods to determine the second-level dataset associated with the first-level dataset from various source data.

[0110] To identify more source data from the multi-scenario threat modeling dataset that are highly correlated with each source data in the first-level dataset (i.e., the second-level dataset), another method, either the similarity method or the causal relationship method, can be used to re-identify N source data from each source data group.

[0111] In other words, if a similarity-based method was used to determine the first-level dataset, a causal relationship-based method can be used for the second-level dataset. Based on this, the N source data points re-determined from each source data group are the N source data points with the highest relevance to the corresponding source data in the first-level dataset.

[0112] 204. Using similarity and causal relationship methods interchangeably, determine the next level dataset associated with the previous level dataset layer by layer until an instruction to end threat modeling is received.

[0113] The method used to determine the dataset at any given level is different from the method used to determine the dataset at the next level or the previous level. However, the method used to determine the dataset at the next level or the previous level is the same.

[0114] 205. Construct a threat tree model with the target scenario as the root node, and each data point in the upper-level dataset and each data point in the lower-level dataset as the root child nodes.

[0115] The input data is associated with every source data point in the first-level dataset, and each source data point in the first-level dataset is associated with every source data point in the second-level dataset. This continues hierarchically, with each source data point in each level's dataset being associated with every source data point in the next level's dataset. Therefore, the input data is equivalent to a root node, and each data point in each level is equivalent to a child node in that level. The root node, multiple first-level child nodes, and multiple child nodes from adjacent levels form a threat tree model. The connection between the root node of the threat tree model and a child node in each level constitutes a threat path in the threat tree model.

[0116] It should be noted that the threat tree model, input data, and each source data group included in each level of the dataset can all be displayed in the interactive interface of the threat modeling editor. Furthermore, each source data group can be displayed on separate pages.

[0117] The threat tree construction method provided in this invention, when performing threat modeling in a target scenario, uses one of the similarity method and the causal relationship method to determine the threat modeling data associated with the input data corresponding to the target scenario from various source data, thus obtaining a first-level dataset. Then, using the other of the two methods, a second-level dataset associated with the first-level dataset is determined from various source data again. Since the source data in the associated hierarchical datasets determined by the similarity method and the causal relationship method are different, the two methods can be used interchangeably to determine the next-level dataset associated with the previous-level dataset layer by layer, until an instruction to end threat modeling is received. Finally, a threat tree model is constructed with the target scenario as the root node, and each data point in the previous-level dataset and each data point in the next-level dataset as the root child nodes. This method of using different methods to determine hierarchical datasets automatically filters out the next-level datasets associated with the input data or the previous-level dataset from various source data from different perspectives. Compared to related technologies that rely entirely on manual decision-making to construct threat trees, the threat tree model obtained in this embodiment of the invention, based on input data and datasets filtered from different perspectives at each layer, includes a more comprehensive range of threat paths. This model can reflect different threat scenarios to the system in the target context and possesses a certain degree of predictability. Using a more comprehensive threat tree model in the target context allows for a more comprehensive, rapid, and effective discovery of system vulnerabilities. Furthermore, this threat tree model can provide inexperienced users with different attack strategies, guiding them through the process of discovering system vulnerabilities in the target context.

[0118] Combination Figure 2 ,like Figure 3 As shown, step 201 above may include step 301.

[0119] 301. On the interactive interface of the threat modeling editor, receive the scenario description data input by the user, and use the scenario description data as the input data for the user to perform threat modeling on the target scenario.

[0120] The terminal device has a threat modeling editor installed. When a threat tree model needs to be built, the user enters the input data for threat modeling the target scenario on the interactive interface of the threat modeling editor. The scenario description data must be in at least natural language and graph structure formats.

[0121] In one embodiment, the scene description data can be a complete description of the target scene in natural language.

[0122] In another embodiment, the scene description data can be a graph structure composed of multiple causally related data nodes. Each data node can represent partial information of the target scene, and each data node includes input information and output information associated with it. The input information is the input label of the data node, and the output information is the output label of the data node. Based on the output labels of each data node, the causal relationship between the data nodes can be determined, and the data nodes can be linked together according to the causal relationship to obtain a graph structure.

[0123] Optionally, users can make targeted edits to the scenario description data on the interactive interface of the threat modeling editor. In this way, the threat modeling editor can obtain a new target scenario based on the re-edited scenario description data, thereby obtaining a threat tree model for the new target scenario.

[0124] Combination Figure 3 ,like Figure 4 As shown, the threat tree construction method provided in this embodiment of the invention may further include the following steps 401 and 402.

[0125] 401. Receive user marking operations on multiple target nodes in the threat tree model. The target nodes can be any node among the root node and its child nodes.

[0126] 402. Based on the relationships between multiple target nodes in the threat tree model, the attack tree is obtained.

[0127] On the interactive interface of the threat modeling editor, users can mark the root node and at least one child node in any level of the child nodes. This allows them to filter out target threat paths related to the root node and at least one child node in any level of the child nodes from the multiple threat paths included in the threat tree model. In this case, a target threat path can be understood as a specific execution process of the attack system in the target scenario, i.e., an attack chain. Based on all attack chains, an attack tree can be obtained.

[0128] During the attack tree formation process, the terminal device stores not only multiple target nodes, but also the input and output labels of the source data corresponding to each target node, as well as all user operations on the threat modeling editor's interactive interface, forming an operation log for user review. Users can learn from the attack strategies of other users by viewing their attack tree generation logs, thereby improving the quality of their decision-making during system vulnerability discovery.

[0129] It is important to understand that the attack tree can be part of the threat tree model.

[0130] In summary, the threat tree construction method provided in this invention includes threats, vulnerabilities, and the exploitation of the threat tree, i.e., an attack tree is derived from the threat tree. In contrast, prior art threat modeling focuses on the discovery and remediation of potential threats during the development phase, lacking analytical capabilities for the attack exploitation stage. Therefore, the threat tree construction method in this invention not only discovers potential threats but also possesses analytical capabilities for the attack exploitation stage.

[0131] The foregoing primarily describes the solutions provided by the embodiments of the present invention from the perspective of the device. It is understood that, in order to achieve the above functions, the device includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the algorithmic steps of the various examples described in the embodiments disclosed herein, the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0132] Figure 5 A schematic diagram of a possible composition of the threat tree construction apparatus 500 involved in the above embodiments is shown, such as... Figure 5 As shown, the threat tree construction device 500 may include: an acquisition unit 501, a determination unit 502, and a construction unit 503.

[0133] The system includes the following components: Acquisition unit 501 receives input data from the user for threat modeling of the target scenario. Determination unit 502 uses one of two methods—similarity method and causal relationship method—to determine threat modeling data associated with the input data from various source data within a pre-defined multi-scenario threat modeling dataset, thus obtaining a first-level dataset. The similarity method determines the similarity between the input data and each source data, while the causal relationship method determines the causal relationship between the input data and each source data. Using the other method, a second-level dataset associated with the first-level dataset is determined from the source data. The similarity method and causal relationship method are used interchangeably to determine the next-level dataset associated with the previous-level dataset, layer by layer, until an instruction to end threat modeling is received. Construction unit 503 constructs a threat tree model with the target scenario as the root node, and each data point in the previous-level and next-level datasets as root nodes for each level of child nodes.

[0134] Optionally, each of the above source data is located in a source data group of the corresponding category. The source data group is grouped according to the data category, which includes threat points, methods, tools, vulnerabilities, and scenario information.

[0135] Optionally, the aforementioned determining unit 502 is specifically used for:

[0136] Determine the first text embedding vector for each source data and the target text embedding vector for the input data; determine the distance value between each first text embedding vector and the target text embedding vector; and determine the similarity between the input data and each source data based on the distance value.

[0137] Optionally, the aforementioned determining unit 502 is specifically used for:

[0138] Sort the similarity between the input data and each source data in each source data group in descending order to obtain the first association list between each source data group and the input data; determine the first N source data from each first association list to obtain the first-level dataset, where N is a positive integer.

[0139] Optionally, the determining unit 502 is further configured to determine whether there is a causal relationship between the input data and each source data based on the graph structure composed of each source data, wherein the graph structure is used to indicate the correlation between each source data. If there is a causal relationship between the source data and the input data, then the source data is determined to be the target source data.

[0140] Optionally, the aforementioned determining unit 502 is specifically used for:

[0141] Determine the input information associated with each source data to obtain the input label corresponding to each source data, and determine the output information associated with the input data to obtain the output label corresponding to the input data; based on the input label and output label, determine whether there is a causal relationship between the input data and each source data.

[0142] Optionally, the number of the above-mentioned input labels and the above-mentioned output labels is at least one. The above-mentioned determining unit 502 is specifically used for:

[0143] Determine the similarities and differences between each input label corresponding to each source data and each output label corresponding to each input data; if one input label and one output label of the source data are the same, then it is determined that there is a causal relationship between the source data and the input data; if all input labels and all output labels are different, then it is determined that there is no causal relationship between the source data and the input data.

[0144] Optionally, the aforementioned determining unit 502 is specifically used for:

[0145] For each target source data that has a causal relationship with the input data, determine the number of input labels of the target source data that are the same as the output labels of the input data; sort the number of target source data in each source data group in descending order to obtain a second association list between each source data group and the input data; determine the first N source data from each second association list to obtain the first-level dataset, where N is a positive integer.

[0146] Optionally, the aforementioned construction unit 503 is further configured to receive user marking operations on multiple target nodes in the threat tree model, where the target nodes are any nodes among the root node and child nodes; and to obtain an attack tree based on the association relationship between the multiple target nodes in the threat tree model.

[0147] Optionally, the aforementioned acquisition unit 501 is specifically used for:

[0148] The interactive interface of the threat modeling editor receives scenario description data input by the user and uses this scenario description data as input data for the user to perform threat modeling on the target scenario; the format of the scenario description data includes at least natural language and graph structure.

[0149] Of course, the threat tree construction apparatus 500 provided in this embodiment of the invention includes, but is not limited to, the modules described above.

[0150] In actual implementation, the acquisition unit 501, the determination unit 502, and the construction unit 503 can be determined by... Figure 1 The processor 11 shown calls the program code in memory 12 to implement this. For the specific execution process, please refer to... Figures 2 to 4 The description of the method for constructing the threat tree shown is omitted here.

[0151] Another embodiment of the present invention provides a computer-readable storage medium storing computer instructions that, when executed on a threat tree building apparatus, cause the threat tree building apparatus to perform the various steps of the method flow shown in the above method embodiment.

[0152] Another embodiment of the present invention provides a chip system applied to a threat tree construction apparatus. The chip system includes one or more interface circuits and one or more processors 11. The interface circuits and processors 11 are interconnected via lines. The interface circuits are used to receive signals from a memory 12 of the threat tree construction apparatus and send the signals to the processors 11, the signals including computer instructions stored in the memory 12. When the processors 11 execute the computer instructions, the threat tree construction apparatus performs the various steps of the method flow shown in the above method embodiment.

[0153] In another embodiment of the present invention, a computer program product is also provided, the computer program product including instructions that, when executed on a threat tree building device, cause the threat tree building device to perform the various steps performed by the threat tree building device in the method flow shown in the above method embodiment.

[0154] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0155] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions within the technical scope disclosed in the present invention should be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for constructing a threat tree, characterized in that, include: Receive input data from users to perform threat modeling of target scenarios; Determining whether there is a causal relationship between the input data and each of the source data based on the graph structure composed of various source data includes: determining the input information associated with each of the source data from the graph structure to obtain the input label corresponding to each of the source data, and determining the output information associated with the input data from the graph structure to obtain the output label corresponding to the input data; the number of the input label and the output label is at least one. Based on the input labels and output labels, determining whether there is a causal relationship between the input data and each of the source data includes: determining the similarities and differences between each input label corresponding to each source data and each output label corresponding to the input data; if one input label and one output label of the source data are the same, then it is determined that there is a causal relationship between the source data and the input data; if all input labels and all output labels are different, then it is determined that there is no causal relationship between the source data and the input data; the graph structure is used to indicate the association relationship between each of the source data; if the source data and the input data have a causal relationship, then the source data is determined to be the target source data; Based on one of the similarity method and the causal relationship method, threat modeling data associated with the input data is determined from the various source data included in the preset multi-scenario threat modeling dataset to obtain a first-level dataset; wherein, the similarity method is used to determine the similarity between the input data and each of the source data, and the causal relationship method is used to determine the causal relationship between the input data and each of the source data; Based on another method among the similarity method and the causal relationship method, a second-level dataset associated with the first-level dataset is determined from the source data; By using the similarity method and the causal relationship method in combination, the next level dataset associated with the previous level dataset is determined layer by layer until an instruction to end threat modeling is received; Construct a threat tree model with the target scenario as the root node, and each data point in the upper-level dataset and each data point in the lower-level dataset as child nodes of the root node.

2. The method for constructing a threat tree according to claim 1, characterized in that, Each source data is located in a source data group of a corresponding category. The source data group is grouped according to data categories, which include threat points, methods, tools, vulnerabilities, and scenario information.

3. The method for constructing a threat tree according to claim 2, characterized in that, Determining the similarity between the input data and each of the source data includes: Determine a first text embedding vector for each of the source data, and a target text embedding vector for the input data; Determine the distance value between each of the first text embedding vectors and the target text embedding vector; Based on the distance value, the similarity between the input data and each of the source data is determined.

4. The method for constructing a threat tree according to claim 3, characterized in that, Based on the aforementioned similarity method, a first-level dataset is determined from the various source data included in the preset multi-scenario threat modeling dataset, including: The similarity between the input data and each source data in each source data group is sorted in descending order to obtain a first association list between each source data group and the input data. The first N source data are determined from each of the first association lists to obtain the first level dataset, where N is a positive integer.

5. The method for constructing a threat tree according to claim 1, characterized in that, Based on the aforementioned causal relationship method, a first-level dataset is determined from the various source data included in the preset multi-scenario threat modeling dataset, including: For each target source data that has a causal relationship with the input data, determine the number of input labels of the target source data that are the same as the output labels of the input data; The quantity of each target source data in each source data group is sorted in descending order to obtain a second association list between each source data group and the input data. The first N source data are determined from each of the second association lists to obtain the first level dataset, where N is a positive integer.

6. The method for constructing a threat tree according to any one of claims 2 to 4, characterized in that, After constructing a threat tree model with the target scenario as the root node and each data point in the upper-level dataset and each data point in the lower-level dataset as child nodes of the root node, the method for constructing the threat tree further includes: Receive user marking operations on multiple target nodes in the threat tree model, where the target nodes are any nodes among the root node and the child nodes; An attack tree is obtained based on the relationships between multiple target nodes in the threat tree model.

7. The method for constructing a threat tree according to any one of claims 2 to 4, characterized in that, The process of receiving user input data for threat modeling of the target scenario includes: The interactive interface of the threat modeling editor receives scenario description data input by the user and uses the scenario description data as input data for the user to perform threat modeling on the target scenario. The format of the scene description data includes at least natural language and graph structure.

8. A threat tree construction apparatus, characterized in that, include: The acquisition unit is used to receive input data from the user for threat modeling of the target scenario; A determining unit is configured to determine, based on a graph structure composed of various source data, whether there is a causal relationship between the input data and each of the source data, including: determining input information associated with each source data from the graph structure to obtain input labels corresponding to each source data, and determining output information associated with the input data from the graph structure to obtain output labels corresponding to the input data; the number of input labels and output labels is at least one; determining whether there is a causal relationship between the input data and each of the source data based on the input labels and output labels, including: determining the similarities and differences between each input label corresponding to each source data and each output label corresponding to the input data; if one input label and one output label of the source data are the same, then a causal relationship is determined between the source data and the input data; if all input labels and all output labels are different, then a causal relationship is determined between the source data and the input data. There is no causal relationship between the data sources; the graph structure is used to indicate the correlation between the various source data; if the source data and the input data have a causal relationship, then the source data is determined as the target source data; based on one of the similarity method and the causal relationship method, threat modeling data associated with the input data is determined from the various source data included in the preset multi-scenario threat modeling dataset, to obtain the first-level dataset; wherein, the similarity method is used to determine the similarity between the input data and each of the source data, and the causal relationship method is used to determine the causal relationship between the input data and each of the source data; based on the other of the similarity method and the causal relationship method, a second-level dataset associated with the first-level dataset is determined from the source data; the similarity method and the causal relationship method are used interchangeably to determine the next-level dataset associated with the previous-level dataset layer by layer, until an instruction to end threat modeling is received; The building unit is used to build a threat tree model with the target scenario as the root node, and each data point in the upper-level dataset and each data point in the lower-level dataset as child nodes of the root node.

9. A threat tree construction device, characterized in that, The threat tree construction apparatus includes a processor and a memory; the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the threat tree construction apparatus performs the threat tree construction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The device includes computer instructions that, when executed on a threat tree construction apparatus, cause the threat tree construction apparatus to perform the threat tree construction method according to any one of claims 1 to 7.

Images