Bayesian network intelligent connected vehicle unknown risk assessment method and system based on graph search
By constructing a Bayesian attack graph and adding unknown risk nodes using a graph search-based Bayesian network method, the problem of insufficient accuracy in risk assessment of unknown vulnerabilities in intelligent connected vehicles is solved, achieving more accurate risk assessment and reducing subjectivity.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- EAST CHINA NORMAL UNIV
- Filing Date
- 2021-09-13
- Publication Date
- 2026-05-19
AI Technical Summary
Existing methods for assessing the risks of unknown vulnerabilities in intelligent connected vehicles lack accuracy and are insufficient to effectively assess the threat posed by unknown vulnerabilities.
A Bayesian network approach based on graph search is adopted. By modeling node attributes and vulnerability exploitation, a Bayesian attack graph is constructed. By adding the concept of domain, unknown risk nodes are added, and a depth-first search algorithm is used to generate the Bayesian attack graph for unknown risk assessment.
It improves the accuracy and effectiveness of risk assessment for unknown vulnerabilities, reduces subjectivity, and provides diverse risk assessment methods.
Smart Images
Figure CN115809462B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of intelligent connected vehicle safety and safety risk assessment technology, and particularly relates to a method and system for assessing unknown risks of intelligent connected vehicles based on graph search and Bayesian networks. Background Technology
[0002] Currently, vulnerability attacks on intelligent connected vehicle systems occur frequently. Due to information asymmetry between attackers and defenders, vulnerabilities can be categorized as known and unknown. Existing research mainly focuses on risk assessment of known vulnerabilities. However, unknown vulnerabilities are more threatening and more difficult to detect. Therefore, risk assessment of unknown vulnerabilities deserves widespread attention. To simulate the vulnerability exploitation process, a directed graph model is applied to vulnerability risk assessment, and security metrics are used to quantify the exploitability of vulnerabilities. Current research on risk assessment of unknown vulnerabilities based on directed graph models is insufficient.
[0003] Attack graphs can clearly depict the potential relationships between vulnerabilities in a network, facilitating network risk assessment. However, the uncertainty of attack behavior increases the difficulty and affects the accuracy of network security risk assessment when using attack graphs. Bayesian networks, on the other hand, have significant advantages in addressing the problems caused by correlation and uncertainty. Summary of the Invention
[0004] To address the shortcomings of existing technologies, the present invention proposes a method and system for assessing unknown risks in intelligent connected vehicles using Bayesian networks based on graph search. By combining Bayesian methods, attack graphs, and unknown vulnerabilities, a Bayesian attack graph containing unknown vulnerabilities is constructed to model the target network.
[0005] This invention proposes a method for assessing unknown risks in intelligent connected vehicles based on Bayesian networks using graph search. By modeling attribute nodes and vulnerability exploits, attack templates are generated, a Bayesian attack graph is constructed, and unknown risk nodes are added using a backward search algorithm based on added domains. This solves the problems of constructing Bayesian attack graphs based on node attributes and vulnerability exploits, and adding unknown risk nodes to the Bayesian attack graph according to the algorithm. By modeling node attributes and vulnerability exploits, classifying nodes, and setting effective filtering conditions, combined with Bayesian networks, the method solves the problem of using Bayesian attack graphs to assess unknown risks in intelligent connected vehicles.
[0006] Traditional research on Bayesian attack graphs for assessing unknown vulnerability risks has limitations. This paper proposes a graph search-based Bayesian network-based method for assessing unknown risks in intelligent connected vehicles. This method models node attributes and vulnerability exploitation in Bayesian attack graphs, generates the graph based on attack templates, and then classifies the nodes. First, based on the tree structure of the Bayesian attack graph, nodes are divided into three categories: root nodes, leaf nodes, and non-leaf nodes. This method introduces the concept of an appended domain, meaning that when a node belongs to an appended domain, a conditional judgment is performed on that node to determine whether an unknown risk node has been introduced.
[0007] This invention proposes a method for assessing unknown risks in intelligent connected vehicles based on graph search using Bayesian networks. The specific implementation steps are as follows:
[0008] Step 1: Model the node attributes and vulnerability exploits t; the nodes include root nodes, leaf nodes, and non-leaf nodes.
[0009] Attributes are helpful for analyzing the probability of a node being successfully compromised. Known vulnerabilities set in the attributes can serve as the basis for calculating the prior probability of a node, and the set of parent nodes in the attributes can serve as the basis for calculating conditional probabilities.
[0010] The basic attributes of a node can be represented as a 7-tuple A = (id, pn, cn, kt, p, s, unf); where id is the unique identifier of the current node, such as IP address or vulnerability number; pn is the set of parent nodes, representing a set of source nodes connected to all in-degree edges of this node; cn is the set of child nodes, representing a set of target nodes connected to all out-degree edges of this node; kt is the set of known vulnerability exploits, representing the set of vulnerability exploits that have occurred at this node; p represents the probability that the current node will be successfully compromised due to a vulnerability exploit; s is the state of the node, i.e., the violation state reached due to successful vulnerability exploitation, and the state of the node follows a Bernoulli distribution; unf represents the type of the current node, i.e., a flag used for conditional judgment when adding an unknown node.
[0011] The modeling method for the vulnerability exploit t is as follows: Define a set of nodes A and the dependencies D between them, where D is represented as: A×A→[0,1]. Define a set of preceding nodes A pre ∈A and subsequent node A post ∈A, if the vulnerability is exploited by A pre →A post If true, it is called vulnerability exploitation t:A pre →A post Where → represents a causal relationship between two nodes, if A pre →A post If true, then A pre ≠A postThis is because the Bayesian attack graph is a non-reflexive directed acyclic graph.
[0012] Step 2: Construct an attack template. Based on the network system's topology information and the vulnerability information obtained using vulnerability scanning tools, construct an attack template.
[0013] Step 2, the construction of the attack template specifically includes the following steps:
[0014] Step 2.1: Obtain the network system topology map, which includes: the IP addresses of all hosts, operating systems, running services, and network connectivity.
[0015] Step 2.2: Use a vulnerability scanning tool to perform a security scan on the hosts in the network system to obtain vulnerability information on each host.
[0016] Step 2.3: Based on the vulnerability obtained in Step 2.2, fill in the attack template configuration file. The configuration file includes the vulnerability number as the ID of the atomic attack template; the source host's IP address, current user privilege status, running services, and network connectivity prerequisites; and the target host's state prerequisites, such as the current user privilege status. It also includes state information achievable through successful vulnerability exploitation relying on expert knowledge, and security metrics information such as the conditional probability of successful exploitation of other vulnerabilities after successful vulnerability exploitation, including user privilege escalation.
[0017] In step 2, the exploitation of the vulnerability is described using an atomic attack template. Each vulnerability exploitation includes a vulnerability number, preconditions and postconditions of the atomic attack, and security metrics information. The vulnerability number includes the CVE number and CNVD number. The preconditions include the state of the selected source host of interest, the state of the target host, and the services and network connectivity running on the target host. The postconditions include the state of the target host; if the preconditions are met, the postconditions should be fulfilled unconditionally. The security metrics information includes the state information that can be reached by successfully exploiting the vulnerability based on expert knowledge, and the conditional probability of successfully exploiting other vulnerabilities after successful exploitation of the vulnerability.
[0018] Step 3: Construct a Bayesian attack graph. Based on the attack template information, use a depth-first search algorithm (graph search algorithm) to generate a path attack graph containing the nodes with the attributes from Step 1. That is, starting from the attack target, construct a Bayesian attack graph using a depth-first search algorithm. The construction of the Bayesian attack graph specifically includes the following steps:
[0019] Step 3.1: Select the network security attributes of interest, i.e. specify the state of the attack target.
[0020] Step 3.2: Construct the host configuration file and attack template. The host configuration file includes the host network and system configuration, as well as vulnerabilities obtained through vulnerability scanning tools. The host's network connectivity is stored in a connectivity matrix. The attack template includes the preconditions and postconditions for atomic attacks, as well as the probability of success.
[0021] Step 3.3: Traverse the causal relationships of nodes in the attack template and construct nodes based on the currently input network configuration information. During the construction process, there may be one or more arcs between a pair of nodes, meaning that the source node can instantiate one or more vulnerabilities from the target node. This conflicts with the directed acyclic graph. Consider simplifying all arcs corresponding to the source node to the target node into a single path, and then calculate the probability of the union of these vulnerability exploits as the success probability of the aggregated arc. Since the chance of the source node A reaching the target node B increases proportionally with the number of vulnerabilities B exhibited, there is no loss in the simplification process from the perspective of the attack path. Independent nodes are nodes that have neither ancestors nor descendants. The state of these nodes is represented as being unrelated to the target node, or as being part of the target node. No attacker can reach them. The depth-first search algorithm starting from the target state node can effectively avoid these independent nodes.
[0022] Step 3.4: Calculate the local conditional probability of all non-root nodes in the graph. The nodes in the model are similar to noisy OR nodes. The calculation formula for node i is as follows:
[0023] p(x i =1|pa i )=1-∏ j (1-p(x i =1|x j ))
[0024] Among them, pa i For all parent nodes of node i, j∈pa i ,p(x i =1|x j This is obtained through the prior probability calculation in the previous step, that is, when the parent node x... j Regardless of whether the value is 0 or 1, the child node x i The probability of 1 occurring.
[0025] For all root nodes, a Bernoulli prior (the probability that these nodes will be used) must be specified. All these probability distributions, whether for root nodes (Bernoulli prior) or non-root nodes, follow an uncertain prior and have a certain degree of subjectivity. However, Bayesian network models are robust to the imprecision of the prior, and these assumptions can be updated based on new knowledge later.
[0026] Step 4: Add unknown nodes. Based on the Bayesian attack graph generated in Step 3, mark the feature nodes based on the added domain, that is, assign values to the unf field in the node, perform atomic combination node attribute checks, and add unknown risk nodes.
[0027] Step 4.1: Classify the nodes on the Bayesian attack graph into four types based on the added domain;
[0028] in,
[0029] Class A nodes: The current node and its child nodes belong to the added field;
[0030] Category B nodes: The current node and its child nodes do not belong to the added field;
[0031] Class C nodes: Independent nodes that do not belong to the added domain;
[0032] Class D nodes: Independent nodes that belong to the added domain.
[0033] Step 4.2: Based on the node classification in Step 4.1, assign category attributes to the root node and non-root nodes, i.e., assign the unf attribute; where, the root node is assigned the value of either a type A node or a type B node; the non-root node is assigned the value of one of the types A, B, C, or D nodes according to the actual needs.
[0034] There are eight types of node atom combinations:
[0035] The first method: A, which involves adding the current node and all its child nodes to the added field;
[0036] The second method: B, which involves removing the current node and all its child nodes from the added field;
[0037] The third type: AB, where a B-type node is located in the addition field of a A-type node, and the attributes of the B-type node will override the attributes defined by the A-type node; that is, the current B-type node and its child nodes are removed from the addition field;
[0038] The fourth type: AC, where a C-type node is a child node of an A-type node, meaning the current C-type node is removed from the added domain;
[0039] The fifth type: BD, where a D-type node is a child node of a B-type node, that is, the current D node is added to the field.
[0040] The sixth type: BA, where a node of type A is a child node of a node of type B, that is, the current node A and its child nodes are added to the field.
[0041] The seventh type: AD, where a D-type node is a child node of a A-type node. Since the attribute semantics of D-type nodes and A-type nodes are consistent, adding a D-type node in this case does not change the added field.
[0042] The eighth type: BC. C-type nodes belong to the added fields of B-type nodes. Since the attribute semantics of C-type nodes and B-type nodes are consistent, the addition of C-type nodes does not change the added fields in this case.
[0043] Step 4.3: Node attribute check: Based on the attribute values assigned in Step 4.2, check the node attributes of the atomic combination. For the seventh and eighth combinations mentioned above, the subsequent node is an invalid assignment.
[0044] Step 4.4: Add unknown risk nodes. A graph search algorithm is used to traverse the Bayesian attack graph after attribute assignment. For each traversed node, a condition is determined. If the condition is met, an unknown risk node is added to the current node. The condition determination method is as follows: Determine the type attribute of the current node and, based on the attribute, determine whether the current node belongs to the addition domain; if the current node belongs to the addition domain, determine whether the current node is a leaf node. If it is a leaf node, continue searching; if it is a non-leaf node, add an unknown risk node to the current node; if the current node does not belong to the addition domain, continue searching until the search is complete, thus completing the addition of the unknown risk node.
[0045] Step 5: Risk Assessment: Risk assessment based on marginal probability is performed using the Bayesian network inference formula, and the Bayesian network is updated with beliefs based on the maximum a posteriori probability estimate.
[0046] Marginal probability is calculated using variable elimination based on the joint probability distribution, representing the probability that the target node is destroyed. Maximum a posteriori estimation (MAP) is used to update the beliefs of the Bayesian network; the inference formula is as follows: Where θ is the probability parameter of the Bayesian diagram, D is the event that has already occurred, that is, based on the event that has already occurred as a sample, the maximum possible parameter θ follows the distribution of that sample, P(D) is known, P(θ) is the prior probability, therefore P(θ|D)∝P(D|θ)×P(θ), that is That is, the posterior probability of the parameter θ, let The prior probability of a node is updated using the result of the maximum a posteriori probability estimation; where, This represents the maximum possible value of θ. As the number of samples D increases, the weight of the prior probability P(θ) decreases, which is why Bayesian networks can reduce subjectivity.
[0047] This concludes the implementation of a Bayesian network-based method for assessing unknown risks in intelligent connected vehicles using graph search.
[0048] This invention also proposes a system for implementing the above evaluation method. The system architecture includes three layers: an input layer, an intermediate layer, and an output layer. The system architecture diagram is shown below. Figure 4 As shown. The input layer includes an asset entry module, a vulnerability input module, and a template construction module; the middle layer includes an attack graph generation module; and the output layer includes a belief update module and a risk assessment module.
[0049] The asset entry module is used to enter the assets contained in the intelligent connected vehicle system as a whole, including the vehicle software system, sensors, ECU, cloud platform IP, and roadside units.
[0050] The vulnerability input module is used to input CVE vulnerabilities, CNVD vulnerabilities, and custom attack actions found on the input assets.
[0051] The template building module is used to analyze and format the network topology of the input assets and vulnerabilities to build attack templates.
[0052] The attack graph generation module is used to generate a Bayesian attack graph based on the information of the attack template, and add unknown risk nodes after assigning values to the nodes.
[0053] The belief update module is used to update the prior probability weights of new knowledge for single-record input and batch input. The batch input supports formatted data TXT files and Excel files.
[0054] The risk assessment module is used to assess the marginal probabilities of observed variables and to solve the problem of assessing the maximum path probability of sequential structures.
[0055] The beneficial effects of this invention are as follows: Starting from the perspective of assessing unknown safety risks of intelligent connected vehicles, this invention adopts attribute definition, uses attack templates to generate Bayesian attack graphs, and constructs a method for adding unknown attack nodes to the Bayesian attack graph based on graph search algorithms and added domains. This allows the use of Bayesian attack graphs to assess unknown safety risks of intelligent connected vehicles. Furthermore, based on new knowledge, the prior probability parameters are adjusted according to the maximum posterior probability estimation to reduce subjectivity, thus providing diversity for methods of assessing unknown safety risks of intelligent connected vehicles. Attached Figure Description
[0056] Figure 1 This is a flowchart of the Bayesian network-based method for assessing unknown risks in intelligent connected vehicles based on graph search, as described in this invention.
[0057] Figure 2 This is a schematic diagram illustrating an example of a denial-of-service attack on the OBD bus in an intelligent connected vehicle according to an embodiment of the present invention.
[0058] Figure 3This is a Bayesian attack diagram of a denial-of-service attack on the OBD bus in an intelligent connected vehicle according to an embodiment of the present invention.
[0059] Figure 4 This is a system architecture diagram of the evaluation system of this invention. Detailed Implementation
[0060] The invention will be further described in detail below with reference to the specific embodiments and accompanying drawings. Except for the contents specifically mentioned below, the processes, conditions, and experimental methods for implementing the invention are all common knowledge and general knowledge in the art, and the invention does not have any particular limitations.
[0061] like Figure 1 As shown, a method for assessing unknown risks in intelligent connected vehicles based on graph search optimization using Bayesian networks consists of three steps.
[0062] Step 1: Model the node attributes, exploit t, and attack template to construct a Bayesian attack graph.
[0063] Step 2: Add unknown nodes. Based on the Bayesian attack graph generated in Step 1, mark feature nodes based on the added domain, perform atomic combination node attribute checks, and add unknown risk nodes.
[0064] Step 2.1: Classify the nodes on the Bayesian attack graph into four types based on the added domain;
[0065] Step 2.2: Based on the node classification in Step 2.1, assign category attributes to the root node and non-root nodes;
[0066] Step 2.3: Based on the attribute values assigned in Step 2.2, check the node attributes of the atomic combination;
[0067] Step 2.4: Add unknown risk nodes. Use a graph search algorithm to traverse the Bayesian attack graph after assigning attribute values. Perform condition judgment on each node traversed. When the condition is met, add an unknown risk node to the current node.
[0068] Step 3: Risk Assessment. Marginal probabilities are calculated using the Bayesian network inference formula. Risk assessment is performed based on the calculation results. As new knowledge is added, the Bayesian network's beliefs are updated based on maximum a posteriori probability estimation.
[0069] This concludes the implementation of a method for assessing unknown risks in intelligent connected vehicles using Bayesian networks based on graph search optimization.
[0070] Example
[0071] Taking a denial-of-service attack on the OBD bus in a smart connected vehicle as an example, such as Figure 2 The diagram shows a Bayesian attack graph model, where leaf nodes represent attack sources and root nodes represent target nodes. For ease of explanation of the risk assessment algorithm, the attack graph simplifies the attributes and the process of adding unknown risk nodes.
[0072] Let A, B, C, D, E, and U represent the above attack graphs respectively, and we obtain... Figure 3 :
[0073] In this table, nodes A, B, C, D, and E represent known attack nodes, and U represents an unknown attack node. The prior probability distribution table for nodes A, B, and C is as follows:
[0074] Table 1. Prior probability distribution of node A
[0075]
[0076]
[0077] Table 2. Prior probability distribution of node B
[0078]
[0079] Table 3. Prior probability distribution of node C
[0080]
[0081] P(C=T)=∑ A,B∈{T,F} P(C=T,A,B)
[0082] =P(C=T,A=F,B=F)+P(C=T,A=F,B=T)+P(C=T,A=T,B=F)
[0083] +P(C=T,A=T,B=T)=0+0.084+0.084+0.036=0.204P(C=F)=1-P(C=T)=0.796
[0084] Therefore, the probability score for node C, i.e., a UDS denial-of-service attack, is 0.204.
[0085] The prior probability distributions of nodes D and E are shown below:
[0086] Table 4D Prior Probability Distribution of Nodes
[0087]
[0088] Table 5. Prior probability distribution of node E
[0089]
[0090] P(E=T)=∑C，D∈{T,F} P(E=T,C,D)=P(E=T,C=F,D=F)+P(E=T,C=F,D=T)+P(E
[0091] =T,C=T,D=F)+P(E=T,C=T,D=T)
[0092] = 0.1*0.796*0.7 + 0.4*0.796*0.3 + 0.4*0.204*0.7 + 0.4*0.204*0.3
[0093] =0.5572 + 0.1508 + 0.0512 + 0.0245 = 0.7837
[0094] Therefore, the probability score for node E, i.e., OBD denial-of-service attack, is 0.7837.
[0095] Where P(U=T)=P(E=T,C=F,D=F)=0.5572, when the OBD denial-of-service attack occurs, the CAN bus DoS attack does not occur, and the UDS denial-of-service attack does not occur either. That is, the probability score of the E node sending due to the unknown attack is 0.5572.
[0096] The conditional probability tables above are based on historical knowledge, meaning they represent prior probabilities. When new data is obtained, maximum a posteriori probability estimation is performed; this estimation process is standard practice in the industry. The conditional probability tables are then updated based on the estimates—a process known as belief updating. After the update, the above steps can be repeated for risk assessment of the model.
[0097] The scope of protection of this invention is not limited to the above embodiments. Any variations and advantages that can be conceived by those skilled in the art without departing from the spirit and scope of the inventive concept are included in this invention and are protected by the appended claims.
Claims
1. A method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks using graph search, characterized in that, Includes the following steps: Step 1: Model node attributes and vulnerability exploits (t); Step 2: Construct an attack template: Based on the network system's topology information and the vulnerability information obtained using vulnerability scanning tools, construct an attack template; Step 3: Construct a Bayesian attack graph: Based on the information of the attack template, use a graph search algorithm to generate a path attack graph containing the attributes of Step 1; In step 3, starting from the target state, a graph search algorithm is used to construct a Bayesian attack graph. The construction of the Bayesian attack graph specifically includes the following steps: Step 3.1: Select the network security attributes of interest, i.e., specify the status of the attack target; Step 3.2: Construct host configuration file and attack template: The host configuration file includes host network and system configuration, as well as vulnerabilities obtained through vulnerability scanning tools; the host's network connectivity is stored in a connectivity matrix; the attack template includes the preconditions and postconditions of atomic attacks, as well as the probability of success. Step 3.3: Traverse the causal relationships of nodes in the attack template and construct nodes based on the current input network configuration information: During the construction process, there are one or more arcs between a pair of nodes, that is, the source node instantiates one or more vulnerabilities from the target node; consider simplifying all arcs corresponding to the source node to the target node into a single path, and then calculate the probability of the union of these vulnerability exploits as the success probability of the aggregated arc. Use a depth-first search algorithm starting from the target state node to avoid independent nodes that are unrelated to the target node or belong to the target node. Step 3.4: Calculate the local conditional probability of all non-root nodes in the graph. The nodes in the model are similar to noisy OR nodes. The calculation formula for node i is as follows: ， Where pa i For all parent nodes of node i, j∈pa i ,p(x i =1|x j This is obtained through prior probability, i.e., when the parent node x... j Regardless of whether the value is 0 or 1, the child node x i = The probability of 1 occurring; Step 4: Add unknown nodes: Based on the Bayesian attack graph generated in Step 3, mark the feature nodes based on the added domain, that is, assign values to the unf field in the node, perform atomic combination node attribute checks, and add unknown risk nodes; Step 5: Risk Assessment: Risk assessment based on marginal probability is performed using the Bayesian network inference formula, and the Bayesian network is updated with beliefs based on the maximum a posteriori probability estimate.
2. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks using graph search as described in claim 1, characterized in that, In step 1, node attributes are modeled. The nodes include root nodes, leaf nodes, and non-leaf nodes. The basic attributes of a node are represented by a 7-tuple A = (id, pn, cn, kt, p, s, unf). `id` is a unique identifier for the current node; the identifier includes the IP address and vulnerability number. pn is the set of parent nodes, representing a set of source nodes connected to all in-degree edges of this node; cn is the set of child nodes, representing a set of target nodes connected by all out-degree edges of this node; kt is the set of exploits, representing the set of exploits that have occurred at this node; p represents the probability that the current node will be successfully destroyed by the triggered event due to vulnerability exploitation; s represents the state of the node, that is, the violation state reached due to successful exploitation of the vulnerability; `unf` indicates the type of the current node, which is a flag used for conditional judgment when adding an unknown node.
3. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks using graph search as described in claim 1, characterized in that, In step 1, the modeling method for the vulnerability exploit t is as follows: Define a set of nodes A and the dependency relationships D between the nodes, where D is represented as: A×A→[0, 1]; Define a set of preceding nodes A pre ∈A and subsequent node A post ∈A, if the vulnerability is exploited by A pre →A post If true, it is called vulnerability exploitation t: A pre →A post Where → represents a causal relationship between two nodes, if A pre →A post If true, then A pre ≠A post .
4. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 1, characterized in that, In step 2, the exploitation of the vulnerability is described using an atomic attack template. Each vulnerability exploitation includes a vulnerability number, preconditions and postconditions of the atomic attack, and security measurement information. The vulnerability number includes the CVE number and CNVD number. The preconditions include the state of the selected source host of interest, the state of the target host, and the services and network connectivity running on the target host. The postconditions include the state of the target host. If the preconditions are met, the postconditions are unconditionally fulfilled. The security metrics include state information that can be reached by successfully exploiting a vulnerability, which relies on expert knowledge, and the conditional probability of successfully exploiting other vulnerabilities after a successful vulnerability exploit.
5. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 1, characterized in that, Step 2, the construction of the attack template specifically includes the following steps: Step 2.1: Obtain the network system topology map. The information in the topology map includes: the IP addresses of all hosts, operating systems, running services, and network connectivity. Step 2.2: Use a vulnerability scanning tool to perform a security scan on the hosts in the network system to obtain vulnerability information on each host; Step 2.3: Based on the vulnerability obtained in Step 2.2, fill in the attack template configuration file; the configuration file includes the ID of the atomic attack template with the vulnerability number as the ID; the IP of the source host, the current user permission status, the running services and network connectivity preconditions; the postconditions of the target host status; the state information that can be reached by successfully exploiting the vulnerability based on expert knowledge, and the security measurement information of the conditional probability of successfully exploiting other vulnerabilities after the successful exploitation of the vulnerability.
6. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 1, characterized in that, Step 4 specifically includes the following steps: Step 4.1: Classify the nodes on the Bayesian attack graph into four types based on the added domain; Step 4.2: Based on the node classification in Step 4.1, assign values to the root node and non-root nodes, i.e., assign the unf attribute. Step 4.3: Based on the attribute values assigned in Step 4.2, perform node attribute checks on atomic combinations; Step 4.4: Add unknown risk nodes. Use a graph search algorithm to traverse the Bayesian attack graph after assigning attribute values. Perform condition judgment on each node traversed. When the condition is met, add an unknown risk node to the current node.
7. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 6, characterized in that, In step 4.1, the node types are defined as follows: Type A node: the current node and its child nodes belong to the added domain; Type B node: the current node and its child nodes do not belong to the added domain; Type C node: an independent node that does not belong to the added domain; Type D node: an independent node that belongs to the added domain.
8. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 6, characterized in that, In step 4.2, the root node is assigned a value of either a class A node or a class B node, and the non-root nodes are assigned a value of one of the class A, class B, class C, or class D nodes.
9. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 6, characterized in that, In step 4.3, there are eight possible combinations of node atoms: The first method: A, which involves adding the current node and all its child nodes to the added field; The second method: B, which involves removing the current node and all its child nodes from the added field; The third type: AB, where a B-type node is located in the addition field of a A-type node, and the attributes of the B-type node will override the attributes defined by the A-type node; that is, the current B-type node and its child nodes are removed from the addition field; The fourth type: AC, where a C-type node is a child node of an A-type node, meaning the current C-type node is removed from the added domain; The fifth type: BD, where a D-type node is a child node of a B-type node, meaning the current D-type node is added to the field. The sixth type: BA, where a node of type A is a child node of a node of type B, that is, the current node A and its child nodes are added to the field. The seventh type: AD, where a D-type node is a child node of a A-type node. Since the attribute semantics of D-type nodes and A-type nodes are consistent, adding a D-type node in this case does not change the added field. The eighth type: BC. C-type nodes belong to the added fields of B-type nodes. Since the attribute semantics of C-type nodes and B-type nodes are consistent, the addition of C-type nodes does not change the added fields in this case.
10. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks according to claim 6, characterized in that, In step 4.4, the method for condition judgment is as follows: determine the type attribute of the current node, and determine whether the current node belongs to the addition domain based on the attribute; if the current node belongs to the addition domain, determine whether the current node is a leaf node; if it is a leaf node, continue the search; if it is a non-leaf node, add an unknown risk node to the current node. If the current node does not belong to the domain to be added, continue searching until the search is complete, and then the addition of the unknown risk node is finished.
11. The method for assessing unknown risks of intelligent connected vehicles based on Bayesian networks using graph search according to claim 1, characterized in that, In step 5, the marginal probability is the probability of the target node being destroyed calculated using the variable elimination method based on the joint probability distribution. The maximum a posteriori probability estimation is used to update the beliefs of the Bayesian network, and the inference formula is as follows: ,in For the probability parameters of the Bayesian diagram, It refers to events that have already occurred, that is, using already occurred events as samples to find the maximum possible parameters. It follows the distribution of this sample, and P(D) is known. For the prior probability, therefore ,Right now , That is, the parameter we are looking for. Let the posterior probability be . That is, the prior probability of a node is updated using the result of the maximum a posteriori probability estimation; as the number of samples D increases, the prior probability... Its proportion is getting smaller and smaller.
12. A system for implementing the evaluation method as described in any one of claims 1-11, characterized in that, The system architecture comprises three layers: an input layer, a middle layer, and an output layer. The input layer includes an asset entry module, a vulnerability input module, and a template construction module. The middle layer includes an attack graph generation module. The output layer includes a belief update module and a risk assessment module. The asset entry module is used to enter the assets contained in the intelligent connected vehicle system as a whole, including the vehicle software system, sensors, ECU, cloud platform IP, and roadside units. The vulnerability input module is used to input CVE vulnerabilities, CNVD vulnerabilities, and custom attack actions found on the input assets. The template building module is used to analyze and format the network topology of the input assets and vulnerabilities to build attack templates; The attack graph generation module is used to generate a Bayesian attack graph based on the information of the attack template, and add unknown risk nodes after assigning values to the nodes. The belief update module is used for single-record input of new knowledge and batch input to update prior probability weights. The batch input supports formatted data TXT files and Excel files. The risk assessment module is used to assess the marginal probabilities of observed variables and to solve the problem of assessing the maximum path probability of sequential structures.