Automatic attack path analysis and evaluation method and device based on large language model

Abstract

The invention provides an automatic attack path analysis and evaluation method and device based on a large language model, and the method comprises the steps: firstly, determining a to-be-analyzed system architecture, determining an attack entrance and an attack exit, constructing a tag tree, and extracting the target information of each tag node in the tag tree; analyzing a potential attack surface and an attack purpose of each tag node in the tag tree by using a large language model; obtaining domain knowledge corresponding to the to-be-analyzed system architecture, and generating an attack tree according to the target information of each label node, the corresponding potential attack surface, the attack purpose and the domain knowledge; and finally, evaluating the feasibility of the attack tree based on a large language model, scoring, and optimizing to obtain a target attack tree. According to the embodiment, the problems of subjectivity, updating difficulty, information abstraction and the like of a traditional threat database-based method are solved, and meanwhile, the method has cross-domain application capability and is suitable for various fields such as intelligent automobiles, intelligent ships, industrial equipment, unmanned aerial vehicles and aerospace.

Description

Technical Field

[0001] The present disclosure relates to the technical field of large language models, and in particular to a method and device for automatic attack path analysis and evaluation based on a large language model. Background Art

[0002] With the leap forward in automotive technology, new modules and sensors such as ADAS, TBOX, gateways, autonomous driving, millimeter waves and lidar are integrated into automobiles. Through the interconnection of vehicle networks, the vehicle functions are improved, but the complexity of the vehicle system and the cybersecurity risks are increased, making the vehicle system more vulnerable to attacks. In response to this, the United Nations WP29 R155e regulation was introduced in 2021, forcing OEMs and Tier 1 suppliers to establish a cybersecurity management system (CSMS) throughout the entire life cycle of the vehicle. However, the regulations do not clarify the details of the CSMS construction, causing implementation difficulties. Subsequently, the ISO 21434 standard came into being to provide a framework for automotive cybersecurity management.

[0003] In related technologies, it is proposed to automatically generate attack paths based on threat databases. However, this automated method has limitations in the field of automotive safety. For example, building a database is time-consuming and labor-intensive, relying on expert experience to cause subjective bias; it is difficult to refine to microscopic components, and analysis is insufficient when updates are frequent; and the method lacks generalization and is only applicable to automobiles, and does not support cross-industry and global regulatory interaction management. Therefore, related technologies are insufficient in meeting the TARA requirements of low-level components and the safety of the entire life cycle. Summary of the invention

[0004] The disclosed embodiments at least provide a method and device for automated attack path analysis and evaluation based on a large language model. By using a large language model to perform automated TARA attack path analysis at the component level or the overall system level throughout the entire life cycle, the problems of subjectivity, update difficulty, and information abstraction in traditional threat database-based methods are overcome. The large language model is combined to obtain domain information to achieve specific scenario reasoning. The method also has cross-domain application capabilities and is suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

[0005] The present disclosure provides an automated attack path analysis and evaluation method based on a large language model, including:

[0006] Acquire a system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; determine an attack entry and an attack exit based on the threat scenarios corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed;

[0007] According to the path finding algorithm, a label tree consisting of a plurality of label nodes is determined based on the plurality of components to be analyzed, the attack entry and the attack exit, and target information of each label node in the label tree is extracted;

[0008] For each label node in the label tree, according to the target information of the label node, determine the potential attack surface corresponding to each label node based on the large language model, and determine the attack purpose corresponding to each label node based on the threat scenario corresponding to each label node based on the large language model;

[0009] Based on the large language model, domain knowledge corresponding to the system architecture to be analyzed is acquired, and an attack tree is generated according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path;

[0010] The attack tree is subjected to feasibility calculation and score calculation based on the large language model, and the attack tree is updated based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

[0011] In some possible embodiments, the system architecture to be analyzed further includes connection relationships between components to be analyzed; and determining a label tree consisting of multiple label nodes based on the multiple components to be analyzed, attack entry points, and attack exit points according to a path finding algorithm includes:

[0012] According to the connection relationship between the components to be analyzed, a label graph is determined based on the multiple components to be analyzed, the attack entry and the attack exit;

[0013] According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

[0014] In some possible embodiments, the system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and the step of extracting target information of each tag node in the tag tree includes:

[0015] Based on the label tree, an associated label node connected to the label node is determined, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

[0016] In some possible embodiments, generating an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge includes:

[0017] For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template;

[0018] For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and a prompt template corresponding to the label node;

[0019] For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node;

[0020] An attack tree is generated based on the attack purpose, attack steps and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic node, and the logic node is connected to each attack step.

[0021] In some possible embodiments, generating an attack tree based on the attack objectives, attack steps, and logic nodes corresponding to each label node includes:

[0022] For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0023] The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0024] In some possible embodiments, merging the processed attack subtrees includes:

[0025] For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree belongs to a special attack step;

[0026] In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of each attack subtree.

[0027] In some possible embodiments, the performing feasibility calculation and score calculation on the attack tree based on the large language model includes:

[0028] Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

[0029] The present disclosure provides an automated attack path analysis and evaluation device based on a large language model, including:

[0030] An architecture acquisition module is used to acquire the architecture of the system to be analyzed; wherein the architecture of the system to be analyzed includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; based on the threat scenarios corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed, an attack entry and an attack exit are determined;

[0031] A label tree determination module, configured to determine a label tree consisting of a plurality of label nodes based on the plurality of components to be analyzed, attack entrances, and attack exits according to a path finding algorithm, and extract target information of each label node in the label tree;

[0032] An information determination module, for each label node in the label tree, determining a potential attack surface corresponding to each label node based on a large language model according to target information of the label node, and determining an attack purpose corresponding to each label node based on the large language model according to a threat scenario corresponding to each label node;

[0033] An attack tree generation module, used to obtain domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node and the domain knowledge; the attack tree includes at least one attack path;

[0034] An attack tree evaluation module is used to perform feasibility calculation and score calculation on the attack tree based on the large language model, and update the attack tree based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

[0035] In some possible embodiments, the system architecture to be analyzed further includes connection relationships between components to be analyzed; and the tag tree determination module is specifically used to:

[0036] According to the connection relationship between the components to be analyzed, a label graph is determined based on the multiple components to be analyzed, the attack entry and the attack exit;

[0037] According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

[0038] In some possible embodiments, the system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and the information determination module is specifically used to:

[0039] Based on the label tree, an associated label node connected to the label node is determined, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

[0040] In some possible embodiments, the attack tree generation module is specifically used to:

[0041] For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template;

[0042] For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and a prompt template corresponding to the label node;

[0043] For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node;

[0044] An attack tree is generated based on the attack purpose, attack steps and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic node, and the logic node is connected to each attack step.

[0045] In some possible embodiments, the attack tree generation module is further used to:

[0046] For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0047] The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0048] In some possible embodiments, the attack tree generation module is further used to:

[0049] For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree belongs to a special attack step;

[0050] In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of each attack subtree.

[0051] In some possible embodiments, the attack tree evaluation module is specifically used to:

[0052] Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

[0053] An embodiment of the present disclosure provides a computer device, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the automated attack path analysis and evaluation method based on a large language model as described in any possible implementation manner described above is performed.

[0054] An embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for automatically analyzing and evaluating attack paths based on a large language model as described in any of the above possible implementations is implemented.

[0055] The automated attack path analysis and evaluation method and device based on a large language model provided in the embodiments of the present disclosure use a large language model to perform automated TARA attack path analysis at the component level or the overall system level throughout the entire life cycle, thereby overcoming the subjectivity, update difficulty, and information abstraction problems of traditional threat database-based methods. The large language model is combined to obtain domain information to achieve specific scenario reasoning, and the device has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, and so on.

[0056] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required to be cited in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 A schematic diagram of a TARA procedure provided by an embodiment of the present disclosure is shown;

[0059] Figure 2 A flowchart of an automated attack path analysis and evaluation based on a large language model provided by an embodiment of the present disclosure is shown;

[0060] Figure 3 A flowchart of a label tree construction method in an automated attack path analysis and evaluation method based on a large language model provided in an embodiment of the present disclosure is shown;

[0061] Figure 4 A schematic diagram of constructing a label tree in the automated attack path analysis and evaluation method based on a large language model provided in an embodiment of the present disclosure is shown;

[0062] Figure 5 A flowchart of a method for generating an attack tree in an automated attack path analysis and evaluation method based on a large language model provided in an embodiment of the present disclosure is shown;

[0063] Figure 6 A schematic diagram of a method for generating an attack subtree in an automated attack path analysis and evaluation method based on a large language model provided in an embodiment of the present disclosure is shown;

[0064] Figure 7 A schematic diagram of a method for merging attack subtrees in an automated attack path analysis and evaluation method based on a large language model provided in an embodiment of the present disclosure is shown;

[0065] Figure 8 A schematic diagram of an automated attack path analysis and evaluation based on a large language model provided by an embodiment of the present disclosure is shown;

[0066] Fig. 9 A schematic diagram of the structure of an automatic attack path analysis and evaluation device based on a large language model provided by an embodiment of the present disclosure is shown;

[0067] Fig.10A schematic diagram of the structure of a computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0069] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0070] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0071] With the rapid development of automotive technology, new modules and sensors are increasingly being integrated into cars. These include advanced driver assistance systems, TBOX, gateways, autonomous vehicles, millimeter wave radars, and lidars. These components are interconnected through the vehicle network, which increases complexity and expands the potential attack surface, making the system more vulnerable to attacks. The increasing number of cyberattacks on IVN in recent years has highlighted the urgent need for strong cybersecurity measures. In response to this, the United Nations WP29 R155e regulation was introduced in 2021, forcing OEMs and Tier 1 suppliers to establish a cybersecurity management system (CSMS) throughout the vehicle life cycle. However, the regulations do not clarify the details of the CSMS construction, causing implementation difficulties. Subsequently, the ISO21434 standard came into being to provide framework guidance for automotive cybersecurity management.

[0072] Here, in order to facilitate the understanding of this embodiment, the concept of Threat Analysis and Risk Assessment (TARA) provided by the ISO 21434 standard core is first introduced in detail. Figure 1 As shown, a schematic diagram of a TARA program provided by the present disclosure is provided; wherein, TARA consists of seven programs (the order of which is flexible) for identifying and evaluating cybersecurity threats and risks. The implementation procedures of TARA include seven types: asset identification, threat scenario identification, impact rating, attack path analysis, attack feasibility assessment, risk value determination, and risk handling decision. Specifically, asset identification includes determining assets and their cybersecurity attributes (confidentiality, integrity, availability), and assessing the damage scenarios that may be caused when they are attacked. Threat scenario identification describes potential threats and vulnerabilities, covering target assets, attributes violated by threats, and possible damage scenarios, such as search history in an in-vehicle infotainment system that may leak personal information if attacked, and may correspond to multiple damage scenarios. Impact rating mainly evaluates damage scenarios from four aspects: security, finance, operations, and privacy. Attack path analysis mainly looks for potential attack paths or attack trees for each threat scenario, including top-down and bottom-up methods. Attack feasibility assessment evaluates the feasibility of attack paths by attack potential, CVSS score, or attack vector. Risk value determination evaluates the risk of threat scenarios by combining impact rating and attack feasibility rating, ranging from 1 (lowest) to 5 (highest). Finally, risk treatment decision considers risk response measures, such as acceptance or mitigation. Among them, attack path analysis and attack feasibility rating are the most time-consuming and require the most technical personnel.

[0073] Research has found that in related technologies, it is proposed to automatically generate attack paths based on threat databases. However, this automated method has limitations in the field of automotive safety. For example, building a database is time-consuming and labor-intensive, relying on expert experience to cause subjective bias; it is difficult to refine to microscopic components, and analysis is insufficient when updates are frequent; and the method lacks generalization and is only applicable to automobiles, and does not support cross-industry and global regulatory interaction management. Therefore, related technologies are insufficient in meeting the TARA requirements of low-level components and the safety of the entire life cycle.

[0074] Based on the above research, an automatic attack path analysis and evaluation method and device based on a large language model are provided in an embodiment of the present disclosure, including: first, obtaining a system architecture to be analyzed; and determining an attack entry and an attack exit based on a threat scenario corresponding to each component to be analyzed and connection information corresponding to each component to be analyzed; secondly, according to a path finding algorithm, a label tree consisting of multiple label nodes is determined based on multiple components to be analyzed, attack entries and attack exits, and target information of each label node in the label tree is extracted; then, for each label node in the label tree, according to the target information of the label node, a potential attack surface corresponding to each label node is determined based on a large language model, and an attack purpose corresponding to each label node is determined based on the threat scenario corresponding to each label node based on the large language model; and domain knowledge corresponding to the system architecture to be analyzed is obtained based on the large language model, and an attack tree is generated based on the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge; finally, feasibility calculation and score calculation are performed on the attack tree based on the large language model, and the attack tree is updated based on the calculation result to obtain a target attack tree.

[0075] In the disclosed embodiments, a large language model is used to perform automated analysis of TARA attack paths at the component level or the overall system level throughout the entire life cycle, thereby overcoming the subjectivity, update difficulty, and information abstraction problems of traditional threat database-based methods. The large language model is combined to obtain domain information to achieve specific scenario reasoning, and the system has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, and more.

[0076] To facilitate understanding of this embodiment, the execution subject of the automated attack path analysis and evaluation method based on a large language model provided by the embodiment of the present disclosure is first introduced in detail. The execution subject of the automated attack path analysis and evaluation method based on a large language model provided by the embodiment of the present disclosure is a computer device. The computer device can be a server. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, big data and artificial intelligence platforms.

[0077] The following is a detailed description of the automated attack path analysis and evaluation method based on a large language model provided in the embodiment of the present application in conjunction with the accompanying drawings. Figure 2 As shown, it is a flow chart of an automated attack path analysis and evaluation method based on a large language model provided by an embodiment of the present disclosure, and the method includes the following S201-S205:

[0078] S201, obtaining a system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, a threat scenario corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed, determining an attack entry and an attack exit.

[0079] Here, the system architecture to be analyzed mainly includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, connection information corresponding to each component to be analyzed, connection relationships between components to be analyzed, and description information corresponding to each component to be analyzed, etc. Taking the analysis of the attack path of the TBOX component of the vehicle-mounted communication module of the car as an example, the connection information corresponding to the TBOX component to be analyzed can be expressed as the TBOX component is connected to other gateway components through an Ethernet channel, and the TBOX component receives external data through a Wifi interface; the connection relationship between it and other components can be expressed as the TBOX component is connected to the vehicle network, connected to the vehicle-mounted sensor, etc.; its description information can be expressed as the TBOX component runs an embedded operating system, such as Linux or Android Automotive, supports remote firmware updates and vehicle management applications, and can ensure some software and hardware information such as efficient data processing and secure communication.

[0080] Specifically, threat scenarios are used to describe potential threats and vulnerabilities, including target assets, property violated by the threat, and the damage scenarios that will be caused. They are also the ultimate goals that the attacker wants to achieve. For example, in a vehicle scenario, threat scenarios can include remote control attacks, where attackers may invade the vehicle system through the vehicle's wireless communication interface (such as Wi-Fi or Bluetooth) and remotely control the vehicle's braking or acceleration system, which may cause an accident; or navigation system hijacking, where attackers tamper with the vehicle's navigation system and provide false route information, causing the driver to deviate from the correct path, increasing the risk of getting lost or safety hazards; and other types of threat scenarios (such as in-vehicle entertainment system vulnerabilities and in-vehicle data leaks, etc.). According to the ISO21434 TARA regulations, each threat scenario must be analyzed for the attack path, that is, each threat scenario corresponds to an attack tree.

[0081] In some other embodiments, if the target is the drone field, the threat scenarios may include signal jamming hijacking (i.e., the attacker interferes with the drone's communication signal or GPS signal, forcing the drone to lose contact with the operator, and then hijacking the drone for illegal operation or deviation from the route) and malware attacks (such as the attacker implanting malware or viruses into the drone's control system, which may cause the drone to malfunction, data leakage, or even complete paralysis of the control system), or other types of threat scenarios. If it is targeted at other fields, the threat scenarios are set according to the actual situation and are not specifically limited here.

[0082] It is understandable that after obtaining the system architecture to be analyzed, it is necessary to determine the attack entry and attack exit based on the threat scenario corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed, where the attack entry refers to the starting point where the attacker can enter the target system or network; the attack exit is the key system component that the attacker relies on to achieve his ultimate goal (such as data theft, privilege escalation, etc.). Specifically, the attack entry where the attack may occur is determined based on the connection information corresponding to each component to be analyzed. For example, if there is a Wifi interface on the TBOX component, then this Wifi interface can be used as the entrance to the car system, so the attack entry of this system is this Wifi interface. And determine the attack exit based on the threat scenario. For example: when the threat scenario is "obtaining the root privileges of the gateway to obtain sensitive user information", the attack exit of the system is the gateway.

[0083] S202, according to a path finding algorithm, based on the multiple components to be analyzed, attack entrances and attack exits, determine a label tree consisting of multiple label nodes, and extract target information of each label node in the label tree.

[0084] Specifically, refer to Figure 3 As shown, when building a label tree according to the path finding algorithm, the following S2021 to S2022 may be included:

[0085] S2021, determining a label graph based on the connection relationship between the components to be analyzed, the multiple components to be analyzed, the attack entry and the attack exit.

[0086] It is understandable that since the system architecture to be analyzed contains all kinds of information of all components to be analyzed, the amount of information is huge and the structure is complex, which is not easy to process and calculate. Therefore, in order to more concisely represent each component to be analyzed, and to represent the relationship between each component to be analyzed, attack entry and attack exit, each component to be analyzed, attack entry and attack exit can be used as different types of labels as a concise representation of their respective information. When it is necessary to obtain detailed information of a component to be analyzed, or to explore the relationship between components, components and attack entry / exit, these labels can be used as indexes to quickly retrieve and obtain complete information. In this way, not only the efficiency of data processing is improved, but also the flexibility and accuracy of data analysis and security assessment are enhanced.

[0087] Exemplarily, after setting labels for each analysis component, attack entry, and attack exit, a label graph is constructed based on these labels. Figure 4 Take the label graph shown as an example, where A1 and A2 are components to be analyzed, M is the attack exit determined according to the threat scenario, N1 and N2 are attack entrances, and the label graph is constructed according to the connection relationship between the labels. Specifically, the component to be analyzed A1 is connected to the component to be analyzed A2, and the component to be analyzed A1 is connected to the attack entrances N1 and N2 and the attack exit M, and the attack exit M is connected to the attack entrance N2.

[0088] S2022: According to the label graph, determine multiple minimum paths from the attack entrance to the attack exit based on a minimum path search algorithm; and determine a label tree based on the multiple minimum paths.

[0089] Here, the minimum path finding algorithm is an algorithm used to find the shortest path from one node to another in a graph. Common algorithms include the Dijkstra algorithm. In order to comprehensively consider all paths and reflect the possible attack surface of each label node, the algorithm will merge the repeated parts of the found paths to construct a tree structure with the attack target as the root node - the label tree. Figure 4As shown, the label graph is traversed by a path finding algorithm, and the solved path is processed to obtain a label tree, in which only the component A1 to be analyzed connected to the attack entry N1, N2 and the attack exit M is retained, and the component A2 to be analyzed that has no connection relationship with the attack entry N1, N2 and the attack exit M is discarded, and the connection relationship between the attack exit M and the attack entry N2 is discarded, and finally the label tree shown in the figure is obtained. In the disclosed embodiment, this label tree can not only describe the degree of association between a single label and its adjacent labels in detail at the local level, but also help to extract key information in the label mapping process; at the same time, from a global perspective, the hierarchical structure of the label tree provides a useful framework and guidance for the subsequent merging of attack subtrees to construct a more complex and systematic attack tree hierarchical relationship.

[0090] In some other embodiments, the path finding algorithm may also be an A* algorithm, a Bellman-Ford algorithm, etc., which is not specifically limited here.

[0091] It is understandable that when dealing with complex network topologies, the system architecture to be analyzed is huge and may exceed the challenge of the token limit of the large language model. In addition, it has been found that when analyzing the potential attack of a certain label, the information of the label that is too far away from the label node is not helpful. When the redundant secondary information is also provided to the large language model, it may not only cause a waste of tokens, but also cause the large language model to be unfocused in analysis, ignore some of the main information, and cause incomplete analysis. In order to deal with these problems, in the embodiment of the present disclosure, according to the hierarchical structure of the label tree, the large language model can be recursively used to generate potential attack methods for each label node in the tree separately, and it is necessary to extract the main information from the system architecture to be analyzed for each label node, strip off the secondary information, and provide it to the large language model, and avoid inputting all the nodes of the entire label tree at one time. It is worth noting that when extracting the main information of each label node, it is necessary to avoid losing the main information while removing the secondary information, otherwise it will also cause the large language model to lack the necessary information support during analysis. Specifically, when extracting the main information of each label node, the associated label node connected to the label node can be determined based on the label tree, and the description information corresponding to the label node and the description information corresponding to the associated label node are used as the target information corresponding to the label node (i.e., the main information corresponding to the label node). Figure 4 In the label tree shown, the target information about the label node A1 of the component to be analyzed can be represented as the description information corresponding to the label nodes N1, N2 and M plus the description information of the component to be analyzed A1 itself.

[0092] S203, for each label node in the label tree, determine the potential attack surface corresponding to each label node based on the large language model according to the target information of the label node, and determine the attack purpose corresponding to each label node based on the large language model according to the threat scenario corresponding to each label node.

[0093] Here, the Large Language Model (LLM) is an important technological breakthrough in the field of artificial intelligence in recent years. It can understand and generate natural language text by training on large-scale text data, and has strong semantic understanding and reasoning capabilities.

[0094] Specifically, for each label node, the large language model is used to understand the context of the corresponding target information and identify security issues related to the node, including possible vulnerabilities, configuration weaknesses, exposed services, etc. This step is based on the large language model's ability to understand and analyze massive security data. Then, based on the results of context understanding, the large language model can infer the potential attack surface against the node, which may include specific attack methods, ways to exploit vulnerabilities, potential intrusion paths, etc. At the same time, on the basis of identifying the potential attack surface, it is necessary to further determine the possible purpose of the attacker, which helps to more accurately assess the severity and urgency of the threat and formulate corresponding response strategies. Specifically, the large language model is guided and used to conduct in-depth analysis of the corresponding threat scenario to infer the possible purpose of the attacker, which may include data theft, service interruption, system destruction, extortion, etc. In this way, by understanding the motivation and intention of the attacker, the potential impact of the threat can be more accurately assessed.

[0095] S204, acquiring domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generating an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node and the domain knowledge.

[0096] Here, when analyzing the system architecture to be analyzed, the large language model can be used to extract professional knowledge related to the field to which the system architecture to be analyzed belongs (such as the automotive industry, financial industry, etc.), including but not limited to industry standards, technical specifications, common vulnerability patterns, attack methods and their impacts, etc.

[0097] Specifically, refer to Figure 5 As shown, when generating the attack tree, the following S2041 to S2044 may be included:

[0098] S2041, for each label node, generate a prompt template corresponding to the label node according to the potential attack surface, attack purpose and the domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template.

[0099] It is understandable that in the field of artificial intelligence, especially when dealing with tasks involving natural language processing and knowledge enhancement, large language models such as GPT series, BERT, etc., have demonstrated powerful text generation, understanding and reasoning capabilities. However, these models may perform poorly when dealing with tasks in specific fields or complex scenarios due to lack of domain knowledge or contextual information. In order to improve the accuracy and efficiency of large language models on specific tasks, an effective method is to enhance the decision-making process of the model through knowledge guidance. Therefore, in the present disclosure, when using a large language model to generate an attack tree, a corresponding prompt template is first generated for each label node, and the prompt template includes the potential attack surface, attack purpose and domain knowledge corresponding to each label node. By providing these prompt templates as input or guidance information to the large language model, the purpose of guiding its knowledge can be achieved. When the model processes tasks, these templates will serve as additional context or constraints to guide the model to more accurately understand and generate content related to the label node. In this way, not only the performance of the model on specific tasks is improved, but also the transparency and controllability of the model are enhanced.

[0100] S2042: For each label node, determine an attack step corresponding to the attack purpose of the label node based on the large language model and the prompt template corresponding to the label node.

[0101] For example, the attack purpose corresponding to each label node may be a broad category (such as data theft, system destruction), and the realization of the attack purpose needs to be analyzed in detail to obtain specific attack steps, that is, in actual attacks, the attacker needs to take a series of specific steps to achieve this goal. For example: taking the in-vehicle infotainment system as a label node, its corresponding attack purpose can be that the attacker steals sensitive data of the system through the label node. The large language model analyzes its attack steps based on the prompt template corresponding to the in-vehicle infotainment system, which can be expressed as follows: the attacker first scans and discovers the IP address and open port of the in-vehicle infotainment system, and identifies the system version and vulnerabilities. Then, they use these vulnerabilities to gain access to the system and implant malware to control the system. Next, the attacker accesses and extracts sensitive data in the system, such as communication records and navigation history, and transmits the data to the server under its control through hidden communication, while clearing the system log to cover up the traces. Ultimately, the attacker can use the stolen data to commit fraud or try to further control other systems of the vehicle.

[0102] S2043: For each label node, perform a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node.

[0103] It can be understood that logical association analysis refers to an in-depth analysis of the cause-effect relationship, sequence, dependency, etc. between the attack steps to determine which steps are necessary conditions, which steps are optional, and how they together form a coherent attack path. Based on the logical association analysis, the key logical nodes in the attack path can be determined. These logical nodes are usually turning points, decision points or bottlenecks between the attack steps, and have a significant impact on the success of the attack. For example, in the attack path of the vehicle control system, the privilege escalation step may be a key logical node because it determines whether the attacker can further control the vehicle system.

[0104] S2044, generating an attack tree based on the attack purpose, attack steps and logic nodes corresponding to each label node.

[0105] Here, based on the attack target, attack step and logical node corresponding to each label node, the attack tree includes at least one attack path, whose root node is the attack purpose, the attack purpose is connected to the logical node, and the logical node is connected to each attack step. Specifically, after obtaining the attack purpose, attack step and logical node corresponding to each label node, generating the attack tree may include the following (1) to (2):

[0106] (1) For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0107] (2) The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0108] It is understandable that for each label node, a corresponding attack subtree is generated. The attack subtree is a tree structure built around a single label node and its attack purpose. Its root node is the attack purpose, and the attack purpose is connected to the logic node, which is connected to each attack step. Because the answers provided by large language models sometimes look reasonable, but may actually be wrong, this may affect the rationality of the attack path. In addition, different manufacturers may assume different constraints on the attack path, such as "not considering social engineering attacks." Therefore, the present disclosure prunes the attack subtree by setting corresponding rules to delete unreasonable attack steps.

[0109] At the same time, the present disclosure also proposes to guide the large language model to distinguish the attack targets of each attack step, indicating whether the attack target is the software or hardware inside the system, or the external interface of the system, referring to Figure 6 As shown in the figure, the attack subtree generated by the large language model based on the target information and threat scenario of a certain label consists of attack purpose, logical nodes and attack steps. The corresponding attack steps have different attack targets (i.e., the attack target is the software or hardware inside the system and the attack target is the interface of the system to the outside). Since when the attack target is the software or hardware inside the system, the attack needs to be implemented through the external interface, so when merging the attack subtrees, only the attack target is the interface of the system to the outside. Therefore, according to the different attack targets, the specific steps of merging the attack subtrees include the following (a) to (b):

[0110] (a) for each attack subtree corresponding to the label node, determining whether the attack step in the attack subtree belongs to a special attack step;

[0111] (b) When the attack step belongs to a special attack step, determine the target component corresponding to the special attack step, and determine the target label node corresponding to the target component; connect the attack subtree corresponding to the target label node with the special attack step to realize the merging of the attack subtrees.

[0112] It can be understood that the special attack steps in the present disclosure are represented by attack targets that are external interfaces of the system. For each attack subtree represented by a label node, its attack steps are checked one by one to determine the special attack steps. Then, for each step marked as a special attack step, its associated target component needs to be clarified, that is, the component involved in the implementation of the attack step, and its corresponding target label node is determined based on the target component. Then, the attack subtree corresponding to the target label node is connected to the special attack step to construct a complete attack tree. This attack tree will comprehensively and progressively reflect the complete attack path, providing a solid foundation for our risk assessment and security protection strategies. Reference Figure 7 As shown, taking the attack subtree of label a and the attack subtree of label b in the figure as an example, among which, the step marked as a special attack step in the attack step corresponding to the attack subtree of label a is associated with the label node b, then the attack subtree corresponding to label b is connected to the special attack step of label a to complete the merger of the subtrees of label a and label b, and the same method is used for other subtrees until all subtrees are merged.

[0113] S205, performing feasibility calculation and score calculation on the attack tree based on the large language model, and updating the attack tree based on the calculation results to obtain a target attack tree.

[0114] Exemplarily, after generating the attack tree, the present disclosure also proposes to use a large language model to evaluate the attack feasibility of the attack paths in the attack tree, the purpose of which is to determine which attacks are more likely to occur, so as to provide priority guidance for the implementation of risk mitigation measures, give priority to and handle these attack paths, and reasonably allocate limited security resources accordingly. Specifically, the evaluation regulations corresponding to the system architecture to be analyzed are obtained through the large language model, and the rules for attack feasibility evaluation in the regulations are extracted as prompt words, so that the large language model can learn the evaluation criteria. Then, the large language model is used to calculate the feasibility of the attack tree, and the score corresponding to the number of attacks is determined based on the calculation results and the scoring rules, and the evaluation reasons are given. And the attack tree is updated according to the calculation results and the corresponding evaluation reasons to obtain the target attack tree. Among them, the target attack tree includes at least one target attack path, and the target attack path includes the attack path and the evaluation results.

[0115] The automated attack path analysis and evaluation method and device based on a large language model provided in the embodiments of the present disclosure use a large language model to perform automated TARA attack path analysis at the component level or the overall system level throughout the entire life cycle, thereby overcoming the subjectivity, update difficulty, and information abstraction problems of traditional threat database-based methods. The large language model is combined to obtain domain information to achieve specific scenario reasoning, and the device has cross-domain application capabilities, making it suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, and so on.

[0116] Next, combine Figure 8 The automated attack path analysis and evaluation method based on the large language model proposed in the present disclosure is described in detail as a whole. First, the system architecture to be analyzed (including multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, connection information corresponding to each component to be analyzed, connection relationships between components to be analyzed, and description information corresponding to each component to be analyzed) is obtained, and then the attack entry is determined according to the connection relationship corresponding to the components to be analyzed, and the attack exit is determined according to the threat scenario. Then, the attack route is extracted according to each system architecture to be analyzed and its corresponding attack entry and attack exit to generate a label tree. Secondly, the target information corresponding to each label node in the label tree is extracted according to the label tree, and the attack steps are generated based on the large language model according to the target information and threat scenarios corresponding to each label node, and the large language model is used to perform logical correlation analysis on the attack steps to determine the logical nodes, and then the attack subtrees are generated according to the attack objectives, attack steps and logical nodes corresponding to each label node, and the attack subtrees are merged according to the attack steps corresponding to each attack subtree to generate an attack tree. Finally, the generated attack tree is evaluated and scored based on the large language model to obtain the final target attack tree.

[0117] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0118] Based on the same inventive concept, the embodiments of the present disclosure also provide an automated attack path analysis and evaluation device based on a large language model corresponding to the automated attack path analysis and evaluation method based on a large language model. Since the principle of solving the problem by the device in the embodiments of the present disclosure is similar to the above-mentioned automated attack path analysis and evaluation method based on a large language model in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0119] Reference Fig. 9 FIG. 1 is a schematic diagram of an automatic attack path analysis and evaluation device 900 based on a large language model provided by an embodiment of the present disclosure, wherein the device comprises:

[0120] The architecture acquisition module 901 is used to acquire the system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; based on the threat scenarios corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed, an attack entry and an attack exit are determined;

[0121] The label tree determination module 902 is used to determine a label tree consisting of multiple label nodes based on the multiple components to be analyzed, attack entrances and attack exits according to a path finding algorithm, and extract target information of each label node in the label tree;

[0122] An information determination module 903 is used to determine, for each label node in the label tree, a potential attack surface corresponding to each label node based on the target information of the label node and based on the large language model, and determine an attack purpose corresponding to each label node based on the threat scenario corresponding to each label node based on the large language model;

[0123] An attack tree generation module 904 is used to obtain domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node and the domain knowledge; the attack tree includes at least one attack path;

[0124] The attack tree evaluation module 905 is used to perform feasibility calculation and score calculation on the attack tree based on the large language model, and update the attack tree based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

[0125] In some possible embodiments, the system architecture to be analyzed further includes connection relationships between components to be analyzed; and the tag tree determination module 902 is specifically used to:

[0126] According to the connection relationship between the components to be analyzed, a label graph is determined based on the multiple components to be analyzed, the attack entry and the attack exit;

[0127] According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

[0128] In some possible embodiments, the system architecture to be analyzed further includes description information corresponding to each component to be analyzed; and the information determination module 903 is specifically used to:

[0129] Based on the label tree, an associated label node connected to the label node is determined, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

[0130] In some possible embodiments, the attack tree generation module 904 is specifically used to:

[0131] For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template;

[0132] For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and a prompt template corresponding to the label node;

[0133] For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node;

[0134] An attack tree is generated based on the attack purpose, attack steps and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic node, and the logic node is connected to each attack step.

[0135] In some possible embodiments, the attack tree generation module 904 is further used to:

[0136] For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node;

[0137] The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

[0138] In some possible embodiments, the attack tree generation module 904 is further used to:

[0139] For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree belongs to a special attack step;

[0140] In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of each attack subtree.

[0141] In some possible embodiments, the attack tree evaluation module 905 is specifically used to:

[0142] Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

[0143] Based on the same technical concept, the embodiment of the present disclosure also provides a computer device. Fig.10 1 is a schematic diagram of the structure of a computer device 1000 provided in an embodiment of the present disclosure, including a processor 1001, a memory 1002, and a bus 1003. The memory 1002 is used to store execution instructions, including a memory 10021 and an external memory 10022; the memory 10021 is also called an internal memory, which is used to temporarily store the operation data in the processor 1001 and the data exchanged with the external memory 10022 such as a hard disk. The processor 1001 exchanges data with the external memory 10022 through the memory 10021.

[0144] In the embodiment of the present application, the memory 1002 is specifically used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 1001. That is, when the computer device 1000 is running, the processor 1001 communicates with the memory 1002 through the bus 1003, so that the processor 1001 executes the application code stored in the memory 1002, and then executes the method described in any of the above embodiments.

[0145] Among them, the memory 1002 can be, but is not limited to, random access memory (Random Access Memory, RAM), read only memory (Read Only Memory, ROM), programmable read-only memory (Programmable Read-Only Memory, PROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, EPROM), electrically erasable read-only memory (Electric Erasable Programmable Read-Only Memory, EEPROM), etc.

[0146] Processor 1001 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0147] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the computer device 1000. In other embodiments of the present application, the computer device 1000 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0148] The present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for automated attack path analysis and evaluation based on a large language model described in the above method embodiment are executed. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0149] The embodiments of the present disclosure also provide a computer program product, which carries a program code. The instructions included in the program code can be used to execute the steps of the automated attack path analysis and evaluation method based on a large language model described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0150] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0151] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed system and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0152] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0153] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0154] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0155] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. An automated attack path analysis and evaluation method based on a large language model, characterized in that: include: Acquire a system architecture to be analyzed; wherein the system architecture to be analyzed includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; determine an attack entry and an attack exit based on the threat scenarios corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed; According to the path finding algorithm, a label tree consisting of a plurality of label nodes is determined based on the plurality of components to be analyzed, the attack entry and the attack exit, and target information of each label node in the label tree is extracted; For each label node in the label tree, according to the target information of the label node, determine the potential attack surface corresponding to each label node based on the large language model, and determine the attack purpose corresponding to each label node based on the threat scenario corresponding to each label node based on the large language model; Based on the large language model, domain knowledge corresponding to the system architecture to be analyzed is acquired, and an attack tree is generated according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node, and the domain knowledge; the attack tree includes at least one attack path; The attack tree is subjected to feasibility calculation and score calculation based on the large language model, and the attack tree is updated based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

2. The method according to claim 1, characterized in that The system architecture to be analyzed also includes the connection relationship between the components to be analyzed; the path finding algorithm is used to determine a label tree consisting of multiple label nodes based on the multiple components to be analyzed, the attack entry and the attack exit, including: According to the connection relationship between the components to be analyzed, a label graph is determined based on the multiple components to be analyzed, the attack entry and the attack exit; According to the label graph, multiple minimum paths from the attack entrance to the attack exit are determined based on a minimum path finding algorithm; and a label tree is determined based on the multiple minimum paths.

3. The method according to claim 1, characterized in that The system architecture to be analyzed also includes description information corresponding to each component to be analyzed; and the target information of each tag node in the tag tree is extracted, including: Based on the label tree, an associated label node connected to the label node is determined, and description information corresponding to the label node and description information corresponding to the associated label node are used as target information corresponding to the label node.

4. The method according to claim 1, characterized in that The generating of the attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node and the domain knowledge includes: For each label node, a prompt template corresponding to the label node is generated according to the potential attack surface, attack purpose and domain knowledge corresponding to the label node, so as to provide knowledge guidance to the large language model through the prompt template; For each label node, determining an attack step corresponding to the attack purpose of the label node based on the large language model and a prompt template corresponding to the label node; For each label node, performing a logical association analysis on the attack steps corresponding to the label node based on the large language model and the prompt template corresponding to the label node to determine a logical node; An attack tree is generated based on the attack purpose, attack steps and logic nodes corresponding to each label node; the root node of the attack tree is the attack purpose, the attack purpose is connected to the logic node, and the logic node is connected to each attack step.

5. The method according to claim 4, characterized in that The generating of the attack tree based on the attack purpose, attack steps and logic nodes corresponding to each label node includes: For each label node, generate an attack subtree according to the attack purpose, attack steps and logic nodes corresponding to the label node; The attack subtrees corresponding to the respective label nodes are processed based on preset rules, and the processed attack subtrees are merged to obtain the attack tree.

6. The method according to claim 5, characterized in that The step of merging the processed attack subtrees includes: For each attack subtree corresponding to the label node, determine whether the attack step in the attack subtree belongs to a special attack step; In the case that the attack step belongs to a special attack step, the target component corresponding to the special attack step is determined, and the target label node corresponding to the target component is determined; the attack subtree corresponding to the target label node is connected to the special attack step to realize the merging of each attack subtree.

7. The method according to claim 1, characterized in that The performing feasibility calculation and score calculation on the attack tree based on the large language model includes: Based on the large language model, an evaluation rule corresponding to the system architecture to be analyzed is obtained, and a feasibility calculation is performed on the attack tree based on the large language model according to the evaluation rule; and a score corresponding to the number of attacks is determined based on the calculation result and a preset scoring rule.

8. An automated attack path analysis and evaluation device based on a large language model, characterized in that: include: An architecture acquisition module is used to acquire the architecture of the system to be analyzed; wherein the architecture of the system to be analyzed includes multiple components to be analyzed, threat scenarios corresponding to each component to be analyzed, and connection information corresponding to each component to be analyzed; based on the threat scenarios corresponding to each component to be analyzed and the connection information corresponding to each component to be analyzed, an attack entry and an attack exit are determined; A label tree determination module, configured to determine a label tree consisting of a plurality of label nodes based on the plurality of components to be analyzed, attack entrances, and attack exits according to a path finding algorithm, and extract target information of each label node in the label tree; An information determination module, for each label node in the label tree, determining a potential attack surface corresponding to each label node based on a large language model according to target information of the label node, and determining an attack purpose corresponding to each label node based on the large language model according to a threat scenario corresponding to each label node; An attack tree generation module, used to obtain domain knowledge corresponding to the system architecture to be analyzed based on the large language model, and generate an attack tree according to the target information of each label node, the potential attack surface corresponding to each label node, the attack purpose corresponding to each label node and the domain knowledge; the attack tree includes at least one attack path; An attack tree evaluation module is used to perform feasibility calculation and score calculation on the attack tree based on the large language model, and update the attack tree based on the calculation results to obtain a target attack tree; the target attack tree includes at least one target attack path, and the target attack path includes an attack path and an evaluation result.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images