An automated network security risk assessment method, system, and readable storage medium

Abstract

This invention relates to an automated network security risk assessment method, system, and readable storage medium, belonging to the field of risk assessment technology. The assessment method includes: acquiring assets of a target system and analyzing them to obtain asset information; collecting vulnerabilities from a publicly available vulnerability database and organizing them into vulnerability information; obtaining the threat types corresponding to the vulnerability information and the threat scenarios corresponding to the asset information, wherein there is a correspondence between the threat types and the threat scenarios; constructing an attack tree model library based on the threat types and the vulnerability information, and generating an attack tree corresponding to specific asset information based on the attack tree model library; scoring the attack tree based on set assessment criteria to obtain the assessment result. This invention reduces reliance on the subjective experience of assessors and improves the effectiveness of automotive network security risk assessment.

Description

Technical Field

[0001] This invention relates to the field of risk assessment technology, and in particular to an automated network security risk assessment method, system, and readable storage medium. Background Technology

[0002] Threat Analysis and Risk Assessment (TARA) is an analytical technique used at each stage of the automotive electronic system lifecycle to identify threats and assess their corresponding risks. It allows developers to focus their resources and efforts on cybersecurity activities targeting high-priority threats. Threat analysis helps organizations identify and understand potential security risks, enabling them to take appropriate preventative and response measures to ensure the security of information systems and data. Through in-depth analysis of various attack methods, vulnerabilities, and threat scenarios, organizations can better develop security strategies, strengthen defenses, improve their ability to combat cyberattacks, and ultimately protect critical assets from damage.

[0003] However, current threat analysis and risk assessment methods rely heavily on the subjective experience of assessors, lacking professional model guidance, which may lead to a degree of subjectivity in the assessment results. Summary of the Invention

[0004] To reduce reliance on the subjective experience of assessors and improve the effectiveness of automotive cybersecurity risk assessment, this invention provides an automated cybersecurity risk assessment method, system, and readable storage medium.

[0005] Firstly, the present invention provides an automated network security risk assessment method, which adopts the following technical solution: An automated cybersecurity risk assessment method includes: Acquire the assets of the target system and analyze them to obtain asset information; Collect vulnerabilities from publicly available vulnerability databases and compile them into vulnerability information; Obtain the threat type corresponding to the vulnerability information and obtain the threat scenario corresponding to the asset information, wherein there is a correspondence between the threat type and the threat scenario; An attack tree model library is constructed based on the threat type and the vulnerability information, and an attack tree corresponding to specific asset information is generated based on the attack tree model library. The attack tree is scored based on the established evaluation criteria to obtain the evaluation results.

[0006] Furthermore, in the aforementioned automated network security risk assessment method, the step of acquiring the assets of the target system and analyzing the asset information includes: Collect assets within the target system's asset scope using collection tools; The collected assets are classified and prioritized to obtain asset information.

[0007] Furthermore, in the aforementioned automated network security risk assessment method, the step of collecting vulnerabilities from publicly available vulnerability databases and organizing them into vulnerability information includes: Collect vulnerabilities from publicly available vulnerability databases; Vulnerabilities are classified according to vulnerability management assets and vulnerability types to obtain vulnerability information.

[0008] Furthermore, in the aforementioned automated network security risk assessment method, the step of obtaining the threat type corresponding to the vulnerability information and the threat scenario corresponding to the asset information includes: Threat types are classified based on a pre-defined model; Based on the vulnerability information, the specific vulnerability information is associated with the threat type; Identify potential threat scenarios based on the characteristics of asset information.

[0009] Furthermore, in the aforementioned automated network security risk assessment method, the step of constructing an attack tree model library based on the threat type and the vulnerability information includes: Based on the different attack types in the vulnerability information, determine the attack targets to be expressed by different attack tree templates; For each target, list the corresponding attack methods and / or attack techniques; Starting with each attack target, the attack methods and / or attack techniques corresponding to each attack target are decomposed layer by layer to form multiple attack tree templates with the attack target as the root node and the attack methods and / or attack techniques as child nodes, and a risk value is assigned to each node. The collection of attack tree templates constitutes the attack tree model library.

[0010] Furthermore, in the aforementioned automated cybersecurity risk assessment method, the step of generating an attack tree corresponding to specific asset information based on the attack tree model library includes: Based on the threat scenarios corresponding to the asset information, and based on the correspondence between the threat scenarios and the threat types, the threat scenarios are mapped to the corresponding attack tree templates in the attack tree model library; Based on the asset information and threat scenarios, the attack tree template is improved to obtain an attack tree.

[0011] Furthermore, in the aforementioned automated network security risk assessment method, if the asset information corresponds to multiple threat scenarios, the attack tree templates corresponding to the multiple threat scenarios can be combined.

[0012] Furthermore, in the aforementioned automated cybersecurity risk assessment method, the step of refining the attack tree template to obtain an attack tree based on the asset information and threat scenarios includes: Customize the selected attack tree template according to specific asset information and threat scenarios, including adding, deleting or modifying nodes in the attack tree to adapt to the actual situation; Determine the dependencies between nodes in the attack tree template; Based on the vulnerability information, the relevant vulnerabilities and risk values ​​are mapped to the corresponding nodes of the attack tree to obtain a complete attack tree.

[0013] Furthermore, in the aforementioned automated network security risk assessment method, the step of scoring the attack tree based on set assessment criteria to obtain the assessment result includes: Assign a risk value to each node in the attack tree; The attack tree is scored based on the pre-set evaluation criteria for the predicted risk value, and the scoring result is obtained; The evaluation result is generated based on the scoring results and the vulnerability information corresponding to the attack tree.

[0014] Furthermore, the aforementioned automated network security risk assessment method further includes: generating attack paths based on the attack tree; the generation of attack paths based on the attack tree includes: Starting from the root node of the attack tree, analyze along each branch to identify possible attack paths; Based on asset information and threat scenarios, determine the attacker's possible targets and motives; Assign a risk value to each node in the attack tree; From the generated attack paths, select the few attack paths with the highest risk values; Optimize the selected attack paths based on asset information.

[0015] Secondly, the present invention also provides an automated network security risk assessment system, which adopts the following technical solution: An automated cybersecurity risk assessment system includes: The asset analysis module is used to acquire the assets of the target system and analyze them to obtain asset information. A vulnerability database is used to collect vulnerabilities from publicly available vulnerability databases and organize them into vulnerability information. The threat analysis module is used to obtain the threat type corresponding to the vulnerability information and the threat scenario corresponding to the asset information, wherein there is a correspondence between the threat type and the threat scenario; The attack model management module is used to construct an attack tree model library based on the threat type and the vulnerability information, and to generate an attack tree corresponding to specific asset information based on the attack tree model library. It also includes a risk assessment module, which scores the attack tree based on set assessment criteria to obtain assessment results.

[0016] Thirdly, the present invention also provides a readable storage medium, which adopts the following technical solution: A readable storage medium storing computer instructions that, when executed by a processor, implement an automated network security risk assessment method as described in any of the first aspects above.

[0017] In summary, the present invention has at least one of the following beneficial technical effects: 1. Integration of mainstream vulnerability databases: By integrating vulnerability databases from different sources, such as CVE and NVD, more comprehensive and accurate vulnerability information can be obtained. This helps to better identify and understand the potential threats faced by the target system, thereby providing data support for subsequent threat analysis and protection measures; 2. Construction of the Attack Tree Model Library: Traditional threat analysis methods typically focus only on a single attack type or strategy. However, by constructing an attack tree model library containing seven categories, it is possible to more comprehensively cover various possible attack methods, improving the accuracy and effectiveness of threat analysis; 3. Targeted Attack Model Selection: Based on the specific circumstances of the target system and threat scenario, the most suitable attack model can be selected from the attack tree model library. This innovative approach ensures the targeting of threat analysis and avoids a one-size-fits-all approach. 4. Dynamically Generate Attack Trees and Attack Paths: Compared to traditional static analysis methods, this invention can dynamically generate attack trees and attack paths based on real-time vulnerability information and threat intelligence. This makes the analysis results closer to reality and helps in discovering new threats and vulnerabilities. Attached Figure Description

[0018] Figure 1 This is a flowchart of an embodiment of an automated network security risk assessment method of the present invention.

[0019] Figure 2 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0020] Figure 3 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0021] Figure 4This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0022] Figure 5 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0023] Figure 6 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0024] Figure 7 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0025] Figure 8 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0026] Figure 9 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0027] Figure 10 This is a flowchart of another embodiment of an automated network security risk assessment method of the present invention.

[0028] Figure 11 This is a schematic diagram of an embodiment of an automated network security risk assessment system according to the present invention.

[0029] Explanation of the attached diagram labels: 1. Asset Analysis Module; 2. Vulnerability Database; 3. Threat Analysis Module; 4. Attack Model Management Module; 5. Risk Assessment Module. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] The method steps described in this embodiment of the invention can be executed in the order described in the specific implementation, or the execution order of each step can be adjusted according to actual needs, provided that the technical problem can be solved. These are not listed one by one here.

[0032] The following is in conjunction with the appendix Figure 1-11 The present invention will be described in further detail below.

[0033] Reference Figure 1This invention discloses an automated network security risk assessment method, comprising: S1, acquire the assets of the target system and analyze the asset information; S2 collects vulnerabilities from publicly available vulnerability databases and organizes them into vulnerability information; S3, obtain the threat type corresponding to the vulnerability information and obtain the threat scenario corresponding to the asset information, wherein the threat type and the threat scenario have a corresponding relationship; S4, construct an attack tree model library based on the threat type and the vulnerability information, and generate an attack tree corresponding to specific asset information based on the attack tree model library; S5. The attack tree is scored based on the set evaluation criteria to obtain the evaluation result.

[0034] First, relevant assets of the target system (such as an automotive electronic system) are collected, including hardware, software, data, and environmental aspects. The collected assets are then analyzed to obtain asset information, ensuring the accuracy and completeness of the asset data. Simultaneously, vulnerabilities are retrieved from publicly available vulnerability databases, and all retrieved vulnerabilities are organized and filtered to obtain vulnerability information.

[0035] Next, based on the characteristics and classification of vulnerability information, the threat type corresponding to the vulnerability is determined, such as deception, information leakage, denial of service, etc. Simultaneously, based on the attributes and classification of asset information, the threat scenarios corresponding to the asset are determined, such as internal access, external attacks, etc.

[0036] Then, based on threat types and vulnerability information, a corresponding attack tree model library is constructed, including various attack methods, techniques, and steps. Simultaneously, based on specific asset information, applicable attack models are selected to generate corresponding attack trees, demonstrating the attack methods and paths that attackers might employ.

[0037] Finally, evaluation criteria are established, including multiple dimensions such as probability, impact level, and mitigation measures. The generated attack tree is then evaluated to obtain an overall risk assessment result, reflecting the security status of the target system.

[0038] This invention utilizes vulnerability information to construct an attack tree model library that includes different threat types. By combining this with a comprehensive analysis of the target system's asset information, it automatically constructs and evaluates the attack trees that the target system may be subjected to. This facilitates the automation of network security risk assessment and reduces the subjective factors in the assessment results.

[0039] Furthermore, as one embodiment of the present invention, refer to Figure 2 Step S1: Obtain the assets of the target system and analyze the asset information, including: S11, Collect assets within the target system's asset scope using collection tools; S12: Classify and prioritize the collected assets to obtain asset information.

[0040] Specifically, first, select appropriate asset collection tools, such as network scanning tools and asset management tools. Configure the tools to collect all assets within the target system. Run the tools to scan networks, systems, and applications, collecting asset-related data. Next, organize and categorize the collected asset data, for example, by hardware, software, data, network equipment, etc. Assign attributes and identifiers to each asset, such as type, owner, importance, and risk level. Prioritize assets based on their criticality and impact to determine which assets are most important and sensitive to the target system. The organized data constitutes the asset information.

[0041] Furthermore, as one embodiment of the present invention, refer to Figure 3 Step S2: Collect vulnerabilities from publicly available vulnerability databases and organize them into vulnerability information, including: S21, collect vulnerabilities from publicly available vulnerability databases; S22, classify the vulnerabilities according to the vulnerability management assets and vulnerability types to obtain vulnerability information.

[0042] Specifically, first, select some widely used and recognized mainstream vulnerability databases, such as CVE (Common Vulnerabilities and Exposures), NVD (National Vulnerability Database), and CWE (Common Weakness Enumeration). These databases typically provide rich vulnerability information and scoring systems, such as CVSS (Common Vulnerability Scoring System).

[0043] Next, vulnerability acquisition is performed, obtaining data on critical vulnerabilities from the selected vulnerability database, including: Vulnerability ID: A unique identifier for the vulnerability (e.g., CVE-2021-12345). Vulnerability Description: A brief explanation and impact of the vulnerability; Affected assets: List the affected software, systems, and versions; Vulnerability types: Vulnerabilities are classified according to the CWE classification system; CVSS Score: The basic CVSS score for a vulnerability, used to assess the severity of the vulnerability; Score reference information acquisition: Extract reference information related to risk assessment from vulnerability databases, such as known publicly available exploit tools or Proof-of-Concept (PoC), which can be used to assess the exploitability of vulnerabilities; Defense measures and remediation recommendations: These can be used to assess the effectiveness of existing defense measures and the cost of vulnerability remediation.

[0044] Finally, vulnerabilities are screened and categorized to generate vulnerability information. These vulnerabilities are then classified according to the organization's asset management and vulnerability type. Vulnerabilities can be grouped by affected assets, vulnerability type, or severity for subsequent risk assessment and mitigation.

[0045] Furthermore, as one embodiment of the present invention, refer to Figure 4 Step S3, obtaining the threat type corresponding to the vulnerability information and the threat scenario corresponding to the asset information, including: S31, classify threat types based on a pre-defined model; S32, Based on the vulnerability information, associate the specific vulnerability information with the threat type; S33, based on the characteristics of asset information, identify potential threat scenarios.

[0046] Specifically, this embodiment, referencing the STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) model, categorizes threat types into the following seven types: .

[0047] Next, based on the vulnerability description, scope of impact, and other characteristics, the vulnerability information is associated with the aforementioned preset threat types to determine the threat type corresponding to each vulnerability in the vulnerability information.

[0048] At the same time, by combining the asset information, including the characteristics of hardware, software, data and environment, potential threat scenarios can be identified.

[0049] Furthermore, a correspondence is established between the threat types and the threat scenarios. In this embodiment, the mapping table between threat types and threat scenarios is as follows: .

[0050] In step S3, vulnerability information is categorized and associated with preset threat types. Simultaneously, based on the characteristics of the asset information, potential threat scenarios are identified. This will aid in subsequent attack model construction and risk assessment, leading to a better understanding of the system's security threats and risks.

[0051] Furthermore, as one embodiment of the present invention, refer to Figure 5In step S4, an attack tree model library is constructed based on the threat type and the vulnerability information, including: S41, Based on the different types of attacks in the vulnerability information, determine the attack targets to be expressed by different attack tree templates; S42, For each attack target, list the attack methods and / or attack techniques corresponding to each attack target; S43, taking each attack target as the starting point, decompose the attack methods and / or attack techniques corresponding to each attack target layer by layer to form multiple attack tree templates with the attack target as the root node and the attack methods and / or attack techniques as child nodes, and assign a risk value to each node; the set of attack tree templates is the attack tree model library.

[0052] Specifically, first, based on the threat type and the attack types involved in the vulnerability information, the specific attack targets to be described by different attack tree templates are determined. For example, a certain threat type may involve different attack targets such as data breach attacks and denial-of-service attacks.

[0053] Next, based on the characteristics of the target, list the specific attack methods and / or techniques that might be used to achieve that target. Each target may involve multiple attack methods and / or techniques, requiring a comprehensive consideration of existing vulnerability information and security research findings.

[0054] Finally, starting from the target, the attack methods and / or techniques required for that target are gradually decomposed to form a multi-layered attack tree template. Each node represents an attack method and / or technique, and the relationships between nodes represent the dependencies between attack methods and / or techniques. Simultaneously, a risk value is assigned to each node, which can be assessed based on factors such as the potential threat level, difficulty, and probability of the attack method and / or technique.

[0055] Specifically, in the embodiment of threat classification based on the STRIDE model, the attack tree template corresponding to the threat type is shown in the following example: 1. Attack tree template corresponding to the spoofing threat scenario: Root node: Identity disguise related activities ├─ Sub-node 1: Social Engineering Related Activities │ ├─ Child Node 1.1: Pretext Attack Related Activities │ └─ Child Node 1.2: Phishing Attack Related Activities ├─ Sub-node 2: Phishing-related activities │ ├─ Child Node 2.1: Domain Spoofing Related Activities │ └─ Child Node 2.2: Website Imitates Related Activities └─ Child Node 3: Session Hijacking Related Activities ├─ Child Node 3.1: Token Hijacking Related Activities └─ Child node 3.2: Cookie theft related activities; 2. Tampering with the attack tree template corresponding to the (T)Tampering threat scenario: Root node: Data tampering related activities ├─ Child Node 1: File Modification Related Activities │ ├─ Child Node 1.1: Code Injection Related Activities │ └─ Child Node 1.2: File Replacement Related Activities ├─ Child Node 2: Database Injection Related Activities │ ├─ Child Node 2.1: SQL Injection Related Activities │ └─ Child Node 2.2: NoSQL Injection Related Activities └─ Child Node 3: Activities Related to Man-in-the-Middle Attacks ├─ Child Node 3.1: ARP Spoofing Related Activities └─ Child Node 3.2: DNS Hijacking Related Activities; 3. Attack tree template corresponding to the Repudation (R1) threat scenario: Root node: Activities related to repudiation ├─ Child Node 1: Activities related to log tampering │ ├─ Child Node 1.1: Deleting Log-Related Activities │ └─ Child Node 1.2: Activities Related to Forged Logs └─ Child Node 2: Operations related to concealment ├─ Child Node 2.1: Activities Related to Encrypted Communication └─ Child node 2.2: Activities related to using anonymous proxies; 4. Attack tree template for the Information Disclosure (I) threat scenario: Root node: Activities related to information leakage ├─ Child Node 1: Unauthorized Access Related Activities │ ├─ Child Node 1.1: Unauthorized Access Related Activities │ └─ Child Node 1.2: Activities Related to Permission Misconfiguration └─ Sub-node 2: Data breach related activities ├─ Child Node 2.1: Brute-force related activities │ ├─ Child Node 2.1.1: Online Cracking Related Activities │ └─ Child Node 2.1.2: Offline Cracking Related Activities └─ Child Node 2.2: Password Cracking Related Activities ├─ Child Node 2.2.1: Dictionary Attack Related Activities └─ Child node 2.2.2: Rainbow table attack related activities; 5. Attack tree template for Denial of Service (D) threat scenarios: Root node: Activities related to information leakage ├─ Child Node 1: Activities Related to Resource Depletion │ ├─ Child Node 1.1: Memory Exhaustion Related Activities │ └─ Child Node 1.2: CPU Exhaustion Related Activities ├─ Child Node 2: Network Congestion Related Activities │ ├─ Child Node 2.1: SYN Flood Attack Related Activities │ └─ Child Node 2.2: UDP Flood Attack Related Activities └─ Child Node 3: Application Layer Attack Related Activities ├─ Child Node 3.1: HTTP Flood Attack Related Activities └─ Child node 3.2: Slowloris attack-related activities; 6. Elevation of Privilege (E) Attack tree template corresponding to the threat scenario: Root node: Activities related to elevating privileges ├─ Child Node 1: Horizontal Privilege Escalation │ ├─ Child Node 1.1: Exploiting System Vulnerabilities │ └─ Child Node 1.2: Exploiting Application Vulnerabilities ├─ Child Node 2: Vertical Privilege Escalation │ ├─ Child Node 2.1: Exploiting System Configuration Errors │ └─ Child Nodes 2.2: Inheritance by Access Control └─ Child Node 3: Permission Maintenance ├─ Child Node 3.1: Creating a Backdoor └─ Child node 3.2: Install Rootkit; 7. Attack tree template corresponding to the threat scenario in R2 (Replaying): Root node: Replay attack-related activities ├─ Child Node 1: Network Communication Replay │ ├─ Child Node 1.1: HTTP Replay Attack │ │ ├─ Child node 1.1.1: Retrieve user session │ │ └─ Child Node 1.1.2: Intercept and Replay HTTP Requests │ └─ Child Node 1.2: SSL / TLS Replay Attack │ ├─ Child Node 1.2.1: Intercepting Encrypted Data │ └─ Child Node 1.2.2: Replaying Data Under Specific Conditions └─ Child Node 2: Non-network communication replay ├─ Child Node 2.1: Physical Medium Replay Attack │ ├─ Child node 2.1.1: Copy physical medium │ └─ Child Node 2.1.2: Replay data at appropriate times └─ Child Node 2.2: Authentication Replay Attack ├─ Child Node 2.2.1: Intercept Authentication Token └─ Child node 2.2.2: Replay tokens during the authentication process.

[0056] The attack tree model library is constructed by aggregating the various attack tree templates. The constructed attack tree model library contains multiple attack tree templates. Each attack tree template uses a different attack target as the root node, attack methods and / or attack techniques as child nodes, and assigns a corresponding risk value to each node. This helps to comprehensively understand the attack paths and risk levels of different attack targets, providing a foundation for subsequent risk assessment.

[0057] Furthermore, as one embodiment of the present invention, refer to Figure 6 In step S4, generating an attack tree corresponding to specific asset information based on the attack tree model library includes: S44, based on the threat scenarios corresponding to the asset information, and based on the correspondence between the threat scenarios and the threat types, map the threat scenarios to the corresponding attack tree templates in the attack tree model library; S45, based on the asset information and threat scenarios, improve the attack tree template to obtain an attack tree.

[0058] Specifically, firstly, based on the correspondence between threat scenarios and threat types, attack tree templates in the attack tree model library associated with the threat scenarios in the asset information are determined. Each threat scenario may be associated with one or more attack types; according to the correspondence, the threat scenario is mapped to the corresponding attack tree template.

[0059] Next, based on asset information and relevant threat scenarios, the selected attack tree template is further refined and customized. Depending on the characteristics of the asset information and the requirements of the threat scenarios, nodes, paths, or risk values ​​in the attack tree are added, deleted, or modified to reflect the specific attack paths and risks faced by a particular asset. Simultaneously, depending on the actual situation, the attack tree can be expanded and corrected by incorporating attack methods and / or techniques from the attack tree model library to more accurately describe the potential attack paths of a specific asset.

[0060] Through steps S44 and S45 above, an attack tree corresponding to specific asset information can be generated. This attack tree is based on relevant attack tree templates in the attack tree model library and has been customized and improved according to the asset information and threat scenarios. Such an attack tree will be more targeted and can more accurately describe the threats and potential attack paths faced by a specific asset, providing a foundation for subsequent risk assessment.

[0061] Furthermore, as an embodiment of the present invention, if the asset information corresponds to multiple threat scenarios, the attack tree templates corresponding to the multiple threat scenarios can be combined.

[0062] Specifically, when the target system's asset information faces multiple threat scenarios, the following methods can be considered to combine the mapped attack tree templates: 1. Union and Combination: This method merges the attack tree templates corresponding to various threat scenarios into a single, unified attack tree. This integrates attack paths from different threat scenarios, forming a comprehensive attack tree that covers a wide range of threat situations. 2. Parallel Combination: Each threat scenario's independent attack tree template is retained, forming multiple parallel attack trees. Each attack tree describes the attack path under a specific threat scenario. Parallel analysis allows for simultaneous consideration of the risks of different threat scenarios, as well as the attack methods and vulnerabilities they may share. 3. Serial Combination: Connect attack tree templates from different threat scenarios sequentially to form a continuous attack tree. This allows consideration of the relationships and dependencies between multiple threat scenarios, describing the sequential attack steps that attackers might take.

[0063] By combining attack tree templates corresponding to multiple threat scenarios, a more comprehensive and integrated attack tree can be obtained to support more comprehensive threat analysis and risk assessment of asset information across various threat scenarios.

[0064] Furthermore, as one embodiment of the present invention, refer to Figure 7 Step S45, based on the asset information and threat scenarios, improve the attack tree template to obtain an attack tree, including: S451 allows for customization of the selected attack tree template based on specific asset information and threat scenarios, including adding, deleting, or modifying nodes in the attack tree to adapt to the actual situation. S452, Determine the dependencies between nodes in the attack tree template; S453, based on vulnerability information, maps relevant vulnerabilities and risk values ​​to the corresponding nodes of the attack tree to obtain a complete attack tree.

[0065] Specifically, firstly, the attack tree template is customized. Based on specific asset information and threat scenarios, the selected attack tree template is customized, including adding, deleting, or modifying nodes in the attack tree to adapt to the actual situation. Simultaneously, based on the characteristics of the assets and the needs of the threat scenario, new attack methods or technology nodes can be added, inapplicable nodes can be deleted, or the attributes and relationships of nodes can be modified.

[0066] Secondly, determine the dependencies between nodes in the attack tree template. Nodes in the attack tree represent attack steps or stages, and the dependencies between nodes describe the logical order or sequence of the attacker's actions. Depending on the specific circumstances, dependencies between nodes can be determined, such as prerequisites or sequential execution.

[0067] Finally, vulnerability information and risk values ​​are mapped. Based on the vulnerability information, relevant vulnerabilities and risk values ​​are mapped to the corresponding nodes in the attack tree, thus obtaining a complete attack tree. Vulnerability information can be obtained from vulnerability databases, and specific vulnerabilities can be associated with nodes in the attack tree. This allows for a more accurate description of the vulnerability exploitation portion of the attack path and assigns an appropriate risk value to each node to reflect the degree of risk.

[0068] By following the steps above, the attack tree template can be customized and improved based on specific asset information and threat scenarios to create an attack tree suitable for specific situations. This improvement process can more accurately describe the threat scenario and attack path, and provide a more comprehensive basis for subsequent risk assessments.

[0069] Furthermore, as one embodiment of the present invention, refer to Figure 8 Step S5: Based on the set evaluation criteria, score the attack tree to obtain the evaluation result, including: S51 assigns a risk value to each node in the attack tree; S52, The attack tree is scored based on the preset evaluation criteria for the predicted risk value, and a scoring result is obtained; S53, the evaluation result is generated based on the scoring result and the vulnerability information corresponding to the attack tree.

[0070] Specifically, firstly, a risk value is assigned to each node in the attack tree based on the risk level of the attack step or stage it represents. This can be a quantitative assessment indicator, such as risk level, numerical value, or weight, or a qualitative description, such as high, medium, or low level.

[0071] Next, based on the established evaluation criteria, the attack tree is scored using predefined evaluation methods and rules. Evaluation criteria may include factors such as the risk value of nodes, dependencies between nodes, and the complexity of attack paths. Based on the established evaluation criteria, the nodes of the attack tree are comprehensively evaluated, and the overall score is calculated.

[0072] Finally, based on the scoring results and the vulnerability information corresponding to the attack tree, the assessment results are generated. This may include generating a detailed assessment report listing the risk value, score, and related vulnerability information for each node in the attack tree. The assessment results can be sorted according to the score level, priority, or other indicators to help assessors understand the degree and priority of risks, and then take appropriate security measures.

[0073] Specifically, the established evaluation criteria can be shown in the table below: , .

[0074] To further illustrate the implementation principle of this invention, taking a web application as the target system, an attack tree targeting SQL injection attacks is created as an example. The evaluation process includes: 1. Select an attack model: Based on the target system (web application) and threat scenario (SQL injection attack), select a tamper attack tree template from the attack tree model library; 2. Attack Tree Customization: Customize attack model templates for web application and SQL injection attack scenarios. The following nodes can be added: Root node: tampering with database content Child node: Identifying input validation vulnerabilities Child nodes: Constructing valid SQL injection attack statements Child nodes: bypass web application firewalls; 3. Node Association: Establish relationships between nodes in the attack tree. In this embodiment, all child nodes are directly associated with the root node, as they are all key steps in achieving database tampering. 4. Vulnerability Mapping: Map vulnerabilities related to web applications and SQL injection attacks from mainstream vulnerability databases to corresponding nodes in the attack tree. For example, a known input validation vulnerability can be mapped to the "Identify Input Validation Vulnerabilities" node; 5. Risk Assessment: Assign a risk value to each node in the attack tree. For example, different risk values ​​can be assigned to nodes such as "Identifying Input Validation Vulnerabilities," "Constructing Valid SQL Injection Statements," and "Bypassing Web Application Firewalls" based on factors such as the severity, scope of impact, and exploitability of the vulnerability.

[0075] Furthermore, as one embodiment of the present invention, refer to Figure 9 The evaluation method further includes: S6, Generate an attack path based on the attack tree.

[0076] Specifically, refer to Figure 10 Step S6 includes: S61: Starting from the root node of the attack tree, analyze along each branch to identify possible attack paths; S62, based on asset information and threat scenarios, determines the attacker's possible targets and motives; S63 assigns a risk value to each node in the attack tree; S64: Select the highest risk attack paths from the generated attack paths. S65 optimizes the selected attack paths based on asset information.

[0077] Specifically, based on the generated attack tree, this method can also generate attack paths. An attack path is a series of attack steps an attacker might take to achieve their objective. These attack paths can help assessors identify potential security risks and analyze the techniques and strategies attackers might use. The generation of attack paths mainly includes the following steps: 1. Analyze the attack tree: Starting from the root node of the attack tree, analyze each branch to identify possible attack paths. Consider the risk value and dependencies of each node to determine the key nodes and paths in the attack tree; 2. Identify Attack Targets: Based on the target system's asset information and threat scenarios, determine the attacker's potential goals and motives. This can be inferred from the nodes in the attack tree; for example, the attacker might target sensitive data, critical functions, or system weaknesses. 3. Calculate the risk value: Assign a risk value to each node in the attack tree to measure the potential danger of the node. The risk value can be calculated based on factors such as the severity, exploitability, and scope of impact of the vulnerability. A higher risk value indicates that the node poses a greater threat to system security; 4. Attack Path Filtering: From the generated attack paths, filter out the top few with the highest risk values. These paths represent the most likely avenues for attackers to exploit. Filtering can be based on risk ranking or other evaluation criteria to ensure that the selected attack paths have a high potential risk. 5. Optimize Attack Paths: Optimize the selected attack paths based on actual conditions and security requirements. For example, this can be achieved by eliminating some low-risk nodes or merging similar attack steps to simplify the attack path. The optimized attack path should more accurately reflect the steps and strategies that an actual attacker might take.

[0078] The attack paths generated through the above steps can help assessors identify potential security risks and analyze the techniques and strategies attackers might use. These attack paths can be included as part of the assessment report, providing guidance and recommendations for security improvements to the target system.

[0079] This invention also discloses an automated network security risk assessment system, referring to... Figure 11 The system includes an asset analysis module 1, a vulnerability database 2, a threat analysis module 3, an attack model management module 4, and a risk assessment module 5.

[0080] Asset Analysis Module 1 is used to acquire and analyze the assets of the target system to obtain asset information. Module 1 is responsible for collecting and organizing asset information of the target system, including hardware, data, software, and environmental information. This asset information is then passed as input to Threat Analysis Module 3 to identify potential threats based on asset characteristics.

[0081] Vulnerability Database 2 is used to collect vulnerabilities from the publicly available vulnerability database 2 and organize them into vulnerability information. Vulnerability Database 2 is responsible for obtaining vulnerability information from the publicly available vulnerability database 2 and filtering and classifying it according to policies. The filtered vulnerability information will be passed to Threat Analysis Module 3 and Attack Model Management Module 4.

[0082] The threat analysis module 3 is used to obtain the threat type corresponding to the vulnerability information and the threat scenario corresponding to the asset information, wherein there is a correspondence between the threat type and the threat scenario. The threat analysis module 3 receives asset information from the asset analysis module 1 and, based on the STRIDE model, classifies the threat types into 7 categories. Simultaneously, the threat analysis module 3 also receives filtered vulnerability information from the vulnerability database 2 to associate specific vulnerability data with threat scenarios. The output of the threat analysis module 3 includes vulnerability information categorized by threat type, which will be passed to the attack model management module 4.

[0083] The attack model management module 4 is used to construct an attack tree model library based on the threat type and vulnerability information, and to generate attack trees corresponding to specific asset information based on the attack tree model library. The attack model management module 4 receives categorized vulnerability information from the threat analysis module 3, as well as vulnerability information from the vulnerability database 2. Based on this information, the attack model management module 4 modifies and improves the existing seven attack models. The output of the attack model management module 4 is a series of constructed attack trees, which will be passed to the risk assessment module 5.

[0084] The risk assessment module 5 scores the attack tree based on set assessment criteria to obtain assessment results. The risk assessment module 5 receives the attack tree from the attack model management module 4 and scores it according to the set assessment criteria and methods. The risk assessment module 5 then sorts the assessment results and generates a detailed assessment report.

[0085] This invention also discloses a readable storage medium.

[0086] A computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of an automated network security risk assessment method as described in any of the above embodiments. The computer-readable storage medium may include: any entity or device capable of carrying a computer program, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc. The computer program includes computer program code. The computer program code may be in the form of source code, object code, an executable file, or some intermediate form, etc. The computer-readable storage medium may include: any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc.

[0087] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0088] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a system including a processing module or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0089] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An automated network security risk assessment method, characterized in that, include: Acquire the assets of the target system and analyze them to obtain asset information; Collect vulnerabilities from publicly available vulnerability databases and compile them into vulnerability information; Obtain the threat type corresponding to the vulnerability information and obtain the threat scenario corresponding to the asset information, wherein there is a correspondence between the threat type and the threat scenario; An attack tree model library is constructed based on the threat types and vulnerability information, and an attack tree corresponding to specific asset information is generated based on the attack tree model library. This includes: determining the attack targets to be expressed by different attack tree templates according to different categories of attack types in the vulnerability information; listing the attack methods and / or attack techniques corresponding to each attack target for each attack target; taking each attack target as the starting point, decomposing the attack methods and / or attack techniques corresponding to each attack target layer by layer to form multiple attack tree templates with the attack target as the root node and the attack methods and / or attack techniques as child nodes, and assigning a risk value to each node. The set of attack tree templates is the attack tree model library. Based on the threat scenarios corresponding to the asset information, and based on the correspondence between the threat scenarios and the threat types, the threat scenarios are mapped to the corresponding attack tree templates in the attack tree model library; for the asset information and threat scenarios, the attack tree templates are improved to obtain an attack tree; wherein, improving the attack tree templates to obtain an attack tree includes: customizing the selected attack tree template for the asset information and threat scenarios, the customization including adding, deleting, or modifying nodes in the attack tree to adapt to the actual situation; determining the dependencies between nodes in the attack tree template; and mapping relevant vulnerabilities and risk values ​​to the corresponding nodes of the attack tree based on vulnerability information to obtain a complete attack tree; The attack tree is scored based on the established evaluation criteria to obtain the evaluation results.

2. The automated network security risk assessment method according to claim 1, characterized in that, The acquisition and analysis of the target system's assets to obtain asset information includes: Collect assets within the target system's asset scope using collection tools; The collected assets are classified and prioritized to obtain asset information.

3. The automated network security risk assessment method according to claim 1, characterized in that, The process of collecting vulnerabilities from publicly available vulnerability databases and compiling them into vulnerability information includes: Collect vulnerabilities from publicly available vulnerability databases; Vulnerabilities are classified according to vulnerability management assets and vulnerability types to obtain vulnerability information.

4. The automated network security risk assessment method according to claim 1, characterized in that, The steps of obtaining the threat type corresponding to the vulnerability information and obtaining the threat scenario corresponding to the asset information include: Threat types are classified based on a pre-defined model; Based on the vulnerability information, the vulnerability information is associated with the threat type; Identify potential threat scenarios based on the characteristics of asset information.

5. The automated network security risk assessment method according to claim 1, characterized in that, If the asset information corresponds to multiple threat scenarios, the attack tree templates corresponding to the multiple threat scenarios are combined.

6. The automated network security risk assessment method according to claim 1, characterized in that, The method further includes: generating attack paths based on the attack tree; the generation of attack paths based on the attack tree includes: Starting from the root node of the attack tree, analyze along each branch to identify possible attack paths; Based on asset information and threat scenarios, determine the attacker's possible targets and motives; Assign a risk value to each node in the attack tree; From the generated attack paths, select the few attack paths with the highest risk values; Optimize the selected attack paths based on asset information.

7. An automated network security risk assessment system, applied to the assessment method described in any one of claims 1-6, characterized in that, The system includes: The asset analysis module is used to acquire the assets of the target system and analyze them to obtain asset information. A vulnerability database is used to collect vulnerabilities from publicly available vulnerability databases and organize them into vulnerability information. The threat analysis module is used to obtain the threat type corresponding to the vulnerability information and the threat scenario corresponding to the asset information, wherein there is a correspondence between the threat type and the threat scenario; The attack model management module is used to construct an attack tree model library based on the threat type and the vulnerability information, and to generate an attack tree corresponding to specific asset information based on the attack tree model library. It also includes a risk assessment module, which scores the attack tree based on set assessment criteria to obtain assessment results.

8. A readable storage medium, characterized in that, The readable storage medium stores computer instructions that, when executed by a processor, implement an automated network security risk assessment method as described in any one of claims 1-6.

Images