Vehicle network risk determination method, device and related equipment

Abstract

The present application discloses a risk determination method, device and related equipment for a vehicle network, and relates to the field of network security technology. The method includes: obtaining asset information of at least one asset in the vehicle network, the asset information includes asset type and security attributes, and different at least one asset corresponds to different damage scenarios; determining the impact rating of each asset in a preset multi-dimensional damage type according to the asset type and security attributes of each asset; calculating the damage score of each asset according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type; displaying the evaluation results of the damage scenario in the vehicle network to the user, the evaluation results include at least one asset, the damage score of each asset and the impact rating of the multi-dimensional damage type in each damage score.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to a method, device and related equipment for determining risk of a vehicle network. Background Art

[0002] Intelligent Connected Vehicles (ICVs) are vehicles that integrate advanced information and communication technologies, the Internet, big data, artificial intelligence, and autonomous driving technologies. They can realize intelligent information exchange and sharing between vehicles, vehicles and roads, vehicles and people, and vehicles and networks, and have complex environmental perception, intelligent decision-making, collaborative control and other functions. Since intelligent connected vehicles rely on network connections, in order to ensure the security of vehicle networks, it is necessary to conduct risk assessments on vehicle networks. Existing technologies can conduct risk assessments on vehicle networks through black box models, but such assessment methods are not transparent enough, making the assessment results lack interpretability, resulting in low user trust in the assessment results. Summary of the invention

[0003] The embodiments of the present application provide a vehicle network risk determination method, apparatus, and related equipment, which can improve the interpretability of vehicle network risk assessment and thereby enhance the user's trust in the assessment results.

[0004] In a first aspect, an embodiment of the present application provides a method for determining risk of a vehicle network, the method comprising:

[0005] Acquire asset information of at least one asset in the vehicle network, the asset information including asset type and security attributes, and different at least one asset corresponds to different damage scenarios;

[0006] Determining, according to the asset type and the security attribute of each of the assets, an impact rating of each of the damage types in the preset multi-dimensional damage types for each of the assets;

[0007] Calculate the damage score of each asset according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type;

[0008] An assessment result of the damage scenario in the vehicle network is presented to a user, the assessment result including the at least one asset, a damage score of each of the assets, and an impact rating of the multi-dimensional damage type in each of the damage scores.

[0009] In a second aspect, an embodiment of the present application provides a risk determination device for a vehicle network, the device comprising:

[0010] A first acquisition module is used to acquire asset information of at least one asset in the vehicle network, wherein the asset information includes an asset type and a security attribute, and different at least one asset corresponds to different damage scenarios;

[0011] A first determination module, configured to determine, according to the asset type and the security attribute of each asset, an impact rating of each of the damage types in the preset multi-dimensional damage types for each of the assets;

[0012] A calculation module, configured to calculate a damage score for each of the assets according to the impact rating of the multi-dimensional damage type of each of the assets and a preset weight coefficient for each of the damage types;

[0013] The first display module is used to display the evaluation results of the damage scenario in the vehicle network to the user, wherein the evaluation results include the at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the risk determination method for a vehicle network as described in any one of the above.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, and when the computer program instructions are executed by a processor, a risk determination method for a vehicle network as described in any one of the above items is implemented.

[0016] In a fifth aspect, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the risk determination method for a vehicle network as described in any one of the above.

[0017] The risk determination method, device and related equipment of the vehicle network of the embodiment of the present application can obtain the asset information of at least one asset in the vehicle network, the asset information includes the asset type and security attributes, and different at least one asset corresponds to different damage scenarios; according to the asset type and security attributes of each asset, determine the impact rating of each asset in each damage type in the preset multi-dimensional damage type; according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type, calculate the damage score of each asset; display the evaluation results of the damage scenario in the vehicle network to the user, and the evaluation results include at least one asset, the damage score of each asset and the impact rating of the multi-dimensional damage type in each damage score. In this way, in the embodiment of the present application, the impact rating of each asset in each damage type can be evaluated according to the asset type and security attributes of the asset, and the damage score of each asset can be calculated in combination with the preset weight coefficient of each damage type, and finally the evaluation results of the damage scenario in the vehicle network can be displayed to the user, so that the user can clearly know the at least one asset, the damage score of each asset and the impact rating of the multi-dimensional damage type in each damage score, thereby improving the interpretability of the vehicle network risk assessment, and then enhancing the user's trust in the assessment results. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] Figure 1 is a flow chart of a method for determining risk of a vehicle network provided in an embodiment of the present application;

[0020] Figure 2 This is a workflow diagram of a scenario embodiment provided by an embodiment of the present application;

[0021] Figure 3 is a schematic diagram of a damage scenario assessment workflow provided by an embodiment of the present application;

[0022] Figure 4 It is a schematic diagram of the attack path workflow provided by the embodiment of the present application;

[0023] Figure 5 is a schematic diagram of an attack tree provided in an embodiment of the present application;

[0024] Figure 6 is a schematic diagram of the structure of a risk determination device for a vehicle network provided by another embodiment of the present application;

[0025] Figure 7 It is a structural schematic diagram of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0026] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0027] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0028] Intelligent Connected Vehicles (ICVs) are vehicles that integrate advanced information and communication technologies, the Internet, big data, artificial intelligence, and autonomous driving technologies. They can realize intelligent information exchange and sharing between vehicles, vehicles and roads, vehicles and people, and vehicles and networks, and have complex environmental perception, intelligent decision-making, collaborative control and other functions. Since intelligent connected vehicles rely on network connections, in order to ensure the security of vehicle networks, it is necessary to conduct risk assessments on vehicle networks. Existing technologies can conduct risk assessments on vehicle networks through black box models, but such assessment methods are not transparent enough, making the assessment results lack interpretability, resulting in low user trust in the assessment results.

[0029] In order to solve the problems of the prior art, the embodiments of the present application provide a method, an apparatus and related equipment for determining the risk of a vehicle network. The following first introduces the method for determining the risk of a vehicle network provided by the embodiments of the present application.

[0030] Figure 1 FIG. 1 is a flow chart of a method for determining the risk of a vehicle network provided by an embodiment of the present application. Figure 1 As shown, a method for determining risk of a vehicle network may include the following steps S101 to S104:

[0031] S101, acquiring asset information of at least one asset in a vehicle network, where the asset information includes asset type and security attributes, and different at least one asset corresponds to different damage scenarios;

[0032] S102. Determine the impact rating of each asset for each damage type in the preset multi-dimensional damage types according to the asset type and security attribute of each asset;

[0033] S103. Calculate the damage score of each asset based on the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type;

[0034] S104: Displaying the evaluation results of the damage scenarios in the vehicle network to the user, the evaluation results including at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score.

[0035] The risk determination method of the vehicle network of the embodiment of the present application can obtain the asset information of at least one asset in the vehicle network, the asset information includes the asset type and security attributes, and different at least one asset corresponds to different damage scenarios; according to the asset type and security attributes of each asset, determine the impact rating of each asset in each damage type in the preset multi-dimensional damage type; according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type, calculate the damage score of each asset; display the evaluation results of the damage scenario in the vehicle network to the user, and the evaluation results include at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score. In this way, in the embodiment of the present application, the impact rating of each asset in each damage type can be evaluated according to the asset type and security attributes of the asset, and the damage score of each asset can be calculated in combination with the preset weight coefficient of each damage type, and finally the evaluation results of the damage scenario in the vehicle network can be displayed to the user, so that the user can clearly know the at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score, thereby improving the interpretability of the vehicle network risk assessment, and then enhancing the user's trust in the assessment results.

[0036] In S101, the at least one asset in the vehicle network may be, for example, an actuator, an external interface, a boundary, etc. in the vehicle network. Different at least one asset in the vehicle network corresponds to different damage scenarios.

[0037] The above-mentioned asset information may include asset type and security attributes. For example, in-vehicle information system: asset type: in-vehicle entertainment system; security attributes: confidentiality and integrity protection are required to prevent hackers from stealing or tampering with user data. Communication module: asset type: T-Box; security attributes: authentication and authorization, ensuring that only authorized devices can communicate with the vehicle. Sensors and controllers: asset type: vehicle control unit (ECU); security attributes: integrity and availability, preventing hacker attacks from affecting vehicle control. Data assets: asset type: driving data; security attributes: confidentiality and privacy protection, preventing sensitive data leakage. Mobile applications: asset type: smartphone applications; security attributes: authentication and authorization, ensuring that only legitimate users can control the vehicle. Cloud service platform: asset type: remote monitoring platform; security attributes: confidentiality, integrity and availability, protecting data and services stored in the cloud. In the embodiment of the present application, asset information is not limited to asset type and security attributes, but may also include other key information related to assets, such as asset name and asset identification code, etc., which are not specifically limited here.

[0038] In S102, the above-mentioned multi-dimensional damage types may be, for example, damage types in four dimensions: safety, financial, operational, and privacy.

[0039] The impact ratings of the above damage types may, by way of example, include four levels: negligible, moderate, significant, and severe.

[0040] The above-mentioned Explainable-Artificial Intelligence (XAI) can be used to determine the impact rating of each asset in each pre-set multi-dimensional damage type based on the asset type and security attributes of each asset. Taking the in-vehicle information system as an example, its asset type is the in-vehicle entertainment system, and its security attributes are confidentiality and integrity. Impact analysis: Safety: If the IVI system includes vehicle control functions, data leakage may lead to vehicle control risks, and the impact rating may be severe. Financial: Data leakage may lead to fines and brand reputation loss, and the impact rating may be important. Operational: System unavailability may affect vehicle functions, and the impact rating may be medium. Privacy: If the user's personal information is leaked, the impact rating may be severe.

[0041] In S103, the weight coefficients of the above different damage types may be different.

[0042] The damage score of each asset is calculated based on the impact rating of the multidimensional damage type of each asset and the preset weight coefficient of each damage type. Exemplarily, the XAI model multiplies the impact rating of the multidimensional damage type of each asset by the preset weight coefficient of each damage type, and sums them up to obtain the damage score of each asset.

[0043] In S104, the user may be a security expert or decision maker who ensures vehicle network security.

[0044] The above-mentioned evaluation results may include at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score.

[0045] The above-mentioned display of the evaluation results of the damage scenarios in the vehicle network to the user may, for example, be displaying the evaluation results of the damage scenarios in the vehicle network to the user in the form of an impact heat map or a decision tree, which can help the user understand the evaluation results of the damage scenarios.

[0046] As an implementation of the present application, in order to dynamically assign a weight coefficient to each damage type, before S103, the method may further include:

[0047] Obtain target demand information and historical cases;

[0048] Determine the weight coefficient of each damage type based on target demand information and historical cases;

[0049] The above S103 may specifically include:

[0050] The damage score of each asset is calculated based on the impact rating of the multi-dimensional damage type of each asset and the weight coefficient of each damage type.

[0051] The above target demand information may include business objectives, risk tolerance, compliance requirements, etc.

[0052] The above-mentioned historical cases may be records of events or situations that occurred in the past. For example, they may be recorded cyber attacks, data leaks, system failures or other security-related security incidents; known software or hardware vulnerabilities and the history of their exploitation; they may also be detailed reports of traffic accidents, especially those involving technical failures or network security issues; previously conducted risk assessment cases, including the identification and analysis of potential damage scenarios; compliance review cases related to security and privacy regulations, including violations and corrective measures; historical records of system maintenance, software updates and patch applications; and monitoring data of system performance, including data for normal operation and when problems occur.

[0053] The weight coefficients of each damage type are determined based on the target demand information and historical cases. For example, the XAI model can assign higher weights to security damage types based on the frequency and severity of cybersecurity incidents in historical cases. Considering compliance requirements, such as data protection regulations, higher weights are assigned to damage types involving user privacy. Based on technical limitations, such as the computing power and network connectivity of the vehicle, the weight distribution of the operating damage types is adjusted.

[0054] In the embodiment of the present application, weight coefficients are dynamically assigned to each damage type through target demand information and historical cases, which can provide users with more targeted risk assessment and decision support in vehicle network security.

[0055] As another implementation of the present application, in order to improve the accuracy of the evaluation result of the damage scenario, after the above S104, the above method may further include:

[0056] Receiving first feedback information input by a user according to an evaluation result of a damage scenario;

[0057] The impact rating of each damage type is adjusted according to the first feedback information.

[0058] The first feedback information is feedback information input by the user according to the evaluation result of the damage scenario.

[0059] The above-mentioned adjusting the impact rating of each damage type according to the first feedback information may, illustratively, be adjusting the standard for the impact rating of each damage type in the XAI model according to the first feedback information.

[0060] In an embodiment of the present application, by receiving first feedback information input by the user based on the evaluation results of the damage scenario and adjusting the impact rating of each damage type based on the first feedback information, the accuracy of the evaluation results of the damage scenario can be improved and the security of the vehicle network can be further enhanced.

[0061] As another implementation of the present application, in order to further enhance the security of the vehicle network, after the above S104, the above method may further include:

[0062] Determining a target threat type of the damage scenario based on at least one asset corresponding to the damage scenario;

[0063] In the case where the target threat type exists in a preset threat scenario library, determining the threat scenario corresponding to the target threat type as the target threat scenario, the threat scenario library including at least one threat scenario and the threat type of each threat scenario;

[0064] Searching for at least one attack path associated with a target threat scenario in a preset attack path library, wherein the attack path library includes at least one attack path associated with at least one threat scenario;

[0065] Conduct feasibility assessment on each attack path associated with the target threat scenario according to the preset assessment table to obtain the feasibility rating of each attack path;

[0066] The feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path are displayed to the user, where the target attack path is the attack path corresponding to the highest feasibility rating among the feasibility ratings of at least one attack path associated with the target threat scenario.

[0067] The target threat type of the above damage scenario may be, for example, a tampering threat type.

[0068] The above-mentioned determination of the target threat type of the damage scenario based on at least one asset corresponding to the damage scenario may be, for example, asset identification: first, determine the assets, including data, systems, networks, facilities, etc. Understanding these assets can help identify the risks and threats they may face. Vulnerability assessment: Analyze the vulnerabilities of these assets, that is, the weaknesses or loopholes of the assets, which may be exploited by threat actors. Threat intelligence: Collect relevant threat intelligence, including known attack methods, attacker strategies, and security incidents that have occurred. Attack vector analysis: Determine the attack vectors that attackers may use, such as through network attacks, social engineering, physical intrusion, etc. Threat modeling: Use threat modeling techniques to identify and classify threat types, such as the STRIDE model, which includes six threat types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

[0069] The above-mentioned threat scenario library may include at least one threat scenario and the threat type of each threat scenario. The damage scenario corresponds to the threat scenario.

[0070] The above-mentioned attack path library may include at least one attack path associated with at least one threat scenario.

[0071] The above-mentioned preset evaluation table may include at least one attack potential indicator and a corresponding value of each attack potential indicator.

[0072] The feasibility rating of each attack path associated with the target threat scenario is obtained by performing a feasibility evaluation on each attack path associated with the target threat scenario according to a preset evaluation table. Exemplarily, the feasibility rating of each attack path is obtained by performing a feasibility evaluation on each attack path associated with the target threat scenario according to a preset evaluation table, and then comparing the feasibility score of each attack path with a plurality of preset score intervals to determine the feasibility rating of each attack path, where different score intervals correspond to different feasibility ratings.

[0073] The above-mentioned target attack path is an attack path corresponding to the highest feasibility rating among the feasibility ratings of at least one attack path associated with the target threat scenario.

[0074] In an embodiment of the present application, a threat scenario corresponding to a target threat type of a damage scenario in a preset threat scenario library may be determined as a target threat scenario, and at least one attack path associated with the target threat scenario may be searched in an attack path library, and a feasibility assessment may be performed on each attack path to obtain a feasibility rating of each attack path. Finally, the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path may be displayed to the user, which may help the user to promptly discover potential threats and further enhance the security of the vehicle network.

[0075] In some embodiments, after determining the target threat type of the damage scenario according to at least one asset in the damage scenario, the method further includes:

[0076] When the target threat type does not exist in the threat scenario library, the damage scenario and the target threat type of the damage scenario are stored in the threat scenario library.

[0077] In an embodiment of the present application, when the target threat type does not exist in the threat scenario library, the damage scenario and the target threat type of the damage scenario are stored in the threat scenario library, which can enrich the threat scenario library to meet the ever-changing security needs of the vehicle network.

[0078] In some embodiments, presenting the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user may specifically include:

[0079] Among the feasibility ratings of at least one attack path associated with the target threat scenario, determining the attack path corresponding to the highest feasibility rating as the target attack path;

[0080] Draw an attack tree based on the target attack path. The attack tree includes the attack purpose, attack method, and attack source and target in the target attack path.

[0081] The feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path are displayed to the user, so that the user can view the feasibility rating of at least one attack path associated with the target threat scenario and the attack purpose, attack method, attack source and attack target of the target attack path.

[0082] The above attack tree may include the attack purpose, attack method, and attack source and attack target in the target attack path.

[0083] The above-mentioned display of the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user may, for example, be displaying the feasibility rating of at least one attack path associated with the target threat scenario, such as an attack path diagram, a feasibility heat map, etc., and the attack tree of the target attack path to the user.

[0084] In an embodiment of the present application, a user can intuitively understand at least one attack path associated with a target threat scenario, the feasibility rating of each attack path, and the attack purpose, attack method, attack source, and attack target of the target attack path, thereby enhancing the user's interpretability of the target attack path in the damage scenario, and further enhancing the user's trust in the target attack path.

[0085] As another implementation of the present application, in order to improve the accuracy of the target attack path, after presenting the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, the method further includes:

[0086] receiving second feedback information input by a user based on a feasibility rating of at least one attack path associated with a target threat scenario and an attack tree of the target attack path;

[0087] The parameters in the evaluation table are adjusted according to the second feedback information.

[0088] The second feedback information is feedback information input by the user based on the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path.

[0089] In an embodiment of the present application, by receiving second feedback information input by a user based on a feasibility rating of at least one attack path associated with a target threat scenario and an attack tree of the target attack path, and adjusting the parameters in the evaluation table based on the second feedback information, the accuracy of the target attack path can be improved and the security of the vehicle network can be further enhanced.

[0090] In order to facilitate the understanding of the risk determination method of the vehicle network in the embodiment of the present application, the actual application process of the risk determination method of the vehicle network is described as follows:

[0091] This application proposes a data-driven inheritance mechanism to perform threat analysis and risk assessment (TARA). Figure 2 ,This mechanism systematically guides the user through the entire assessment process in the following order: drawing ,data flow diagram-asset description-damage scenario-threat scenario-attack path-risk assessment-security concept-risk assessment.,Through this orderly step, the present application ensures the comprehensiveness and ,systematicness of the TARA assessment.

[0092] At the same time, this application uses the XAI algorithm model to perform AI automatic evaluation in the impact rating process of the damage scenario and the attack feasibility rating process, and explains the evaluation process and provides evaluation visualization, such as feature dependency graphs, allowing users to query and explore specific decision points in the rating process, thereby improving the efficiency and accuracy of the evaluation process.

[0093] 1. Data flow diagram:

[0094] This application integrates multiple key security components in the data flow graph design, including actuators, external interfaces, boundaries, etc., and each component is equipped with corresponding security measures. These security components are flexible, and users can choose to define them as assets as needed and assign asset types and security attributes to them. Once a security component is defined as an asset, the system automatically extracts its attributes and prepares them as input data for the XAI algorithm model.

[0095] The system will integrate the asset data extracted from the data flow graph into the XAI algorithm model, and the algorithm will analyze the data to identify potential damage scenarios and attack paths.

[0096] 2. Asset Description:

[0097] The asset description module will automatically identify and inherit components that are clearly identified as assets in the data flow diagram. The module will automatically fill in key information such as asset ID, asset name, asset type, and security attributes, thereby realizing automated management and recording of asset information. This design not only improves the efficiency of data management, but also ensures the consistency and accuracy of information.

[0098] 3. Damage scenario:

[0099] The damage scenario assessment process for this application will be based on Figure 3 The steps are as follows:

[0100] Step 1: The user describes the damage scenario. Based on the XAI model, the system automatically assigns a preliminary impact rating to the damage type in the four key dimensions (SFOP) of safety, financial, operational, and privacy according to the data flow diagram and the description of the damage scenario, including negligible, moderate, important, and severe levels.

[0101] Step 2: The XAI model dynamically assigns the importance weight (i.e., the weight coefficient) of each damage type based on the specific requirements of the system (equivalent to the target requirement information mentioned above) and historical cases.

[0102] Step 3: The system automatically adjusts the impact rating of each key dimension by analyzing the description of the damage scenario and the asset information (asset type and security attributes) in the data flow diagram, and uses scores to quantify the impact of the input damage rating in the four dimensions.

[0103] Step 4: The system automatically calculates the product of the weight of each damage type and the impact rating score, and accumulates the results to generate a comprehensive score (i.e. the damage score mentioned above).

[0104] Step 5: The XAI model provides transparency into the decision-making process, showing how the final damage impact rating is derived from the comprehensive score, including the rating logic and basis.

[0105] Step 6: The system provides visual explanations, such as influence heat maps or decision trees, to help users understand the logic behind the rating results.

[0106] Step 7: Users can provide feedback on the evaluation results, and the XAI model will self-learn and optimize based on the feedback to improve the accuracy of the evaluation model.

[0107] 4. Threat scenarios and threat scenario library:

[0108] The construction of threat scenarios has been significantly simplified in this application. By leveraging the built-in threat scenario library, pre-defined threat patterns can be easily selected and applied, greatly reducing the workload and complexity of manual input.

[0109] Function: Displays threat scenario library data in a list format, and can also be added, deleted, edited, and viewed.

[0110] Page logic: As the number of projects increases, this application can dynamically enrich the scenario library to adapt to the changing network security needs. The scenario library can be privately maintained to ensure that the data in the library meets the security standards and requirements of a specific organization. An efficient screening mechanism is achieved through intelligent classification of asset classification and threat types. For example, when the user specifies the threat classification of the threat scenario (equivalent to the above threat type) as "tampering", the system will automatically filter out all threat items related to "tampering" from the threat scenario library, thereby significantly reducing the matching time and the number of matching rows. This application supports association with the R155 regulatory appendix, and at the same time, provides an explanation function for the inapplicability of the R155 appendix to help users understand the application limitations of the standard in specific circumstances.

[0111] 5. Attack path and attack path library:

[0112] The construction of attack paths in this application is achieved through an efficient attack path library, which provides a systematic method to populate and evaluate potential attack paths. The specific steps can be seen in Figure 4 ,as follows:

[0113] Step 1: The attack path library integrates detailed attack path information, including threat scenario ID, description, attack path ID, description, and key factors such as experience time, expertise, etc.

[0114] Step 2: The XAI model analyzes the data in the data flow graph and automatically fills in the experience time, expertise, knowledge of the components, opportunity windows, and equipment based on the existing security measures of the components and the data flow.

[0115] Step 3: The system automatically evaluates the feasibility of each attack path through the built-in evaluation tables (Table 1 and Table 2). The XAI model provides transparency and explainability, showing the evaluation process and results.

[0116] Table 1: Example of attack potential summary

[0117]

[0118] Table 2: Example of attack feasibility mapping

[0119]

[0120] Step 4: For attack paths (equivalent to the above target attack paths) whose attack feasibility analysis results (i.e., the above feasibility rating) are high, the system will automatically draw an attack tree and associate the number of the attack tree with the attack path number.

[0121] Step 5: The system provides visual evaluation results, such as attack path diagrams, feasibility heat maps, etc., to help users intuitively understand the evaluation status of each path.

[0122] Step 6: The system allows users to provide feedback on the evaluation results. The XAI model is adjusted based on the feedback to optimize the evaluation logic and parameters.

[0123] 6. Attack Tree

[0124] Function: Expand the attack path in a tree format to provide a visual view.

[0125] Page logic: such as Figure 5 The list view shown shows the attack source, attack target and related description. The top layer of the attack tree represents the attack purpose, indicating the benefits that can be brought to the attacker. The attack target is the target that meets the attack purpose. The attack method indicates how to reach the attack target, while the bottom layer represents the attack source, that is, the asset attack, the leaf node, and the attack tree number. The attack tree number follows the logical generation rules to ensure that the structure and hierarchy of each tree are clear and identifiable. The numbering system of the attack tree is associated with the high-feasibility attack path number in the attack path library. This association allows users to quickly identify and evaluate those attack trees corresponding to high-risk attack paths, thereby improving the efficiency and pertinence of risk management. The attack tree can support: attack target severity assessment; attack method possibility assessment; network security requirements derivation; network security control priority sorting. The attack tree method can be used for analysis at all levels, including system level, hardware level and software level.

[0126] Based on the vehicle network risk determination method provided in the above embodiment, the present application also provides a specific implementation of the vehicle network risk determination device. Please refer to the following embodiment.

[0127] like Figure 6 As shown, the risk determination device 600 for a vehicle network provided in an embodiment of the present application may include the following modules: a first acquisition module 601 , a first determination module 602 , a calculation module 603 and a first display module 604 .

[0128] A first acquisition module 601 is used to acquire asset information of at least one asset in the vehicle network, where the asset information includes asset type and security attributes, and different at least one asset corresponds to different damage scenarios;

[0129] A first determination module 602 is used to determine the impact rating of each asset for each damage type in the preset multi-dimensional damage type according to the asset type and security attribute of each asset;

[0130] A calculation module 603 is used to calculate the damage score of each asset according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type;

[0131] The first display module 604 is used to display the evaluation results of the damage scenario in the vehicle network to the user, where the evaluation results include at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score.

[0132] The risk determination device of the vehicle network of the embodiment of the present application can obtain the asset information of at least one asset in the vehicle network, the asset information includes the asset type and security attributes, and different at least one asset corresponds to different damage scenarios; according to the asset type and security attributes of each asset, determine the impact rating of each asset in each damage type in the preset multi-dimensional damage type; according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type, calculate the damage score of each asset; display the evaluation results of the damage scenario in the vehicle network to the user, and the evaluation results include at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score. In this way, in the embodiment of the present application, the impact rating of each asset in each damage type can be evaluated according to the asset type and security attributes of the asset, and the damage score of each asset can be calculated in combination with the preset weight coefficient of each damage type, and finally the evaluation results of the damage scenario in the vehicle network can be displayed to the user, so that the user can clearly know the at least one asset, the damage score of each asset, and the impact rating of the multi-dimensional damage type in each damage score, thereby improving the interpretability of the vehicle network risk assessment, and then enhancing the user's trust in the assessment results.

[0133] As an implementation of the present application, in order to dynamically assign a weight coefficient to each damage type, the above-mentioned device 600 may further include:

[0134] The second acquisition module is used to obtain target demand information and historical cases;

[0135] The second determination module is used to determine the weight coefficient of each damage type based on target demand information and historical cases;

[0136] The calculation module 603 may be specifically used to calculate the damage score of each asset based on the impact rating of the multi-dimensional damage type of each asset and the weight coefficient of each damage type.

[0137] As another implementation of the present application, in order to improve the accuracy of the evaluation result of the damage scene, the above-mentioned device 600 may also include:

[0138] A first receiving module, used to receive first feedback information input by a user according to an evaluation result of a damage scenario;

[0139] The first adjustment module is used to adjust the impact rating of each damage type according to the first feedback information.

[0140] As another implementation of the present application, in order to further enhance the security of the vehicle network, the above-mentioned device 600 may also include:

[0141] A third determination module is used to determine a target threat type of the damage scenario according to at least one asset corresponding to the damage scenario;

[0142] a fourth determination module, configured to determine a threat scenario corresponding to the target threat type as the target threat scenario if the target threat type exists in a preset threat scenario library, wherein the threat scenario library includes at least one threat scenario and a threat type of each threat scenario;

[0143] A search module, used to search for at least one attack path associated with a target threat scenario in a preset attack path library, the attack path library including at least one attack path associated with at least one threat scenario;

[0144] An evaluation module is used to perform a feasibility evaluation on each attack path associated with the target threat scenario according to a preset evaluation table to obtain a feasibility rating of each attack path;

[0145] The second display module is used to display the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, where the target attack path is the attack path corresponding to the highest feasibility rating among the feasibility ratings of at least one attack path associated with the target threat scenario.

[0146] In some embodiments, the apparatus 600 may further include:

[0147] The storage module is used to store the damage scenario and the target threat type of the damage scenario in the threat scenario library when the target threat type does not exist in the threat scenario library.

[0148] In some embodiments, the second display module may specifically include:

[0149] A determination unit, configured to determine, among the feasibility ratings of at least one attack path associated with the target threat scenario, an attack path corresponding to a highest feasibility rating as a target attack path;

[0150] A drawing unit, used for drawing an attack tree according to a target attack path, wherein the attack tree includes an attack purpose, an attack method, and an attack source and an attack target in the target attack path;

[0151] A display unit is used to display the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, so that the user can view the feasibility rating of at least one attack path associated with the target threat scenario and the attack purpose, attack method, attack source and attack target of the target attack path.

[0152] As another implementation of the present application, in order to improve the accuracy of the target attack path, the above-mentioned device 600 may also include:

[0153] A second receiving module is used to receive second feedback information input by a user based on a feasibility rating of at least one attack path associated with a target threat scenario and an attack tree of the target attack path;

[0154] The second adjustment module is used to adjust the parameters in the evaluation table according to the second feedback information.

[0155] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0156] The electronic device may include a processor 701 and a memory 702 storing computer program instructions.

[0157] Specifically, the processor 701 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0158] The memory 702 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 702 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 702 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 702 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 702 is a non-volatile solid-state memory.

[0159] In certain embodiments, the memory 702 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage media device, an optical storage media device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, in general, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0160] The processor 701 implements any one of the vehicle network risk determination methods in the above embodiments by reading and executing computer program instructions stored in the memory 702 .

[0161] In one example, the electronic device may further include a communication interface 703 and a bus 710. Figure 7 As shown, the processor 701, the memory 702, and the communication interface 703 are connected via a bus 710 and communicate with each other.

[0162] The communication interface 703 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0163] Bus 710 includes hardware, software or both, and couples the components of the electronic device to each other. For example, but not limitation, the bus may include an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front-side bus (FSB), a hypertransport (HT) interconnect, an industry standard architecture (ISA) bus, an infinite bandwidth interconnect, a low pin count (LPC) bus, a memory bus, a microchannel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (SATA) bus, a video electronics standard association local (VLB) bus or other suitable bus or a combination of two or more of these. Where appropriate, bus 710 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnect.

[0164] The electronic device can execute the vehicle network risk determination method in the embodiment of the present application, thereby realizing the combination Figure 1 and Figure 6 A method and apparatus for determining risk of a vehicle network are described.

[0165] In addition, in combination with the risk determination method of the vehicle network in the above embodiments, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any of the risk determination methods of the vehicle network in the above embodiments is implemented.

[0166] In combination with the vehicle network risk determination method in the above embodiments, an embodiment of the present application may provide a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes any of the vehicle network risk determination methods as above.

[0167] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0168] The functional blocks shown in the structural block diagram described above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier. "Machine-readable medium" may include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0169] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0170] Aspects of the present disclosure are described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the functions / actions specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0171] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for determining risk of a vehicle network, characterized in that: The method comprises: Acquire asset information of at least one asset in the vehicle network, the asset information including asset type and security attributes, and different at least one asset corresponds to different damage scenarios; Determining, according to the asset type and the security attribute of each of the assets, an impact rating of each of the damage types in the preset multi-dimensional damage types for each of the assets; Calculate the damage score of each asset according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type; Presenting to a user an evaluation result of the damage scenario in the vehicle network, the evaluation result comprising the at least one asset, a damage score of each of the assets, and an impact rating of the multi-dimensional damage type in each of the damage scores; After presenting the evaluation result of the damage scenario in the vehicle network to the user, the method further includes: receiving first feedback information input by the user according to the evaluation result of the damage scenario; adjusting the impact rating of each of the damage types according to the first feedback information; After presenting the evaluation result of the damage scenario in the vehicle network to the user, the method further includes: Determining a target threat type of the damage scenario according to the at least one asset corresponding to the damage scenario; In a case where the target threat type exists in a preset threat scenario library, determining a threat scenario corresponding to the target threat type as the target threat scenario, the threat scenario library including at least one of the threat scenarios and the threat type of each of the threat scenarios; Searching for at least one attack path associated with the target threat scenario in a preset attack path library, wherein the attack path library includes at least one attack path associated with the at least one threat scenario; Performing a feasibility assessment on each of the attack paths associated with the target threat scenario according to a preset assessment table to obtain a feasibility rating for each of the attack paths; Displaying the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, wherein the target attack path is the attack path corresponding to the highest feasibility rating among the feasibility ratings of at least one attack path associated with the target threat scenario; The presenting the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user includes: Among the feasibility ratings of at least one attack path associated with the target threat scenario, determining the attack path corresponding to the highest feasibility rating as the target attack path; Draw an attack tree according to the target attack path, the attack tree including the attack purpose, attack method, and the attack source and attack target in the target attack path; The feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path are displayed to the user, so that the user can view the feasibility rating of at least one attack path associated with the target threat scenario and the attack purpose, the attack method, the attack source and the attack target of the target attack path.

2. The method according to claim 1, characterized in that Before calculating the damage score of each asset according to the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type, the method further includes: Obtain target demand information and historical cases; Determining a weight coefficient for each of the damage types according to the target demand information and the historical cases; The damage score of each asset is calculated based on the impact rating of the multi-dimensional damage type of each asset and the preset weight coefficient of each damage type, including: The damage score of each asset is calculated based on the impact rating of the multi-dimensional damage type of each asset and the weight coefficient of each damage type.

3. The method according to claim 1, characterized in that After determining the target threat type of the damage scenario according to the at least one asset in the damage scenario, the method further includes: In a case where the target threat type does not exist in the threat scenario library, the damage scenario and the target threat type of the damage scenario are stored in the threat scenario library.

4. The method according to claim 1, characterized in that: After presenting the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, the method further includes: receiving second feedback information input by the user based on a feasibility rating of at least one attack path associated with the target threat scenario and an attack tree of the target attack path; The parameters in the evaluation table are adjusted according to the second feedback information.

5. A risk determination device for a vehicle network, characterized in that: The device comprises: A first acquisition module is used to acquire asset information of at least one asset in the vehicle network, wherein the asset information includes an asset type and a security attribute, and different at least one asset corresponds to different damage scenarios; A first determination module, configured to determine, according to the asset type and the security attribute of each asset, an impact rating of each of the damage types in the preset multi-dimensional damage types for each of the assets; A calculation module, configured to calculate a damage score for each of the assets according to the impact rating of the multi-dimensional damage type of each of the assets and a preset weight coefficient for each of the damage types; A first display module, configured to display an evaluation result of the damage scenario in the vehicle network to a user, the evaluation result including the at least one asset, a damage score of each of the assets, and an impact rating of the multi-dimensional damage type in each of the damage scores; The device also includes: A first receiving module, configured to receive first feedback information input by the user according to the evaluation result of the damage scenario; A first adjustment module, configured to adjust the impact rating of each of the damage types according to the first feedback information; The device also includes: A third determination module, configured to determine a target threat type of the damage scenario according to the at least one asset corresponding to the damage scenario; a fourth determination module, configured to determine a threat scenario corresponding to the target threat type as a target threat scenario if the target threat type exists in a preset threat scenario library, wherein the threat scenario library includes at least one of the threat scenarios and the threat type of each of the threat scenarios; A search module, configured to search for at least one attack path associated with the target threat scenario in a preset attack path library, wherein the attack path library includes at least one attack path associated with the at least one threat scenario; An evaluation module, used to perform a feasibility evaluation on each of the attack paths associated with the target threat scenario according to a preset evaluation table to obtain a feasibility rating of each of the attack paths; A second display module is used to display the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, wherein the target attack path is the attack path corresponding to the highest feasibility rating among the feasibility ratings of at least one attack path associated with the target threat scenario; The second display module includes: a determining unit, configured to determine, among the feasibility ratings of at least one attack path associated with the target threat scenario, an attack path corresponding to a highest feasibility rating as a target attack path; A drawing unit, configured to draw an attack tree according to the target attack path, wherein the attack tree includes an attack purpose, an attack method, and an attack source and an attack target in the target attack path; A display unit is used to display the feasibility rating of at least one attack path associated with the target threat scenario and the attack tree of the target attack path to the user, so that the user can view the feasibility rating of at least one attack path associated with the target threat scenario and the attack purpose, the attack method, the attack source and the attack target of the target attack path.

6. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the risk determination method for a vehicle network as described in any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the risk determination method for a vehicle network as described in any one of claims 1 to 4 is implemented.

8. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the risk determination method for a vehicle network as described in any one of claims 1 to 4.

Images