Embedded system information security threat modeling system

Abstract

The invention discloses an embedded system information security threat modeling system comprising an embedded system simulation environment module used for constructing a simulation service scene; the asset identification module is used for actively or passively identifying assets of the target embedded system; the object analysis module is used for performing safety assessment on the assets identified by the asset identification module; the threat identification module is used for carrying out multi-method heterogeneous threat identification on the embedded system by combining the analysis result of the object analysis module and utilizing attack tree threat identification, data flow graph threat identification, OWASP threat identification and STRIDE threat identification methods; and the threat rating and filing module is used for rating the threat information identified by the threat identification module and filing the threat information in a database or document mode. According to the method, comprehensive and accurate identification and analysis of the security threats of the embedded system are realized through a systematic methodology, and one-sidedness and limitation of a traditional method are avoided.

Description

Technical Field

[0001] The present invention relates to the field of embedded system information security engineering, and in particular to an embedded system information security threat modeling system. Background Art

[0002] With the rapid development of information technology, embedded systems have been widely used in numerous fields, including military, aerospace, industrial automation, embedded automotive systems, drone control systems, satellite onboard control systems, and embedded power control systems. These systems typically face limited resources, strict real-time requirements, and close coupling with the physical world, making the security threats they face more complex and diverse. Hardware vulnerabilities, software defects, cyberattacks, physical attacks, and human factors can all cause serious damage to embedded systems, threatening their stable operation and information security.

[0003] Currently, security testing and protection methods for embedded systems primarily rely on traditional methods, such as penetration testing and code review. However, these methods are mostly targeted at specific application scenarios or security threats, lacking a systematic, reusable threat modeling approach. This makes it difficult to comprehensively and accurately identify and analyze the various security threats facing embedded systems in practical applications, making it difficult to develop effective security protection measures. Specifically, current embedded system security threat modeling has the following limitations:

[0004] 1. Limited environmental resources. Embedded systems typically have limited computing power, storage space, and power consumption. Furthermore, they have strict real-time requirements. Due to these resource and environmental constraints, it is difficult to develop a systematic and standardized approach to security research and threat analysis.

[0005] 2. Multiple communication protocols. Embedded systems use multiple communication protocols (such as CAN, BLE, and SPI), and it is difficult to fully cover threat identification for different communication protocols.

[0006] 3. Interdisciplinary. Embedded systems involve multiple disciplines, including hardware, software, communications, and control. Threat modeling requires interdisciplinary knowledge.

[0007] 4. Limited coverage. Example: Existing approaches to drone control system communication protocol security (such as the OWASP TOP10) primarily target web application layer vulnerabilities, but threats to drone communication protocols like MAVLink (such as GPS spoofing and data injection) are not covered. For example, using the STRIDE approach to analyze drone systems only identified data tampering risks but failed to discover protocol design flaws (such as the lack of encrypted authentication), leading to remote control signal hijacking in actual attacks.

[0008] 5. Static analysis can lead to missed detection of dynamic threats. Case study: Data flow diagram threat identification methods for dynamic message characteristics in embedded power control systems rely on static data flow analysis. However, dynamic message interactions (such as Modbus TCP periodic heartbeat packets) occur during power system operation. Attackers forged dynamic heartbeat packets to trigger buffer overflows, but static analysis failed to detect these real-time interaction vulnerabilities, causing system downtime.

[0009] 6. Ignoring hardware and physical environment threats. For example, the DREAD rating method for radiated interference in satellite onboard control systems fails to incorporate physical environmental indicators (such as radiation and temperature). Space radiation in a satellite system caused a bit flip in the FPGA chip, allowing attackers to exploit this vulnerability to inject malicious instructions. However, existing threat models do not assess this type of hardware vulnerability.

[0010] 7. Inefficient resource use. Case study: The complexity of attack trees for embedded vehicle systems. Attack tree methods require constructing hundreds of nodes within the vehicle system (involving the CAN bus, IVI modules, and OTA updates), making analysis time-consuming. Due to a delay in updating the attack tree, one automaker failed to identify an OTA signature verification vulnerability in a timely manner, leading to a large-scale remote flashing attack.

[0011] Therefore, developing a modeling and analysis system that can systematically identify and analyze security threats to embedded systems is of great significance for improving the security and reliability of embedded systems. This system can comprehensively and accurately identify and analyze various security threats facing embedded systems, providing a scientific basis and technical support for the development of effective security protection measures. Summary of the Invention

[0012] The purpose of the present invention is to provide an embedded system information security threat modeling system to solve the problems raised in the above background technology.

[0013] To achieve the above object, the present invention provides the following technical solutions:

[0014] An embedded system information security threat modeling system, comprising

[0015] Embedded system simulation environment module, used to build simulation business scenarios including embedded locomotive systems, UAV control systems, avionics control systems, satellite airborne systems, and embedded power control systems;

[0016] The asset identification module is used to actively or passively identify the assets of the target embedded system through data packet fingerprint features, port fingerprint features, device message static features, and device message dynamic features;

[0017] The object analysis module is used to perform security assessments on the assets identified by the asset identification module, including protocol security analysis, system runtime feature analysis, system vulnerability mechanism analysis, system attack surface identification, and information security attack impact assessment;

[0018] The threat identification module is used to combine the analysis results of the object analysis module and use attack tree threat identification, data flow diagram threat identification, OWASP threat identification, and STRIDE threat identification methods to perform multi-method heterogeneous threat identification on embedded systems;

[0019] The threat rating and archiving module is used to rate the threat information identified by the threat identification module and archive it in the form of a database or document.

[0020] In the present invention, the embedded system simulation environment module includes the following units:

[0021] Embedded locomotive system simulation unit, used to simulate the working environment of the locomotive control system, including train control, signal processing, and communication protocols;

[0022] UAV control system simulation unit, used to simulate UAV flight control, navigation system, and communication link;

[0023] Avionics control system simulation unit, used to simulate the working environment of avionics equipment, including flight management, communication and navigation, and radar systems;

[0024] Satellite onboard system simulation unit, used to simulate the working environment of satellite communication, navigation and remote sensing systems;

[0025] Embedded power control system simulation unit is used to simulate the control, monitoring and protection environment of the power system.

[0026] In the present invention, the asset identification module includes the following units:

[0027] The data packet fingerprint feature recognition unit generates the data packet fingerprint feature by analyzing the protocol type, source address, destination address, port number, and data packet content information of the data packet and compares it with the known fingerprint feature library;

[0028] The port fingerprint feature recognition unit analyzes the open status and service type characteristics of the network port and compares them with the known port fingerprint feature library;

[0029] The device message static feature recognition unit identifies the device type, manufacturer, and version information by analyzing the length, specific field values, protocol version, and static features of the message header format of the device message;

[0030] The device message dynamic feature recognition unit identifies the dynamic behavior of the device by analyzing the message sending frequency, interaction mode, response time, and dynamic characteristics of traffic changes.

[0031] In the present invention, the asset identification module further includes the following units:

[0032] Asset classification unit, which classifies assets according to asset type, importance, and location attributes;

[0033] Asset correlation analysis unit, which identifies key assets and potential risk points by analyzing the correlation between assets;

[0034] The asset update and maintenance unit regularly updates asset information to ensure the accuracy and timeliness of asset identification.

[0035] In the present invention, the object analysis module includes the following units:

[0036] The protocol security analysis unit performs defect analysis, authentication and authorization, encryption mechanism, message integrity, and exception handling assessment on communication protocols;

[0037] The system runtime feature analysis unit analyzes the embedded system's resource utilization, process status, network connection status, log information, and performance indicator changes;

[0038] System vulnerability mechanism analysis unit, which conducts in-depth research on system design flaws, implementation vulnerabilities, improper configuration, environmental impacts, and interaction risks;

[0039] System attack surface identification unit, which identifies and analyzes the embedded system's network ports and services, user interface, data storage, external interfaces, and system configuration;

[0040] The information security attack impact assessment unit conducts a comprehensive analysis from the aspects of business interruption, data leakage, economic loss, reputation damage, and recovery cost.

[0041] In the present invention, the object analysis module further includes the following units:

[0042] Security policy evaluation unit, which evaluates the security policy of embedded systems, including access control, log management, and audit mechanisms;

[0043] Security incident response unit, which simulates the occurrence of security incidents and evaluates the system's response and recovery capabilities;

[0044] Security training and awareness unit, which improves the security awareness of system administrators and users by simulating attack and defense scenarios.

[0045] In the present invention, the threat identification module includes the following units:

[0046] Attack tree threat identification unit, which builds attack tree models, identifies threats and assesses risks;

[0047] Data flow diagram threat identification unit, which draws data flow diagrams, analyzes data flows, identifies key nodes and potential attack points, and assesses threat likelihood and impact;

[0048] OWASP Threat Identification Unit uses OWASP TOP10 for regular expression comparison to assess threat likelihood and impact;

[0049] The STRIDE threat identification unit uses the STRIDE model to perform regular comparisons and assess the likelihood and impact of threats.

[0050] In the present invention, the threat identification module further includes the following units:

[0051] Threat intelligence collection unit, which collects threat intelligence through public channels, partners, and internal monitoring methods;

[0052] Threat intelligence analysis unit, which analyzes collected threat intelligence to identify potential threats and attack patterns;

[0053] The threat intelligence sharing unit shares analysis results with relevant parties to improve overall security protection capabilities.

[0054] In the present invention, the threat rating and profiling module includes the following units:

[0055] CVSS Threat Rating Unit, which uses CVSS to rate threats and generates a score between 0 and 10;

[0056] The DREAD threat rating unit generates a score between 0 and 10 based on five dimensions: degree of harm, reproducibility, difficulty of exploitation, impact, and difficulty of discovery;

[0057] The OWASP Threat Rating Unit generates a score between 0 and 10 based on the vulnerability nature, potential impact, difficulty of exploitation, and likelihood of attack;

[0058] The threat archiving unit archives the threat model in a database or document format. The archived content includes threat description, threat target, attack technology, and response measures.

[0059] In the present invention, the threat rating and profiling module further includes the following units:

[0060] Threat trend analysis unit, which analyzes the development trend and changing patterns of threats through historical and current data;

[0061] The threat response strategy unit formulates response strategies and measures based on the threat rating results;

[0062] The threat drill and testing unit tests the effectiveness of response strategies and the system's anti-attack capabilities by simulating threat scenarios.

[0063] Compared with the prior art, the present invention has the following beneficial effects:

[0064] 1. The present invention uses a systematic methodology to achieve comprehensive and accurate identification and analysis of embedded system security threats, avoiding the one-sidedness and limitations of traditional methods.

[0065] 2. The present invention ensures the full identification of potential threat sources of embedded systems by comprehensively utilizing multiple threat identification methods and technical means, thereby improving the accuracy and comprehensiveness of threat identification.

[0066] 3. This invention reveals the inherent connections and mutual influences between threats by deeply analyzing the correlation and interaction mechanisms between threats, providing a scientific basis for formulating effective security protection measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 It is a schematic diagram of the overall architecture of the present invention.

[0068] Figure 2 It is a flow chart of the embedded system simulation environment module of the present invention.

[0069] Figure 3 Schematic diagram of the threat identification module of the present invention.

[0070] Figure 4 Schematic diagram of the threat rating module of the present invention. DETAILED DESCRIPTION

[0071] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0072] Example 1

[0073] like Figure 1-2 As shown, the present invention provides a technical solution:

[0074] An embedded system information security threat modeling system includes an embedded system simulation environment module, an asset identification module, an object analysis module, a threat identification module, and a threat rating and profiling module. The implementation of the system specifically includes the following steps:

[0075] Step S1: Asset detection: Asset detection mainly relies on the asset identification module, which includes data packet fingerprint feature identification, port fingerprint feature identification, device message static feature identification and device message dynamic feature identification. The asset identification module includes three steps: target system scanning, feedback data matching analysis, and asset type determination. The scanning uses the nmap tool, which performs tentative access to each port according to the IP of the target system. If the specific port of the target system gives feedback information, the returned information will be decoded and matched with the fingerprint library. If the match is successful, an asset information will be entered into the system.

[0076] Step S2: Asset information feedback: Based on the results of asset detection and identification, the internal asset component association relationship of the target object is drawn and the original asset information dataset is exported.

[0077] Step S3: Asset List: Customize a safety asset list specifically for quantitative evaluation for specific objects. Specific contents include:

[0078] By decomposing the business process of the target object, the meta-task operation set of the business process of the measured object is obtained.

[0079] Obtain key assets that affect the success or failure of tasks through which information is processed and transmitted in each business operation. Asset types include software, hardware, data, services, personnel, systems, etc.

[0080] Assign value and weight to the security of assets (confidentiality, integrity, availability, etc.).

[0081] Step S4: Security assessment: Security assessment mainly relies on the object analysis module, including protocol security analysis, system runtime feature analysis, system vulnerability mechanism analysis, system attack surface identification and information security attack impact assessment.

[0082] Step S5: Vulnerability value feedback: Based on the security assessment results, in accordance with the security risk assessment guidelines, security protection management guidelines, and public vulnerability databases, use corresponding methods and tools to carry out vulnerability assignment and feedback, and export the original vulnerability risk data set.

[0083] Step S6: Vulnerability List: Customize a vulnerability risk list specifically for quantitative assessment for specific objects, including:

[0084] For system tasks, vulnerability identification can be carried out through manual verification, penetration testing, and security testing.

[0085] For functional applications, vulnerability identification can be carried out using methods such as fuzz testing, dynamic monitoring, penetration testing, tool scanning, and security testing.

[0086] For platform services, vulnerability identification can be performed using manual verification and tool scanning.

[0087] For communication networks, manual verification can be adopted. At the same time, digital simulation environment testing and semi-physical simulation environment testing can be used to verify whether the communication protocol has vulnerabilities by testing the corresponding interface of the communication protocol.

[0088] For the hardware environment, formal verification can be used for system software / firmware, and the hardware devices can be penetrated and tested together with the software running on them to identify vulnerabilities.

[0089] For comprehensive management, such as security and confidentiality management systems, identification is mainly carried out through document review, manual verification, on-site interviews, questionnaires, etc.

[0090] Step S7: Threat identification: Threat identification mainly depends on the threat identification module, which is responsible for identifying threats to embedded systems using threat identification methods such as attack trees, data flow diagrams, OWASP, and STRID.

[0091] Step S8: Threat information feedback: Based on the results of threat identification, threat information is fed back to the threat rating and archiving module. Threat sources come from the system's internal and external threat planes. Different threat sources have different threat motivations and capabilities, different ways of attacking assets, and different degrees of impact on assets. According to the main source, they can be divided into human and non-human, according to the attack vector, they can be divided into network, system, physical, and environmental, and according to the motivation, they can be divided into intentional and accidental.

[0092] Step S9: Threat information rating: Threats are rated by assigning values to them, i.e., calculating the likelihood of the threat occurring. Factors include: the historical frequency of threats, the motivation of the threat source, the attack capability of the threat source, the resources owned by the threat source, the risk tolerance of the threat source, the likelihood of the threat source being punished, and the attractiveness of the assets to the threat source.

[0093] Step S10: Threat model list: For different embedded system objects, a threat model list specifically for archiving needs to be customized, including:

[0094] Intentional acts carried out from outside the network: unauthorized scanning, unauthorized access, DOS attacks, distributed DOS attacks, script attacks, tampering, malicious codes, worms, viruses, Trojans, logic bombs, backdoor programs, electronic deception, network deception, and hacking by illegal external organizations and uncooperative external personnel.

[0095] Unexpected actions caused by external factors of the network: unintentional DOS attacks by trusted suppliers or customers, cooperating third-party personnel, outdated / incomplete regulations, and failure of outsourced operations.

[0096] Intentional acts carried out from within the network: unauthorized scanning, unauthorized access, logic bombs, backdoor programs, electronic deception, network deception, hacking, etc. carried out by malicious insiders.

[0097] Unintended behavior caused by internal network personnel: including human operational errors, unintentional DOS, use of pirated software and other unintentional destructive behaviors caused by internal personnel, as well as malicious consequences caused by inadequate management systems, leakage of sensitive files, unreasonable physical security measures, loss of information / storage devices, etc.

[0098] The results of non-human external environmental factors of the system: power failure, voltage fluctuation, communication failure, network failure, DNS failure, link failure and other environmental factors.

[0099] The results of non-human internal environmental factors of the system: power failure, voltage fluctuation, control component system failure, computer hardware failure, software failure, database failure, communication failure, software defects and other environmental factors.

[0100] This system can comprehensively and accurately identify and analyze security threats to embedded systems in these areas, providing a scientific basis and technical support for developing effective security protection measures. Furthermore, the system can be applied to cybersecurity research and education, contributing to the cultivation of cybersecurity professionals and the advancement of cybersecurity technology.

[0101] Example 2

[0102] The asset identification module is a key component of the embedded system information security threat modeling and analysis system. The module's main task is to identify the assets of the target system for threat modeling. The specific implementation steps are as follows:

[0103] Packet fingerprinting is a method for identifying packets by extracting their specific characteristics. It primarily analyzes information such as the packet's protocol type, source address, destination address, port number, and packet content to generate a unique fingerprint. This is then compared with a known fingerprint library to identify and classify the packet. Packet fingerprinting uses a hash algorithm (such as MD5 or SHA-256) to generate a packet fingerprint and performs a rapid match using a Bloom filter.

[0104] The construction and update of the fingerprint feature library are as follows:

[0105] Construction method: Extract fingerprint features from public vulnerability libraries (such as CVE, NVD) and internal historical data, and use machine learning algorithms (such as KNN or SVM) for classification and optimization.

[0106] Update mechanism: Regularly obtain the latest fingerprint features from public channels (such as manufacturer security announcements) through automated scripts and integrate them into the feature library.

[0107] Port fingerprint feature recognition is a method for identifying network devices or applications by analyzing the characteristics of network ports. Data collection: Collecting relevant information about network ports, such as the number, type, and size of data packets. Feature extraction: Extracting information that reflects port characteristics, such as the port's open status and service type, from the collected data. Feature matching: Comparing the extracted features with a known port fingerprint feature library to determine the device or application to which the port belongs. Port fingerprint feature recognition is based on feature extraction from the TCP / IP protocol stack and uses a decision tree algorithm (such as CART) for classification.

[0108] Static device message signature recognition analyzes messages sent by devices to extract inherent, relatively stable features for identification. These static features may include message length, specific field values, protocol version, and header format. By identifying these features, we can determine device type, manufacturer, version, and other information, facilitating accurate device identification and management, while also identifying potential security risks.

[0109] Identification of dynamic characteristics of device messages mainly involves the following aspects: message sending frequency: observing the time interval between device message sending, etc.; interaction mode: the specific mode of interaction between different devices; response time: dynamic characteristics such as the speed at which the device responds to requests; traffic changes: fluctuations in message traffic.

[0110] Passive identification uses network traffic monitoring tools (such as Wireshark or tcpdump) to capture data packets and analyze the protocols and content through deep packet inspection (DPI) technology.

[0111] like Figure 3 As shown in the figure, the implementation steps of the threat identification module are as follows:

[0112] Step 701: Attack tree threat identification. This involves representing network threat behaviors as a tree structure and using a threat tree model to represent the interdependencies between threat behaviors and steps. Each network or information system has a set of threat trees. Each threat tree lists and details the threat methods used by attackers, and each path represents a unique attack.

[0113] Step 702: Data flow diagram threat identification, drawing a data flow diagram based on professional software to help understand business scenarios and systems, including drawing data flow diagrams, analyzing data flows, identifying key nodes, identifying potential attack points, and evaluating threat possibilities and impacts.

[0114] Step 703: OWASP Threat Identification: Based on asset identification, expert experience is used to conduct threat analysis on each element of the asset. Based on the impact scope and degree of harm of the threat, the identified threats are compared with the TOP100 OWASP canonical expression, and the analysis results are compiled into an OWASP threat analysis report.

[0115] Step 704: STRIDE Threat Identification. This step uses the STRIDE model to analyze system threats. By integrating the embedded system's functional and business risks, a typical embedded system threat knowledge base is established for potential threats. Based on asset identification, threat analysis is performed on each asset element using the threat knowledge base. Identified threats are then compared using the STRIDE model, and the analysis results are compiled into a STRIDE model threat analysis report.

[0116] Example 3

[0117] The object analysis module is a key component of the embedded system information security threat modeling and analysis system. Its primary task is to identify the target system's security status and vulnerabilities, providing vulnerability data for threat identification. The specific implementation steps are as follows:

[0118] Protocol security analysis: The process of conducting in-depth research and evaluation of communication protocols to identify potential security risks, including protocol defect analysis, authentication and authorization, encryption mechanisms, message integrity, exception handling, etc. Among them, defect analysis uses protocol reverse engineering tools (such as Scapy) to analyze protocol design vulnerabilities; encryption mechanism evaluation evaluates the security of the protocol through implementation verification of encryption algorithms such as AES and RSA.

[0119] System runtime feature analysis: Analyze the embedded system's resource utilization, process status, network connection status, log information, and performance indicator changes.

[0120] System vulnerability mechanism analysis is an in-depth study of the underlying causes and mechanisms of system vulnerabilities. This includes analysis of design flaws, implementation vulnerabilities, improper configuration, environmental impacts, and interaction risks. Design flaw analysis uses formal verification tools (such as Z3 or Alloy) to verify that the system design complies with security specifications. Implementation vulnerability analysis uses static code analysis tools (such as Coverity or SonarQube) to detect security vulnerabilities in the code.

[0121] System attack surface identification: Identify and analyze the embedded system's network ports and services, user interface, data storage, external interfaces, and system configuration.

[0122] Information security attack impact assessment: A comprehensive analysis is conducted based on business interruption, data leakage, economic losses, reputation damage, and recovery costs. The impact of the attack is quantified using a risk matrix, and a comprehensive score is generated based on indicators such as business interruption time, data leakage volume, and economic losses.

[0123] Example 4

[0124] The threat identification module is the core component of the embedded system information security threat modeling and analysis system. Its main task is to identify threats to embedded systems using threat identification methods such as attack trees, data flow diagrams, OWASP, and STRID. The specific implementation steps are as follows:

[0125] Attack tree threat identification: Based on asset identification, an attack tree is constructed to identify threats and assess risks. An attack tree is a tree-like structure used to describe and analyze system threats. Each node represents an attack step, and the path represents the complete attack chain. The specific steps for constructing an attack tree are as follows:

[0126] Step S7011: Threat enumeration, extracting relevant threats from a threat intelligence library (such as MITRE ATT&CK).

[0127] Step S7012: attack path analysis, using graph theory algorithms (such as Dijkstra) to analyze the shortest path and key nodes of the attack path.

[0128] Step S7013: assigning node weights. Based on the probability of threat occurrence and the degree of impact, the node weights are calculated using the Analytic Hierarchy Process (AHP).

[0129] Data flow diagram threat identification: A data flow diagram is a graphical tool used to describe the flow and processing of data in a system, helping to identify key nodes and potential attack points. This includes drawing data flow diagrams, analyzing data flows, identifying key nodes, identifying potential attack points, and assessing the likelihood and impact of threats. Professional drawing tools (such as Visio or Lucidchart) are used to draw data flow diagrams and mark key nodes (such as data sources, processing nodes, and storage nodes). Data flow analysis tools (such as DataFlowAnalyzer) are used to identify potential attack points.

[0130] OWASP Threat Identification: Based on asset identification, OWASP performs regular expression comparison to assess threat likelihood and impact, matches vulnerability features through regular expressions, and generates a threat analysis report.

[0131] STRID Threat Identification: STRIDE is a threat classification model that includes spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Based on asset identification, it performs regular comparisons of S (spoofing), T (tampering), R (repudiation), I (information disclosure), D (denial of service), and E (elevation of privilege) to assess threat likelihood and impact. A Threat Scorecard is used to evaluate each threat type (such as spoofing, tampering, and repudiation).

[0132] like Figure 4 As shown, the implementation steps of the threat rating module are as follows:

[0133] Step 901: CVSS threat rating, based on the comprehensive evaluation of the vulnerability difficulty and the impact on the confidentiality, integrity, and availability of the embedded system, a score between 0 and 10 is generated through basic indicators, time indicators, and environmental indicators. The higher the score, the more serious the vulnerability. From low risk to high risk, it is mainly divided into: no threat (0), low risk (0.1-3.9), medium risk (4.0-6.9), high risk (7.0-8.9), and severe (9.0-10.0).

[0134] In this example, the base score is the core of the CVSS, reflecting the inherent characteristics of the vulnerability. It consists of two sub-scores:

[0135] Exploitability Metrics: Evaluate how easy it is to exploit a vulnerability.

[0136] Exploitability Metrics

[0137] Attack Vector (AV):

[0138] Network (N): 0.85

[0139] Adjacent (A): 0.62

[0140] Local (L): 0.55

[0141] Physical (P): 0.2

[0142] Attack Complexity (AC):

[0143] Low (Low, L): 0.77

[0144] High (High,H): 0.44

[0145] Privileges Required (PR):

[0146] None (None,N): 0.85(Scope Unchanged) / 0.85(Scope Changed)

[0147] Low (Low,L): 0.62(Scope Unchanged) / 0.68(Scope Changed)

[0148] High (High,H): 0.27(Scope Unchanged) / 0.5(Scope Changed)

[0149] User Interaction (UI):

[0150] Not required (None, N): 0.85

[0151] Required (R): 0.62

[0152] Impact Metrics: Evaluate the impact of a vulnerability after it is successfully exploited.

[0153] Impact Metrics

[0154] Scope (S):

[0155] Unchanged (U)

[0156] Changed (C)

[0157] Confidentiality Impact (C):

[0158] None (N): 0.0

[0159] Low (L): 0.22

[0160] High (High,H): 0.56

[0161] Integrity Impact (I):

[0162] None (N): 0.0

[0163] Low (L): 0.22

[0164] High (High,H): 0.56

[0165] Availability Impact (A):

[0166] None (N): 0.0

[0167] Low (L): 0.22

[0168] High (High,H): 0.56

[0169] The basic score calculation formula is as follows:

[0170] Exploitability Sub-Score: Exploitability=8.22×AV×AC×PR×UI ImpactSub-Score: Impact=1-[(1-C)×(1-I)×(1-A)].

[0171] The Temporal Score is based on the Base Score and combines the vulnerability's temporal characteristics: Exploit Code Maturity (E):

[0172] Not Defined (X): 1.0

[0173] Unproven (U): 0.91

[0174] Proof-of-Concept (P): 0.94

[0175] Functional (F): 0.97

[0176] High (High,H): 1.0

[0177] Remediation Level (RL):

[0178] Not Defined (X): 1.0

[0179] Official Fix (O): 0.95

[0180] Temporary Fix (T): 0.96

[0181] No fix (Workaround, W): 0.97

[0182] Unavailable (U): 1.0

[0183] Report Confidence (RC):

[0184] Not Defined (X): 1.0

[0185] Unknown (Unknown,U): 0.92

[0186] Reasonable (R): 0.96

[0187] Confirmed (C): 1.0

[0188] Temporal score calculation formula: Temporal Score = Base Score × E × RL × RC.

[0189] The Environmental Score is based on the Base Score and the Time Score, taking into account the specific environment of the organization:

[0190] Security Requirements (CR, IR, AR):

[0191] Not Defined (X): 1.0

[0192] Low (L): 0.5

[0193] Medium (M): 1.0

[0194] High (High,H): 1.51

[0195] Environmental score calculation formula:

[0196] Environmental Score=RoundUp(AdjustedTemporal×CR×IR×AR)

[0197] Step 902: DREAD threat rating, based on the difficulty of the threat elements and the comprehensive assessment of the impact of the threat on the embedded system, generates a score between 0 and 10 points based on the five dimensions of damage degree, reproducibility, difficulty of exploitation, impact, and difficulty of discovery. The severity of the threat is determined by the final weighted sum. The specific implementation logic of the algorithm is as follows:

[0198] 1.Damage Potential

[0199] 0: No damage.

[0200] 1: Minor damage (such as information leakage).

[0201] 2: Moderate damage (such as data tampering).

[0202] 3: Severe damage (such as complete loss of system control).

[0203] 2. Reproducibility

[0204] 0: Unable to reproduce.

[0205] 1: Difficult to reproduce (requires specific conditions).

[0206] 2: Easier to reproduce (some conditions required).

[0207] 3: Very easy to reproduce (no special conditions required).

[0208] Exploitability

[0209] 0: Unable to use.

[0210] 1: Requires advanced skills to utilize.

[0211] 2: Requires certain skills to use.

[0212] 3: No skills are required to use it.

[0213] 4.Affected Users

[0214] 0: No users are affected.

[0215] 1: A small number of users are affected.

[0216] 2: Some users are affected.

[0217] 3: All users are affected.

[0218] 5. Discoverability

[0219] 0: Extremely difficult to detect.

[0220] 1: Harder to find.

[0221] 2: Easier to find.

[0222] 3: Very easy to find.

[0223] The calculation formula is: Score = Damage + Reproducibility + Exploitability + Affected Users + Discoverability.

[0224] Step 903: OWASP Threat Rating, based on the analysis of the TOP100 OWASP canonical comparison and a comprehensive assessment of the impact of the embedded system, generates a score between 0 and 10 by considering the vulnerability nature, potential impact, difficulty of exploitation, and likelihood of attack. The severity of the threat is determined by the final weighted summation.

[0225] Step 904: Threat archiving. By focusing on three aspects: hardware vulnerabilities and software defects, network attacks and software and hardware vulnerabilities, and human factors and software and hardware vulnerabilities and network attacks, the impact targets, action stages, triggering conditions, degree of harm and other elements of security threats are clarified, and the threat models are archived in databases, documents and other formats.

[0226] Example 5

[0227] The threat rating and archiving module is a key component of the embedded system information security threat modeling and analysis system. Its primary task is to rate threat identification information and archive it by threat description, threat target, attack technique, and countermeasures, ensuring its accuracy and reliability. The specific implementation steps are as follows:

[0228] CVSS Threat Rating: CVSS (Common Vulnerability Scoring System) is a standardized framework for assessing the severity of information system security vulnerabilities. It conducts comprehensive analysis and rating through basic indicators, time indicators, and environmental indicators.

[0229] DREAD Threat Rating: A comprehensive rating based on potential threats, reproducibility, exploitability, affected users, and discoverability.

[0230] OWASP Threat Rating: A comprehensive rating based on vulnerability nature, potential impact, difficulty of exploitation, and likelihood of attack.

[0231] Threat archiving: Archiving threat models through databases, documents, and other formats.

[0232] In a specific embodiment, further description is given in conjunction with the following experimental data.

[0233] Experimental Case 1: UAV Control System (MAVLink Protocol)

[0234] (1) Injection threats: GPS spoofing, MAVLink protocol unencrypted authentication vulnerability, and control command injection attacks.

[0235] (2) Experimental results:

[0236] Serial number method Threat identification rate Analysis time False alarm rate CPU usage 1 Traditional attack tree 62％ 120 minutes 18％ 85％ 2 Solution of the present invention 98％ 45min 3％ 32％

[0237] (3) Key improvements:

[0238] Dynamic protocol fingerprint library: Identify GPS spoofing attacks by clustering the spatiotemporal distribution of MAVLink commands.

[0239] Attack surface compression: Compresses 200 attack tree nodes to 60 key paths, improving analysis efficiency by 62%.

[0240] Experimental Case 2: Embedded Power Control System (Modbus TCP)

[0241] (1) Injection threats: dynamic heartbeat packet buffer overflow, Modbus function code tampering, and physical electromagnetic interference attacks.

[0242] (2) Experimental results:

[0243] Serial number method Threat identification rate Analysis time False alarm rate Memory consumption 1 STRIDE model 55％ 90 minutes 25％ 1.2G 2 Solution of the present invention 94％ 30min 5％ 220MB

[0244] (3) Key improvements:

[0245] TinyML dynamic monitoring: Real-time detection of heartbeat packet frequency anomalies.

[0246] Hardware-layer indicator fusion: The electromagnetic interference vulnerability identification rate is increased by 40%.

[0247] Experimental Case 3: Satellite Onboard Control System (SpaceWire Protocol)

[0248] (1) Injection threats: radiation-induced bit flipping, DMA attacks, and protocol replay attacks.

[0249] (2) Experimental results:

[0250] Serial number method Threat identification rate Analysis time False alarm rate 1 OWASP TOP 10 28％ 150min 30％ 2 Solution of the present invention 89％ 50min 8％

[0251] (3) Key improvements:

[0252] Emulation sandbox vulnerability heat map: 93% of Fallout-related vulnerabilities are reproduced.

[0253] Hierarchical modeling: FPGA bit flip threats at the hardware layer are accurately identified.

[0254] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0255] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. An embedded system information security threat modeling system, characterized by: include Embedded system simulation environment module, used to build simulation business scenarios including embedded locomotive systems, UAV control systems, avionics control systems, satellite airborne systems, and embedded power control systems; The asset identification module is used to actively or passively identify the assets of the target embedded system through data packet fingerprint features, port fingerprint features, device message static features, and device message dynamic features; The object analysis module is used to perform security assessments on the assets identified by the asset identification module, including protocol security analysis, system runtime feature analysis, system vulnerability mechanism analysis, system attack surface identification, and information security attack impact assessment; The threat identification module is used to combine the analysis results of the object analysis module and use attack tree threat identification, data flow diagram threat identification, OWASP threat identification, and STRIDE threat identification methods to perform multi-method heterogeneous threat identification on embedded systems; The threat rating and archiving module is used to rate the threat information identified by the threat identification module and archive it in the form of a database or document.

2. The embedded system information security threat modeling system according to claim 1, characterized in that: The embedded system simulation environment module includes the following units: Embedded locomotive system simulation unit, used to simulate the working environment of the locomotive control system, including train control, signal processing, and communication protocols; UAV control system simulation unit, used to simulate UAV flight control, navigation system, and communication link; Avionics control system simulation unit, used to simulate the working environment of avionics equipment, including flight management, communication and navigation, and radar systems; Satellite onboard system simulation unit, used to simulate the working environment of satellite communication, navigation and remote sensing systems; Embedded power control system simulation unit is used to simulate the control, monitoring and protection environment of the power system.

3. The embedded system information security threat modeling system according to claim 1, characterized in that: The asset identification module includes the following units: The data packet fingerprint feature recognition unit generates the data packet fingerprint feature by analyzing the protocol type, source address, destination address, port number, and data packet content information of the data packet and compares it with the known fingerprint feature library; The port fingerprint feature recognition unit analyzes the open status and service type characteristics of the network port and compares them with the known port fingerprint feature library; The device message static feature recognition unit identifies the device type, manufacturer, and version information by analyzing the length, specific field values, protocol version, and static features of the message header format of the device message; The device message dynamic feature recognition unit identifies the dynamic behavior of the device by analyzing the message sending frequency, interaction mode, response time, and dynamic characteristics of traffic changes.

4. The embedded system information security threat modeling system according to claim 3, characterized in that: The asset identification module also includes the following units: Asset classification unit, which classifies assets according to asset type, importance, and location attributes; Asset correlation analysis unit, which identifies key assets and potential risk points by analyzing the correlation between assets; The asset update and maintenance unit regularly updates asset information to ensure the accuracy and timeliness of asset identification.

5. The embedded system information security threat modeling system according to claim 1, characterized in that: The object analysis module includes the following units: The protocol security analysis unit performs defect analysis, authentication and authorization, encryption mechanism, message integrity, and exception handling assessment on communication protocols; The system runtime feature analysis unit analyzes the embedded system's resource utilization, process status, network connection status, log information, and performance indicator changes; System vulnerability mechanism analysis unit, which conducts in-depth research on system design flaws, implementation vulnerabilities, improper configuration, environmental impacts, and interaction risks; System attack surface identification unit, which identifies and analyzes the embedded system's network ports and services, user interface, data storage, external interfaces, and system configuration; The information security attack impact assessment unit conducts a comprehensive analysis from the aspects of business interruption, data leakage, economic loss, reputation damage, and recovery cost.

6. The embedded system information security threat modeling system according to claim 5, characterized in that: The object analysis module also includes the following units: Security policy evaluation unit, which evaluates the security policy of embedded systems, including access control, log management, and audit mechanisms; Security incident response unit, which simulates the occurrence of security incidents and evaluates the system's response and recovery capabilities; Security training and awareness unit, which improves the security awareness of system administrators and users by simulating attack and defense scenarios.

7. The embedded system information security threat modeling system according to claim 1, characterized in that: The threat identification module includes the following units: Attack tree threat identification unit, which builds attack tree models, identifies threats and assesses risks; Data flow diagram threat identification unit, which draws data flow diagrams, analyzes data flows, identifies key nodes and potential attack points, and assesses threat likelihood and impact; OWASP Threat Identification Unit uses OWASP TOP10 for regular expression comparison to assess threat likelihood and impact; The STRIDE threat identification unit uses the STRIDE model to perform regular comparisons and assess the likelihood and impact of threats.

8. The embedded system information security threat modeling system according to claim 7, characterized in that: The threat identification module further includes the following units: Threat intelligence collection unit, which collects threat intelligence through public channels, partners, and internal monitoring methods; Threat intelligence analysis unit, which analyzes collected threat intelligence to identify potential threats and attack patterns; The threat intelligence sharing unit shares analysis results with relevant parties to improve overall security protection capabilities.

9. The embedded system information security threat modeling system according to claim 1, characterized in that: The threat rating and profiling module includes the following units: CVSS Threat Rating Unit, which uses CVSS to rate threats and generates a score between 0 and 10; The DREAD threat rating unit generates a score between 0 and 10 based on five dimensions: degree of harm, reproducibility, difficulty of exploitation, impact, and difficulty of discovery; The OWASP Threat Rating Unit generates a score between 0 and 10 based on the vulnerability nature, potential impact, difficulty of exploitation, and likelihood of attack; The threat archiving unit archives the threat model in a database or document format. The archived content includes threat description, threat target, attack technology, and response measures.

10. The embedded system information security threat modeling system according to claim 9, characterized in that: The threat rating and profiling module also includes the following units: Threat trend analysis unit, which analyzes the development trend and changing patterns of threats through historical and current data; The threat response strategy unit formulates response strategies and measures based on the threat rating results; The threat drill and testing unit tests the effectiveness of response strategies and the system's anti-attack capabilities by simulating threat scenarios.

Images