Intelligent networking automobile-oriented threat analysis method, device, medium and program product

Abstract

Embodiments of the present application provide a threat analysis method, device, medium and program product for intelligent networking cars, relating to the technical field of automobile information security. The method comprises: determining a target attack path corresponding to a target business scenario and a target modeling component corresponding to the target attack path according to a rule library constructed for intelligent networking cars; wherein the rule library is constructed according to the corresponding relationship between each business scenario in a business scenario library and each attack path in an attack path library, and the corresponding relationship between each attack path and each modeling component in a modeling component library; the target business scenario is a business scenario specified by a user from the each business scenario; establishing a threat model by connecting the target modeling component according to the target attack path; and searching for target threat data matched with the threat model from a threat database. The embodiments of the present application can achieve the technical effect of automatically performing threat modeling analysis for intelligent networking cars.

Description

Technical Field

[0001] This application relates to the field of automotive information security technology, and more specifically, to a threat analysis method, device, medium, and program product for intelligent connected vehicles. Background Technology

[0002] With the rapid development of intelligent technologies, automobiles have gradually transformed from traditional mechanical devices into complex systems with strong computing, communication, and control capabilities. At the same time, automotive information security issues such as hacking attacks and malware injections are becoming increasingly prominent. These issues not only easily leak the personal information of drivers and passengers but also easily cause vehicle malfunctions and even serious consequences such as traffic accidents.

[0003] While various solutions exist for addressing automotive information security issues, such as encrypted communication, firmware upgrades, and network monitoring, these solutions still face several challenges and problems: 1. The system structure of connected vehicles is complex, with interconnected components making it difficult to pinpoint which specific components pose information security threats; 2. Each component can be further subdivided into multiple functional modules, and the functional modules to focus on for locating information security threats vary depending on the business scenario; 3. Information security threats take many forms, and locating them requires comprehensive consideration of factors such as the vehicle's external environment, internal state, and communication content, often relying on human experience; 4. The lack of efficient and automated identification and response mechanisms makes it difficult to analyze and respond to automotive information security threats in a timely and accurate manner. Therefore, it is necessary to research an automated threat analysis method for connected vehicles to better address current automotive information security issues. Summary of the Invention

[0004] The purpose of this application is to provide a threat analysis method, device, medium, and program product for intelligent connected vehicles, so as to achieve the technical effect of automatically performing threat modeling and analysis for intelligent connected vehicles.

[0005] In a first aspect, embodiments of this application provide a threat analysis method for intelligent connected vehicles, including:

[0006] Based on a rule base built for intelligent connected vehicles, the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path are determined; wherein, the rule base is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the user-specified business scenario among the various business scenarios.

[0007] A threat model is established by connecting the target modeling components according to the target attack path;

[0008] Search the threat database for target threat data that matches the threat model.

[0009] In the above implementation process, by building a unified rule base and threat database for intelligent connected vehicles, the target attack path and target modeling components corresponding to the user-specified business scenario can be automatically determined according to the rule base to build a threat model, and the target threat data matching the threat model can be automatically searched from the threat database, enabling automatic threat modeling and analysis for intelligent connected vehicles.

[0010] Furthermore, before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on the rule base built for intelligent connected vehicles, the method further includes:

[0011] The functional modules in the electronic information architecture of the intelligent connected vehicle are identified as modeling components, and the various modeling components are obtained to construct the modeling component library;

[0012] The business scenarios processed by the network terminals in the Internet of Vehicles are determined, and the various business scenarios are obtained to construct the business scenario library;

[0013] Determine the attack paths between the various modeling components in each business scenario to obtain the attack paths and construct the attack path library;

[0014] Based on the business scenario library, the attack path library, and the modeling component library, the correspondence between each business scenario and each attack path, and the correspondence between each attack path and each modeling component are determined to construct the rule library.

[0015] In the above implementation process, by pre-constructing a modeling component library based on the functional modules in the electronic information architecture of intelligent connected vehicles, constructing a business scenario library based on the business scenarios processed by the connected terminals in the vehicle network, and constructing an attack path library based on the attack paths between various modeling components under various business scenarios, it is possible to ensure the construction of a unified rule library for intelligent connected vehicles.

[0016] Furthermore, the target attack path is an attack path that includes an external component component, a communication protocol component, and a service processing component; the target modeling component includes the external component component, the communication protocol component, and the service processing component;

[0017] The step of connecting the target modeling component according to the target attack path to establish a threat model includes:

[0018] Based on the target attack path, determine the order of the external component, the communication protocol component, and the service processing component;

[0019] The threat model is established by connecting the external component and the service processing component as nodes, and the communication protocol component as directed edges, according to the specified arrangement.

[0020] In the above implementation process, by taking the external component component and the business processing component in the target modeling component as nodes and the communication protocol component in the target modeling component as directed edges, and connecting the nodes and directed edges according to the arrangement order of the external component component, communication protocol component and business processing component in the target attack path, a threat model can be established, which can ensure the complete and accurate establishment of the threat model.

[0021] Furthermore, after establishing the threat model by connecting the target modeling component according to the target attack path, the method further includes:

[0022] In response to a user-initiated threat model modification request, the modeling tool is invoked to modify the threat model.

[0023] In the above implementation process, by responding to user-initiated threat model modification requests after the threat model is established, and calling the modeling tool to modify the threat model, it is possible to further ensure that the threat model conforms to the target business scenario.

[0024] Furthermore, the step of searching for target threat data matching the threat model from the threat database includes:

[0025] Extract the target execution path from the threat model;

[0026] Determine whether the attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein, there is a correspondence between each threat data and each attack path;

[0027] If the attack path corresponding to any of the threat data is the same as the target execution path, then the threat data is identified as the target threat data.

[0028] In the above implementation process, by extracting the target execution path from the threat model, if the attack path corresponding to any threat data in the threat database is the same as the target execution path, this threat data is identified as the target threat data. This ensures a comprehensive analysis of information security threats in the threat model and accurate acquisition of target threat data.

[0029] Furthermore, the threat model includes at least one data flow path, which comprises a data flow path obtained by connecting a node for characterizing an external component, a node for characterizing a service processing component, and a directed edge for characterizing a communication protocol component.

[0030] Extracting the target execution path from the threat model includes:

[0031] For each data flow path in the threat model, determine the execution start point and execution end point on the data flow path; wherein, the execution start point is the node on the data flow path used to characterize the external component, and the execution end point is the node at the end of the data flow path used to characterize the business processing component of process type or storage type;

[0032] The target execution path is determined based on the element identifiers along the data flow path from the execution start point to the execution end point.

[0033] In the above implementation process, by determining the execution start point and execution end point on the data flow path in the threat model, and determining the target execution path based on the element identifiers between the execution start point and the execution end point, it is possible to ensure that the target execution path required for analyzing information security threats is completely and accurately extracted from the threat model.

[0034] Furthermore, after searching for target threat data matching the threat model in the threat database, the method further includes:

[0035] Based on the attribute information carried by the target threat data, assess the risk indicator value of the target threat data;

[0036] A target threat list is generated based on the attribute information carried by the target threat data and the risk indicator value of the target threat data.

[0037] In the above implementation process, the risk index value of the target threat data is evaluated based on the attribute information carried by the target threat data, and a target threat list is generated based on the attribute information carried by the target threat data and the risk index value of the target threat data. This allows users to provide the risk index value of the target threat data to the user, making it convenient for the user to take countermeasures against target threat data with higher risk index values.

[0038] Furthermore, the method also includes:

[0039] In response to a user's request to build a threat model, the system calls the modeling tools to create a new threat model.

[0040] Search the threat database for target threat data that matches the new threat model.

[0041] In the above implementation process, by responding to the user's request to build a threat model, the modeling tool is invoked to create a new threat model, which can meet the user's need to build a threat model for the target business scenario.

[0042] Secondly, embodiments of this application provide a threat analysis device for intelligent connected vehicles, comprising:

[0043] The modeling data acquisition module is used to determine the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on the rule base built for intelligent connected vehicles; wherein, the rule base is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the business scenario specified by the user among the various business scenarios;

[0044] The threat model building module is used to connect the target modeling component according to the target attack path and build a threat model.

[0045] A threat data analysis model is used to find target threat data that matches the threat model from a threat database.

[0046] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor implements the method described above when executing the computer program.

[0047] Fourthly, embodiments of this application provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the method described above.

[0048] Fifthly, embodiments of this application provide a computer program product including instructions that, when executed by a computer, cause the computer to perform the method described above. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1A flowchart illustrating a threat analysis method for intelligent connected vehicles provided in the first embodiment of this application;

[0051] Figure 2 This is a schematic diagram of the threat model exemplified in the first embodiment of this application;

[0052] Figure 3 A schematic diagram of a threat analysis device for intelligent connected vehicles provided in the second embodiment of this application;

[0053] Figure 4 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. Detailed Implementation

[0054] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0055] It should be noted that in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance. Furthermore, the step numbers in the text are only for the convenience of explaining the embodiments of this application and are not intended to limit the order in which the steps are performed. The methods provided in the embodiments of this application can be executed by related terminal devices, and the following descriptions all use a user terminal as the execution subject.

[0056] It should be noted that user terminals include terminal devices such as mobile phones, tablets, and computers held by users.

[0057] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a threat analysis method for intelligent connected vehicles provided in the first embodiment of this application. The first embodiment of this application provides a threat analysis method for intelligent connected vehicles, including steps S101 to S103:

[0058] S101. Based on the rule base built for intelligent connected vehicles, determine the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path; wherein, the rule base is built according to the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the business scenario specified by the user in each business scenario.

[0059] S102. Connect the target modeling components according to the target attack path to establish a threat model;

[0060] S103. Search the threat database for target threat data that matches the threat model.

[0061] As an example, a business scenario library, an attack path library, a modeling component library, and a threat database are pre-built for intelligent connected vehicles. Based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path in the attack path library and each modeling component in the modeling component library, a rule library is built. The rule library stores the association rules between each business scenario, each attack path, and each modeling component.

[0062] For example, suppose the business scenario "Near Field Communication" in the business scenario library corresponds to the attack path "RF key → NFC (Near Field Communication) module → cockpit domain controller" in the attack path library, and the attack path "RF key → NFC module → cockpit domain controller" in the attack path library corresponds to the three modeling components "RF key", "NFC module" and "cockpit domain controller" in the modeling component library, then the rule base stores the following association rule: the business scenario "Near Field Communication" - the attack path "RF key → NFC → cockpit domain controller" - the three modeling components "RF key", "NFC module" and "cockpit domain controller".

[0063] When users need to analyze information security threats to intelligent connected vehicles, they can specify any business scenario in the business scenario library as the target business scenario based on the actual application scenario and input the target business scenario into the user terminal.

[0064] After obtaining the target business scenario, the user terminal searches for the corresponding association rules in the rule base. Based on the association rules, it determines the target attack path and the target modeling component corresponding to the target attack path.

[0065] After obtaining the target attack path and target modeling component, the user terminal connects to the target modeling component according to the target attack path to establish a threat model.

[0066] After obtaining the threat model, the user terminal searches the threat database for target threat data that matches the threat model. At this time, the user can view the target threat data and take timely countermeasures against it.

[0067] This application embodiment constructs a unified rule base and threat database for intelligent connected vehicles. Based on the rule base, it can automatically determine the target attack path and target modeling components corresponding to the user-specified business scenario to build a threat model, and automatically search for target threat data matching the threat model from the threat database, enabling automatic threat modeling and analysis for intelligent connected vehicles.

[0068] In an optional embodiment, before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on the rule base constructed for intelligent connected vehicles, the method further includes: determining the functional modules in the electronic information architecture of the intelligent connected vehicle as modeling components to obtain various modeling components and constructing a modeling component library; determining the business scenarios processed by the network terminals in the vehicle network to obtain various business scenarios and constructing a business scenario library; determining the attack paths between various modeling components under various business scenarios to obtain various attack paths and constructing an attack path library; and determining the correspondence between various business scenarios and various attack paths, and the correspondence between various attack paths and various modeling components based on the business scenario library, the attack path library, and the modeling component library, to construct a rule base.

[0069] As an example, the user terminal pre-defines the electronic information architecture of the intelligent connected vehicle into multiple functional modules for the intelligent connected vehicle, identifies the functional modules in the electronic information architecture of the intelligent connected vehicle as modeling components, obtains each modeling component, and constructs a modeling component library based on each modeling component.

[0070] In practical applications, each modeling component in the modeling component library carries unique identification information. For example, the three modeling components "RF key", "NFC module" and "cockpit domain controller" in the modeling component library carry identification information of 2, 3 and 4, respectively.

[0071] Understandably, by building a modeling component library based on multiple functional modules in the electronic information architecture of intelligent connected vehicles, each modeling component in the library can be refined into a functional module within the system components of the intelligent connected vehicle, ensuring more precise threat model building and information security threat analysis in the future.

[0072] For the Internet of Vehicles (IoV) accessed by intelligent connected vehicles, the connected terminals in the IoV are identified, and the business scenarios processed by the connected terminals in the IoV are determined to obtain each business scenario, so as to build a business scenario library based on each business scenario.

[0073] For example, the connected terminals in the Internet of Vehicles include vehicle terminals, management terminals, service terminals and other connected ecosystem terminals. The business scenarios processed by vehicle terminals, management terminals, service terminals and other connected ecosystem terminals are shown in Table 1. The business scenario library stores multiple business scenarios such as "in-vehicle infotainment system", "Internet of Vehicles control unit", "in-vehicle gateway", "remote communication" and "near field communication".

[0074] It should be noted that the vehicle terminal refers to the intelligent connected vehicle, the management terminal includes terminal devices such as mobile phones, tablets and computers held by users, the service terminal includes terminal devices such as servers and cloud servers, and other connected ecosystem terminals include terminal devices used to power the intelligent connected vehicle and terminal devices used on the road to collect driving information of the intelligent connected vehicle.

[0075] Table 1

[0076]

[0077]

[0078] After completing the construction of the business scenario library, the threat items under each business scenario in the business scenario library are determined. Based on the threat items and their corresponding attribute information, such as threat assets, threat categories, attack success rates, damage scenarios, impact levels, and countermeasures, threat data is generated, such as the threat data shown in Table 2. Each threat data is obtained, and a threat database is constructed based on each threat data.

[0079] Table 2

[0080]

[0081]

[0082] After completing the construction of the threat database, the attack paths corresponding to each threat data in the threat database are determined, and each attack path is obtained in order to build an attack path library based on each attack path.

[0083] For example, the attack path corresponding to the threat data shown in Table 2 is "RF key → NFC module → cockpit domain controller".

[0084] For example, in the "TBOX" business scenario, there is a threat data corresponding to the attack path of "UART (Universal Asynchronous Receiver / Transmitter) interface → I / O (Input / Output) module → TBOX".

[0085] After completing the construction of the business scenario library, attack path library, and modeling component library, a rule library is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path in the attack path library and each modeling component in the modeling component library. The rule library stores the association rules between each business scenario, each attack path, and each modeling component.

[0086] It is understandable that since a business scenario corresponds to at least one threat data, and a threat data corresponds to an attack path, a business scenario corresponds to at least one attack path. Furthermore, since an attack path consists of at least two modeling components, an attack path corresponds to multiple modeling components.

[0087] For example, suppose the business scenario "Near Field Communication" in the business scenario library corresponds to the two attack paths "RF Key → NFC Module → Cockpit Domain Controller" and "Bluetooth Interface → ADB (Android Debug Bridge, Command Line Tool) Module → TBOX → I / O Module → Cockpit Domain Controller" in the attack path library. The attack path "RF Key → NFC Module → Cockpit Domain Controller" in the attack path library corresponds to the three modeling components "RF Key", "NFC Module", and "Cockpit Domain Controller" in the modeling component library. The attack path "Bluetooth Interface → ADB Module → TBOX → I / O Module → Cockpit Domain Controller" in the attack path library corresponds to the five modeling components "Bluetooth Interface", "ADB Module", "TBOX", "I / O Module", and "Cockpit Domain Controller" in the modeling component library. Then the rule base stores two association rules as shown in Table 3.

[0088] Table 3

[0089]

[0090] This application embodiment constructs a modeling component library based on the functional modules in the electronic information architecture of intelligent connected vehicles, a business scenario library based on the business scenarios processed by the connected terminals in the vehicle network, and an attack path library based on the attack paths between various modeling components under various business scenarios, thereby ensuring the construction of a unified rule library for intelligent connected vehicles.

[0091] In an optional embodiment, the target attack path is an attack path that includes an external component component, a communication protocol component, and a service processing component; the target modeling component includes an external component component, a communication protocol component, and a service processing component; the step of connecting the target modeling component according to the target attack path to establish a threat model includes: determining the arrangement order of the external component component, the communication protocol component, and the service processing component according to the target attack path; using the external component component and the service processing component as nodes respectively, and the communication protocol component as a directed edge, connecting the nodes and the directed edges according to the arrangement order to establish a threat model.

[0092] As an example, after the user terminal obtains the target attack path and the target modeling component, since the target attack path includes an external component component, a communication protocol component, and a service processing component, the order of the external component component, the communication protocol component, and the service processing component can be determined based on the target attack path.

[0093] It should be noted that external component components are modeling components corresponding to functional modules used to connect to external systems or devices, such as modeling components for "RF key", "Bluetooth interface" and "UART interface"; communication protocol components are modeling components corresponding to functional modules encapsulated with communication protocols, such as modeling components for "NFC module", "ADB module" and "I / O module"; and service processing components are modeling components corresponding to functional modules used to process services, such as modeling components for "cockpit domain controller" and "TBOX".

[0094] In practical applications, business processing components can be divided into process-type business processing components, such as modeling components like "TBOX", and storage-type business processing components, such as modeling components like "vehicle firmware".

[0095] Since the target modeling component includes external component components, communication protocol components, and service processing components, external component components and service processing components can be used as nodes, and communication protocol components can be used as directed edges. The nodes used to represent external component components, the nodes used to represent service processing components, and the directed edges used to represent communication protocol components can be connected in order to form a data flow path and establish a threat model.

[0096] For example, assuming the user terminal obtains two target attack paths: "RF key → NFC module → cockpit domain controller" and "Bluetooth interface → ADB module → TBOX → I / O module → cockpit domain controller," and obtains the target modeling components such as "RF key," "NFC module," "cockpit domain controller," "Bluetooth interface," "ADB module," "TBOX," and "I / O module," then the established threat model would be as follows: Figure 2 As shown.

[0097] This application embodiment establishes a threat model by using external component components and service processing components in the target modeling component as nodes, and communication protocol components in the target modeling component as directed edges. The nodes and directed edges are connected according to the order of external component components, communication protocol components, and service processing components in the target attack path to ensure the complete and accurate establishment of the threat model.

[0098] In an optional embodiment, after connecting the target modeling component according to the target attack path and establishing the threat model, the method further includes: responding to a user-initiated threat model modification request and calling the modeling tool to modify the threat model.

[0099] As an example, after obtaining the threat model, the user terminal can return the threat model to the user, allowing the user to view the threat model and confirm whether the threat model matches the target business scenario.

[0100] When a user determines that a threat model does not conform to the target business scenario, the user can input a threat model modification request into the user terminal to modify the threat model to conform to the target business scenario.

[0101] After receiving a threat model modification request initiated by the user, the user terminal responds to the threat model modification request and calls a pre-developed modeling tool to modify the threat model.

[0102] In practical applications, user terminals can directly call the drawing tool to display the threat model on the drawing area. Based on the user's operation instructions on the drawing area, such as adding nodes, deleting directed edges, and adjusting the direction of directed edges, the threat model can be modified.

[0103] This application embodiment, by responding to a user's request to modify the threat model after establishing the threat model, calls the modeling tool to modify the threat model, thereby further ensuring that the threat model conforms to the target business scenario.

[0104] In an optional embodiment, the step of searching for target threat data matching the threat model from the threat database includes: extracting the target execution path from the threat model; determining whether the attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein, each threat data has a corresponding relationship with each attack path; and if it is determined that the attack path corresponding to any threat data in the threat data is the same as the target execution path, the threat data is determined as the target threat data.

[0105] As an example, after obtaining the threat model, the user terminal extracts the target execution path from the threat model. For each threat data in the threat database, it determines the attack path corresponding to the threat data, judges whether the attack path corresponding to the threat data is the same as the target execution path, and determines the threat data as the target threat data if it is determined that the attack path corresponding to the threat data is the same as the target execution path.

[0106] In practical applications, if multiple target execution paths are extracted from the threat model, then for each threat data in the threat database, it is necessary to determine whether the attack path corresponding to the threat data is the same as each of the multiple target execution paths. If it is determined that the attack path corresponding to the threat data is the same as any of the multiple target execution paths, the threat data is identified as target threat data.

[0107] This application embodiment extracts the target execution path from the threat model. When the attack path corresponding to any threat data in the threat database is the same as the target execution path, this threat data is identified as the target threat data. This can ensure a comprehensive analysis of information security threats in the threat model and accurate acquisition of target threat data.

[0108] In an optional embodiment, the threat model includes at least one data flow path, which comprises a directed edge connecting nodes representing external component components, nodes representing business processing components, and directed edges representing communication protocol components. Extracting the target execution path from the threat model includes: for each data flow path in the threat model, determining the execution start point and execution end point on the data flow path; wherein the execution start point is a node on the data flow path representing an external component component, and the execution end point is a node at the end of the data flow path representing a business processing component of process type or storage type; and determining the target execution path based on the element identifiers between the execution start point and execution end point on the data flow path.

[0109] As an example, after obtaining the threat model, the user terminal can determine each data flow path in the threat model, since the threat model includes at least one data flow path, which includes a data flow path connecting nodes for representing external component components, nodes for representing business processing components, and directed edges for representing communication protocol components. For each data flow path in the threat model, the execution start point and execution end point on the data flow path are determined, where the execution start point is the node on the data flow path used to represent external component components, and the execution end point is the node at the end of the data flow path used to represent business processing components of process type or storage type. Based on the element identifiers between the execution start point and the execution end point on the data flow path, that is, the identifier information carried by the modeling components represented by these elements, such as the nodes and directed edges between the execution start point and the execution end point, the target execution path is determined.

[0110] In practical applications, the user terminal can first determine the various execution starting points in the threat model. Starting from each execution starting point, it traverses to the next node according to the direction indicated by the directed edge connected to the end of the execution starting point. It determines whether the current node has a directed edge connected to its end and whether the current node represents a process-type or storage-type business processing component. If the current node has a directed edge connected to its end, it continues to traverse to the next node according to the direction indicated by the directed edge connected to its end. If the current node does not have a directed edge connected to its end, but the current node does not represent a process-type or storage-type business processing component, it is determined that the data flow path containing the execution starting point and the current node does not contain the target execution path, and the traversal of this data flow path ends. If the current node does not have a directed edge connected to its end, and the current node represents a process-type or storage-type business processing component, then the current node is determined as the execution endpoint, and the target execution path is determined based on the element identifiers on the data flow path from the execution starting point to the execution endpoint.

[0111] For example, assuming the threat model has a data flow path of "UART interface → I / O module → TBOX → I / O module → vehicle firmware", and the identification information of the modeling components such as "UART interface", "I / O module", "TBOX" and "vehicle firmware" are 1, 18, 31 and 35 respectively, then the target execution path is "1, 18, 31, 18, 35".

[0112] This application embodiment determines the execution start point and execution end point on the data flow path in the threat model, and determines the target execution path based on the element identifiers between the execution start point and execution end point, which can ensure that the target execution path required for analyzing information security threats is completely and accurately extracted from the threat model.

[0113] In an optional embodiment, after searching for target threat data that matches the threat model from the threat database, the method further includes: evaluating the risk indicator value of the target threat data based on the attribute information carried by the target threat data; and generating a target threat list based on the attribute information carried by the target threat data and the risk indicator value of the target threat data.

[0114] As an example, risk indicator assessment rules are defined in advance based on the attribute information carried by the threat data, according to actual application needs.

[0115] After obtaining target threat data, the user terminal evaluates the risk indicator value of the target threat data based on predefined risk indicator assessment rules and the attribute information carried by the target threat data.

[0116] For example, suppose the predefined risk indicator assessment rule is to calculate the risk indicator value of the threat data by weighting the score corresponding to the attack success rate carried by the threat data and the score corresponding to the impact level carried by the threat data. If the user terminal obtains the target threat data shown in Table 2, and determines that the score corresponding to the attack success rate carried by the target threat data is 2 and the score corresponding to the impact level carried by the target threat data is 4, then the risk indicator value of the target threat data is 2W. a +4W b Among them, W a and W b The target threat list is generated by weighting the attack success rate and impact level, respectively, and W... a +W b =1.

[0117] Based on the attribute information and risk index values ​​carried by the target threat data, a target threat list is generated. Users can then view the target threat list, identify the target threat data and its risk index values, and prioritize taking countermeasures against target threats with higher risk index values.

[0118] This application embodiment evaluates the risk index value of target threat data based on the attribute information carried by the target threat data, and generates a target threat list based on the attribute information carried by the target threat data and the risk index value of the target threat data. It can provide the risk index value of the target threat data to the user at the same time, so that the user can take countermeasures for target threat data with higher risk index values ​​first.

[0119] In an optional embodiment, the method further includes steps S104 to S105:

[0120] S104. Respond to the user's request to build a threat model and call the modeling tool to create a new threat model;

[0121] S105. Search the threat database for target threat data that matches the new threat model.

[0122] As an example, after obtaining the threat model, the user terminal can return the threat model to the user, allowing the user to view the threat model and confirm whether the threat model matches the target business scenario.

[0123] When a user determines that a threat model is completely inconsistent with the target business scenario, the user can directly input a threat model self-building request into the user terminal to customize and build a new threat model that conforms to the target business scenario.

[0124] After receiving a threat model self-building request initiated by the user, the user terminal responds to the threat model self-building request and calls the pre-developed modeling tools to build the threat model.

[0125] In practical applications, user terminals can directly call drawing tools and build new threat models based on user operation instructions on the drawing area, such as adding nodes, adding directed edges, and connecting nodes and directed edges.

[0126] In practical applications, when users need to analyze information security threats to intelligent connected vehicles, they can also directly input a threat model self-building request into the user terminal to customize and build a threat model that conforms to the target business scenario.

[0127] This application embodiment responds to a user-initiated threat model self-building request and calls modeling tools to build a new threat model, which can meet the user's need for self-building threat models for target business scenarios.

[0128] Please refer to Figure 3 , Figure 3 This is a schematic diagram of a threat analysis device for intelligent connected vehicles provided in the second embodiment of this application. The second embodiment of this application provides a threat analysis device for intelligent connected vehicles, including: a modeling data acquisition module 201, used to determine the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on a rule base constructed for intelligent connected vehicles; wherein, the rule base is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the user-specified business scenario among the various business scenarios; a threat model building module 202, used to connect the target modeling component according to the target attack path to build a threat model; and a threat data analysis model 203, used to search for target threat data matching the threat model from the threat database.

[0129] In an optional embodiment, the apparatus further includes: a rule base construction module, configured to, before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on the rule base constructed for the intelligent connected vehicle, determine the functional modules in the electronic information architecture of the intelligent connected vehicle as modeling components, obtain each modeling component, and construct a modeling component library; determine the business scenarios processed by the connected terminals in the vehicle network, obtain each business scenario, and construct a business scenario library; determine the attack paths between each modeling component under each business scenario, obtain each attack path, and construct an attack path library; and determine the correspondence between each business scenario and each attack path, and the correspondence between each attack path and each modeling component, based on the business scenario library, the attack path library, and the modeling component library, to construct a rule base.

[0130] In an optional embodiment, the target attack path is an attack path that includes an external component component, a communication protocol component, and a service processing component; the target modeling component includes an external component component, a communication protocol component, and a service processing component; the step of connecting the target modeling component according to the target attack path to establish a threat model includes: determining the arrangement order of the external component component, the communication protocol component, and the service processing component according to the target attack path; using the external component component and the service processing component as nodes respectively, and the communication protocol component as a directed edge, connecting the nodes and the directed edges according to the arrangement order to establish a threat model.

[0131] In an optional embodiment, the threat model building module 202 is further configured to respond to a user-initiated threat model modification request and call a modeling tool to modify the threat model after the threat model is built by connecting the target modeling component according to the target attack path.

[0132] In an optional embodiment, the step of searching for target threat data matching the threat model from the threat database includes: extracting the target execution path from the threat model; determining whether the attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein, each threat data has a corresponding relationship with each attack path; and if it is determined that the attack path corresponding to any threat data in the threat data is the same as the target execution path, the threat data is determined as the target threat data.

[0133] In an optional embodiment, the threat model includes at least one data flow path, which comprises a directed edge connecting nodes representing external component components, nodes representing business processing components, and directed edges representing communication protocol components. Extracting the target execution path from the threat model includes: for each data flow path in the threat model, determining the execution start point and execution end point on the data flow path; wherein the execution start point is a node on the data flow path representing an external component component, and the execution end point is a node at the end of the data flow path representing a business processing component of process type or storage type; and determining the target execution path based on the element identifiers between the execution start point and execution end point on the data flow path.

[0134] In an optional embodiment, the threat data analysis model 203 is further configured to, after searching for target threat data that matches the threat model in the threat database, evaluate the risk index value of the target threat data based on the attribute information carried by the target threat data; and generate a target threat list based on the attribute information carried by the target threat data and the risk index value of the target threat data.

[0135] In an optional embodiment, the threat model building module 202 is also used to respond to a user-initiated threat model self-building request and call the modeling tool to build a new threat model; the threat data analysis model 203 is also used to search for target threat data that matches the new threat model from the threat database.

[0136] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0137] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. The third embodiment of this application provides an electronic device 30, including a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the memory 302 is coupled to the processor 301, and when the processor 301 executes the computer program, it implements the method described in the first embodiment of this application and can achieve the same beneficial effects.

[0138] When the processor 301 reads a computer program from the memory 302 via the bus 303 and executes the computer program, it can implement any of the methods described in the first embodiment of this application.

[0139] Processor 301 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 301 may be a microprocessor.

[0140] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 301 of this disclosure embodiment can be used to execute instructions in the memory 302 to implement the method described in the first embodiment of this application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0141] The fourth embodiment of this application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the method described in the first embodiment of this application, and can achieve the same beneficial effects.

[0142] The fifth embodiment of this application provides a computer program product, the computer program product including instructions, which, when executed by a computer, cause the computer to perform the method described in the first embodiment of this application and achieve the same beneficial effects.

[0143] The method described in the first embodiment of this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of this application are executed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0144] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0145] In summary, this application provides a threat analysis method, device, medium, and program product for intelligent connected vehicles. The threat analysis method for intelligent connected vehicles includes: determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on a rule base constructed for intelligent connected vehicles; wherein, the rule base is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the user-specified business scenario among the various business scenarios; connecting the target modeling component according to the target attack path to establish a threat model; and searching for target threat data matching the threat model from the threat database. This application, by constructing a unified rule base and threat database for intelligent connected vehicles, can automatically determine the target attack path and target modeling component corresponding to the user-specified business scenario to establish a threat model based on the rule base, and automatically search for target threat data matching the threat model from the threat database, enabling automatic threat modeling and analysis for intelligent connected vehicles.

[0146] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0147] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0148] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0149] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A threat analysis method for intelligent connected vehicles, characterized in that, include: Based on a rule base built for intelligent connected vehicles, the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path are determined; wherein, the rule base is constructed based on the correspondence between each business scenario in the business scenario library and each attack path in the attack path library, and the correspondence between each attack path and each modeling component in the modeling component library; the target business scenario is the user-specified business scenario among the various business scenarios. A threat model is established by connecting the target modeling component according to the target attack path; wherein, the target attack path is an attack path including an external component component, a communication protocol component, and a service processing component; the target modeling component includes the external component component, the communication protocol component, and the service processing component; The step of connecting the target modeling component according to the target attack path to establish a threat model includes: Based on the target attack path, determine the order of the external component, the communication protocol component, and the service processing component; The threat model is established by connecting the external component and the service processing component as nodes, and the communication protocol component as directed edges, according to the arrangement order. Search the threat database for target threat data that matches the threat model.

2. The method according to claim 1, characterized in that, Before determining the target attack path corresponding to the target business scenario and the target modeling component corresponding to the target attack path based on the rule base built for intelligent connected vehicles, the method further includes: The functional modules in the electronic information architecture of the intelligent connected vehicle are identified as modeling components, and the various modeling components are obtained to construct the modeling component library; The business scenarios processed by the network terminals in the Internet of Vehicles are determined, and the various business scenarios are obtained to construct the business scenario library; Determine the attack paths between the various modeling components in each business scenario to obtain the attack paths and construct the attack path library; Based on the business scenario library, the attack path library, and the modeling component library, the correspondence between each business scenario and each attack path, and the correspondence between each attack path and each modeling component are determined to construct the rule library.

3. The method according to claim 1, characterized in that, After establishing the threat model by connecting the target modeling component according to the target attack path, the method further includes: In response to a user-initiated threat model modification request, the modeling tool is invoked to modify the threat model.

4. The method according to claim 1, characterized in that, The step of searching for target threat data that matches the threat model from the threat database includes: Extract the target execution path from the threat model; Determine whether the attack path corresponding to each threat data in the threat database is the same as the target execution path; wherein, there is a correspondence between each threat data and each attack path; If the attack path corresponding to any of the threat data is the same as the target execution path, then the threat data is identified as the target threat data.

5. The method according to claim 4, characterized in that, The threat model includes at least one data flow path, which is a data flow path obtained by connecting a node for characterizing an external component, a node for characterizing a business processing component, and a directed edge for characterizing a communication protocol component. Extracting the target execution path from the threat model includes: For each data flow path in the threat model, determine the execution start point and execution end point on the data flow path; wherein, the execution start point is the node on the data flow path used to characterize the external component, and the execution end point is the node at the end of the data flow path used to characterize the business processing component of process type or storage type; The target execution path is determined based on the element identifiers along the data flow path from the execution start point to the execution end point.

6. The method according to claim 1, characterized in that, After searching the threat database for target threat data that matches the threat model, the process further includes: Based on the attribute information carried by the target threat data, assess the risk indicator value of the target threat data; A target threat list is generated based on the attribute information carried by the target threat data and the risk indicator value of the target threat data.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: In response to a user's request to build a threat model, the system calls the modeling tools to create a new threat model. Search the threat database for target threat data that matches the new threat model.

8. An electronic device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor, when executing the computer program, implements the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 7.

Images