Risk assessment method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a risk assessment method and device, equipment and a storage medium, relates to the technical field of vehicle network security, and aims to provide an accurate and effective risk assessment scheme. The risk assessment method comprises the steps of obtaining a safety asset object in a vehicle; determining an attacked object from the first corresponding relation according to the security asset object; the attacked object is a platform or a system supporting a security asset object; determining an attack scheme from the second corresponding relation according to the attacked object; the attack scheme is used for indicating attack technologies and attack tools adopted in different attack stages for the attacked object and corresponding attack influence ranges in the target attack path; determining a corresponding threat type according to the attack scheme; and performing risk assessment based on the attack scheme and the threat type.

Description

Technical Field

[0001] This application relates to the field of vehicle cybersecurity technology, and in particular to a risk assessment method, apparatus, device, and storage medium. Background Technology

[0002] As automotive electronic systems become increasingly intelligent and connected, cybersecurity threats are becoming more severe. The international standard ISO 21434 proposes the Threat Analysis and Risk Assessment (TARA) methodology, aiming to systematically identify threats, assess risks, and guide the rational allocation of security resources. However, current TARA implementation relies primarily on the engineering experience and brainstorming methods of security developers, lacking standardized support implementation schemes. This results in a highly subjective risk assessment process, making it difficult to guarantee consistency and accuracy. Summary of the Invention

[0003] The purpose of this application is to provide a risk assessment method, apparatus, equipment, and storage medium, with the aim of providing an accurate and effective risk assessment solution.

[0004] Firstly, a risk assessment method includes: acquiring security asset objects in a vehicle; determining an attack target from a first correspondence based on the security asset objects; the attack target being a platform or system supporting the security asset objects; determining an attack scheme from a second correspondence based on the attack target; the attack scheme indicating the attack techniques and tools used at different attack stages against the attack target in a target attack path, as well as the corresponding attack impact range; determining the corresponding threat type based on the attack scheme; and conducting a risk assessment based on the attack scheme and threat type.

[0005] This application provides a risk assessment method. In the process of assessing vehicle risk, this method identifies the target of attack by acquiring security asset objects, then determines the attack scheme based on the target, and finally determines the threat type based on the attack scheme. Risk assessment is then performed using the attack scheme and threat type. In this method, the target of attack is first identified based on the security asset objects. This target is the platform or system supporting the security asset objects, thus accurately identifying the subject vulnerable to risk threats for subsequent targeted analysis. Furthermore, for the target of attack, the attack scheme is determined, and risk assessment analysis is performed on multiple aspects, including attack path, attack stage, attack technology, attack tools, attack impact scope, and threat type. This provides a standardized risk assessment scheme to ensure the accuracy and consistency of risk assessment.

[0006] In conjunction with the first aspect mentioned above, based on the attack scheme, the corresponding threat type is determined, including: extracting key information related to the attack technology from the attack scheme; inputting the key information into the threat classification model to obtain the threat type; the threat types include: deception, tampering, repudiation, information disclosure, denial of service, and privilege escalation.

[0007] In conjunction with the first aspect above, different attack phases include at least one of the following: Phase 1; Phase 1 is used to indicate the phase of searching for vulnerabilities in the target; Phase 2; Phase 2 is used to indicate the phase of determining how to exploit the vulnerability; Phase 3; Phase 3 is used to indicate the phase of building an attack environment to exploit the vulnerability; Phase 4; Phase 4 is used to indicate the phase of deploying the attack program; Phase 5; Phase 5 is used to indicate the phase of using the attack program to carry out the attack; Phase 6; Phase 6 is used to indicate the phase of continuing the attack while evading the detection of protection tools.

[0008] In conjunction with the first aspect mentioned above, based on the target of the attack, an attack scheme is determined from the second correspondence, including: using an association factor matching algorithm, with the target of the attack as the association factor, obtaining different data query results from each data mart in the second correspondence to form an attack scheme.

[0009] In conjunction with the first aspect mentioned above, the second correspondence includes: attack path data mart; impact scope data mart; time data mart; attack tool data mart; and attack technique data mart.

[0010] In conjunction with the first aspect mentioned above, risk assessment is conducted based on attack schemes and threat types, including: risk assessment based on threat types to identify corresponding threat scenarios; risk assessment based on attack paths to identify multiple nodes involved in the attack; risk assessment based on the scope of attack impact and multiple nodes to determine the depth of attack impact on each node; the depth of attack impact includes at least one of the following: functional safety, property, operability, and privacy regulations; and risk assessment based on attack techniques and tools to determine the feasibility level of the attack on each node.

[0011] In addition to the first aspect mentioned above, this risk assessment method also includes: developing risk management strategies based on the risk assessment results.

[0012] Secondly, a risk assessment device includes an acquisition module, a processing module, and an assessment module. The acquisition module is used to acquire security asset objects in a vehicle. The processing module is used to determine the target of attack from a first correspondence based on the security asset objects. The target of attack is a platform or system supporting the security asset objects. The processing module is used to determine an attack scheme from a second correspondence based on the target of attack. The attack scheme indicates the attack techniques and tools used against the target of attack at different stages in the target attack path, as well as the corresponding attack impact range. The processing module is used to determine the corresponding threat type based on the attack scheme. The assessment module is used to perform a risk assessment based on the attack scheme and threat type.

[0013] In conjunction with the second aspect above, the processing module is used to determine the corresponding threat type based on the attack scheme, including: the processing module is specifically used to extract key information related to the attack technology from the attack scheme; the processing module is specifically used to input the key information into the threat classification model to obtain the threat type; the threat types include: deception, tampering, repudiation, information disclosure, denial of service, and privilege escalation.

[0014] In conjunction with the second aspect above, different attack phases include at least one of the following: Phase 1; Phase 1 is used to indicate the phase of searching for vulnerabilities in the target; Phase 2; Phase 2 is used to indicate the phase of determining how to exploit the vulnerability; Phase 3; Phase 3 is used to indicate the phase of building an attack environment to exploit the vulnerability; Phase 4; Phase 4 is used to indicate the phase of deploying the attack program; Phase 5; Phase 5 is used to indicate the phase of using the attack program to carry out the attack; Phase 6; Phase 6 is used to indicate the phase of continuously attacking while evading the detection of protection tools.

[0015] In conjunction with the second aspect above, the processing module is used to determine the attack scheme from the second correspondence based on the attacked object, including: the processing module is specifically used to obtain different data query results from each data mart in the second correspondence using the attacked object as the correlation factor through the correlation factor matching algorithm, so as to form the attack scheme.

[0016] In conjunction with the second aspect above, the second correspondence includes: attack path data mart; impact scope data mart; time data mart; attack tool data mart; and attack technique data mart.

[0017] In conjunction with the second aspect above, the assessment module is used to conduct risk assessments based on attack schemes and threat types, including: risk assessment based on threat types to determine the corresponding threat scenarios; risk assessment based on attack paths to determine the multiple nodes involved in the attack; risk assessment based on the scope of attack impact and multiple nodes to determine the depth of attack impact on each node; the depth of attack impact includes at least one of the following: functional safety, property, operability, and privacy regulations; and risk assessment based on attack techniques and tools to determine the attack feasibility level for each node.

[0018] In conjunction with the second aspect mentioned above, the strategy development module is used to further develop risk assessment strategies based on the risk assessment results.

[0019] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.

[0020] Fourthly, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the method described in the first aspect.

[0021] The beneficial effects of the second to fourth aspects mentioned above can be referred to the corresponding description of the first aspect, and will not be repeated here. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram illustrating the composition of a risk assessment system provided in an embodiment of this application;

[0024] Figure 2 A flowchart illustrating a risk assessment method provided in an embodiment of this application;

[0025] Figure 3 This application provides a schematic diagram of a vulnerability information structure for a vehicle attack and defense framework.

[0026] Figure 4 This is a schematic diagram of a vehicle information security attack and defense framework provided in an embodiment of this application;

[0027] Figure 5A schematic diagram of a risk assessment method provided in an embodiment of this application;

[0028] Figure 6 A flowchart illustrating a risk assessment method provided in an embodiment of this application;

[0029] Figure 7 This is a complete flowchart illustrating a risk identification method provided in an embodiment of this application.

[0030] Figure 8 This is a schematic diagram of the composition of a risk assessment device provided in an embodiment of this application;

[0031] Figure 9 This is a schematic diagram of the structure of a risk assessment electronic device provided in an embodiment of this application. Detailed Implementation

[0032] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0033] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0034] In the embodiments of this application, the terms "first," "second," "third," "fourth," "fifth," and "sixth" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," "third," "fourth," "fifth," and "sixth" may explicitly or implicitly include one or more of that feature.

[0035] In embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0036] Based on the aforementioned background technology, embodiments of this application provide a risk assessment method, apparatus, device, and storage medium. The method includes: acquiring security asset objects in a vehicle; determining the target of attack from a first correspondence relationship based on the security asset objects; the target of attack being a platform or system supporting the security asset objects; determining an attack scheme from a second correspondence relationship based on the target of attack; the attack scheme indicating the attack techniques and tools used at different attack stages against the target of attack in the target attack path, as well as the corresponding attack impact range; determining the corresponding threat type based on the attack scheme; and performing a risk assessment based on the attack scheme and threat type. It can be seen that, in the process of risk assessment of a vehicle, embodiments of this application determine the target of attack by acquiring security asset objects, determine the attack scheme based on the target of attack, determine the threat type based on the attack scheme, and then perform a risk assessment based on the attack scheme and threat type. In the above method, the target of attack is first determined based on the security asset objects, and the target of attack is the platform or system supporting the security asset objects, thereby accurately identifying the subject subject vulnerable to risk threats, facilitating subsequent targeted analysis. Furthermore, for the target of the attack, the attack plan is identified, and a risk assessment analysis is conducted on multiple plans, including attack path, attack stage, attack technology, attack tools, attack impact scope and threat type, so as to provide a standardized risk assessment plan to ensure the accuracy and consistency of risk assessment.

[0037] Figure 1 This is a schematic diagram illustrating the composition of a risk assessment system provided in an embodiment of this application. Figure 1 As shown, the risk assessment system includes an object acquisition module 101, a determination module 102, and an assessment module 103. The determination module 102 includes determining the target of attack, determining the attack scheme, and determining the threat type.

[0038] The object acquisition module 101 is used to acquire security asset objects in the vehicle. The determination module 102 is used to determine the attacked object from a first correspondence based on the security asset object; the attacked object is the platform or system supporting the security asset object. The determination module 102 is used to determine the attack scheme from a second correspondence based on the attacked object; the attack scheme indicates the attack techniques and tools used against the attacked object at different attack stages in the target attack path, as well as the corresponding attack impact range. The determination module 102 is used to determine the corresponding threat type based on the attack scheme. The assessment module 103 is used to perform a risk assessment based on the attack scheme and threat type.

[0039] In some embodiments, the object acquisition module 101 is used to instruct vehicle developers to input security asset objects.

[0040] In other words, the object acquisition module 101 is used to instruct the user to input the vehicle's security asset objects. During the vehicle design phase, the user can use the vehicle's key parts and information as security asset objects, providing a precise basis for subsequent targeted risk assessments, ensuring that risk assessments cover all important parts, and guaranteeing vehicle information security.

[0041] In some embodiments, the determining module 102 is configured to: determine the attacked object from a first correspondence based on the security asset object; the attacked object is a platform or system supporting the security asset object; the determining module 102 is configured to: determine the attack scheme from a second correspondence based on the attacked object; the attack scheme is configured to indicate the attack techniques and tools used against the attacked object at different attack stages in the target attack path, as well as the corresponding attack impact range; the determining module 102 is configured to: determine the corresponding threat type based on the attack scheme.

[0042] For example, the determination module 102 is used to obtain the target object by matching keywords or a matching list based on the obtained correspondence between the security asset object and the target object. The target object is the platform or system supporting the security asset object. The target object and the data mart are input into the association factor matching algorithm to obtain the attack plan. The attack plan displays the current attack situation of the target object, including the attack techniques and tools used against the target object at different attack stages in the target attack path, as well as the corresponding attack impact range, etc., providing a real data foundation for subsequent evaluation. Based on the attack technology information in the attack plan, the threat type is determined, providing a data foundation for subsequent evaluation to ensure the security of the vehicle information system.

[0043] In some embodiments, the assessment module 103 is used to perform risk assessment based on attack schemes and threat types.

[0044] Understandably, the security asset object is acquired through the object acquisition module 101, the determination module 102 determines the attacked object, attack scheme, and threat type, and the assessment module 103 performs a risk assessment. Throughout this process, based on real attack data and matching methods, risk assessment errors are reduced, effectively ensuring the accuracy and consistency of the analysis results, facilitating subsequent reference for vehicle design.

[0045] In some embodiments, the risk assessment system described above can be deployed on a server. The server can be a single server or a cluster of multiple servers. This application does not limit the specific form of the server.

[0046] In addition, the server also includes a corresponding front-end display device. Developers can interact with the vehicle risk assessment system deployed on the server through the front-end display device to input security asset objects, obtain attack schemes and threat types against the targets in the vehicle, improve the accuracy of subsequent risk assessment, and thus facilitate reference for subsequent vehicle design.

[0047] The vehicle risk assessment method provided in this application will be described below with reference to specific embodiments and accompanying drawings:

[0048] Figure 2 This is a flowchart illustrating a risk assessment method provided in an embodiment of this application. Figure 2 As shown, the risk assessment method provided in this application can be applied to the vehicle design stage and implemented through the aforementioned system, specifically including S201-S205:

[0049] S201, Obtain security asset objects in the vehicle.

[0050] Among them, security asset objects refer to security asset information, which is detailed information on various assets that need to be protected and are related to the functional safety and cybersecurity of vehicle electronic systems, including hardware assets, software assets, data assets, service assets, and functional assets.

[0051] For example, hardware assets include information such as the model, function, interface, and deployment location of vehicle controllers, sensors, communication modules, and chips; software assets include information such as the version, functional logic, and interaction relationships of operating systems, applications, firmware, algorithms, and code libraries; data assets include information such as the type, sensitivity, transmission path, and storage method of vehicle location, driving status, user privacy data (account, biometric information), control commands (such as steering and braking signals), and diagnostic data; and service / functional assets include information such as the business logic, dependencies, and impact on vehicle safety of autonomous driving functions, remote control services, and vehicle networking services.

[0052] Understandably, security asset information is the foundation for risk assessment. Only by clarifying the information of assets can we identify the targets of attack in S202, and further analyze the threats they face, the likelihood of being attacked, and the potential impact, thereby conducting an effective risk assessment.

[0053] S202. Based on the security asset objects, determine the attacked object from the first correspondence.

[0054] The first correspondence refers to the relationship between a security asset object and a target object, which can be matched using keywords or a matching list. The target object is the platform or system that supports the security asset object.

[0055] The targets of attack mentioned here refer to platforms or systems identified based on security assets. These are key entities in vehicle electronic systems that may face cybersecurity threats, including at least automotive hardware systems, automotive operating systems, automotive application systems, automotive near-end communications, and automotive far-end communications.

[0056] For example, the targets of attacks cover multiple critical systems of the vehicle, including the vehicle hardware system, vehicle operating system, vehicle application system, vehicle near-field communication system, and vehicle remote operating system. The vehicle hardware system can be further subdivided into electronic control units and sensors (such as tire pressure sensors and cameras); the vehicle operating system includes the operating system of the in-vehicle infotainment system; the vehicle application system includes various in-vehicle applications, such as navigation software and music players; the vehicle near-field communication system involves Bluetooth, wireless network modules, etc.; and the vehicle remote operating system includes vehicle remote control software and back-end servers.

[0057] For example, targeting a vehicle's telematics box (T-Box) encompasses multiple layers, from hardware to software, and from local to remote. At the hardware level, the vehicle's internal electronic control units, various sensors, GPS modules, and wireless communication modules form the physical foundation for the T-Box's operation and are potential targets for attackers. At the operating system level, the operating system running on the T-Box, such as Android or Linux, controls its various functions and services; an attack on this system could paralyze multiple vehicle services. At the application system level, this includes various in-vehicle applications running on the T-Box. These applications directly interact with users, and their security directly impacts user experience and privacy. Regarding near-field communication systems, the T-Box exchanges data with peripheral vehicle devices via Bluetooth, wireless networks, and other modules. If these communication interfaces are compromised, attackers could potentially infiltrate the vehicle's internal network. The remote operating system is associated with the T-Box's remote control software and backend server. They are responsible for the interaction between the vehicle and external services, such as remote diagnostics and software updates. They are an important bridge for the vehicle to connect to the Internet and also an entry point that network attackers may exploit.

[0058] In some embodiments, the first correspondence records various correspondences between security asset objects and attacked objects. During the query process, keyword or list matching methods can be used to determine the attacked object corresponding to the currently queried security asset object from the first correspondence.

[0059] For example, when the security asset object is a data asset in a T-BOX, the attacked object is determined to be the T-BOX by matching keywords or a matching list.

[0060] In one possible implementation, keyword matching involves assigning a unique keyword to each entity and then establishing a one-to-one relationship based on that keyword. The selection of keywords must ensure uniqueness and is typically in the form of IDs, codes, or hash values. When the acquired security asset object is a data asset within a T-BOX, keyword matching is used. Keywords include, but are not limited to, unique hardware identifiers, vehicle-related identifiers, hardware models, firmware versions, etc., to identify the attacked object as a T-BOX.

[0061] In another possible implementation, list matching clarifies the one-to-one relationship between two entities by maintaining a matching list. This table typically contains two columns: a source identifier and a target identifier. When the acquired security asset object is a data asset in a T-BOX, matching is performed using a matching list. One column in the list contains the security asset's hardware unique identifier 1, vehicle-related identifier 1, hardware model 1, and firmware version 1; the other column contains the attacked object T-BOX's hardware unique identifier 2, vehicle-related identifier 2, hardware model 2, and firmware version 2. These two columns are one-to-one. When the data asset in the T-BOX is entered into the matching list, the attacked object can be identified as the T-BOX.

[0062] Understandably, security assets provide the data foundation for identifying targets, while targets are the platforms and systems that support security assets. Using keywords or matching lists effectively improves the accuracy of identifying targets.

[0063] S203. Determine the attack plan from the second correspondence based on the target of the attack.

[0064] The second correspondence refers to the relationship between the attacked object and the data mart. A data mart is a topic-oriented data storage unit that serves a specific data vector analysis field and facilitates the cross-application of data.

[0065] The attack plan is used to indicate the attack techniques and tools used against the target at different stages of the attack path, as well as the corresponding scope of attack impact.

[0066] An attack path refers to the actual attack chain formed by an attacker hopping between different attack nodes during a complete vehicle information security attack. It encompasses the entire process from the attacker's initial contact with the vehicle system to the final achievement of the attack target. In the embodiments of this application, the attack path typically consists of multiple consecutive attack nodes, each targeting a different object and exploiting its vulnerabilities for penetration. For example, an attacker might start with the vehicle's near-field communication interface, exploiting security vulnerabilities in that interface to gain initial access, and then gradually penetrate other critical components in the in-vehicle network, ultimately achieving the goal of controlling key vehicle functions or stealing sensitive information.

[0067] An attack node refers to a transition point in an attack path, encompassing both the target and the attack stage. A complete attack path may involve multiple targets. After penetrating one attack node, an attacker will select the next node to continue the attack, based on the target and system vulnerabilities. By identifying and analyzing these attack nodes, the security risks of the system can be more accurately assessed, and targeted protective measures can be strengthened to block the attack path.

[0068] The above content shows that there is a corresponding relationship between the attacked object and the data mart. The data mart contains massive amounts of data. By analyzing the attacked object, data related to the attacked object can be obtained from the data mart, thereby determining the attack plan and providing a real data foundation for subsequent evaluation.

[0069] In some embodiments, determining an attack scheme from a second correspondence based on the attacked object includes: using an association factor matching algorithm, with the attacked object as the association factor, obtaining different data query results from each data mart in the second correspondence to form an attack scheme.

[0070] Based on the above, the attack scheme obtained by performing correlation factor matching analysis on the following data analysis vectors in the data mart, according to the attacked target, is as follows: Under an attack path that includes the attacked target and the attack stage, an attack is carried out on a certain attacked target at a certain attack stage using attack tools and attack techniques, resulting in a corresponding attack impact range. The impact range is used to analyze the cost invested in protection at different attack stages.

[0071] Association factor matching algorithms are techniques used to discover relationships between items in a dataset. These algorithms are primarily used to uncover hidden patterns, correlations, or causal relationships in large-scale data. Examples include the Apriori algorithm, FP-Growth algorithm, and Eclat algorithm.

[0072] In some possible implementations, the correlation factor matching algorithm, also known as the correlation factor data mart connection algorithm, is based on the correlation factor of the attacked object. It connects the influence scope data mart, attack path data mart, time data mart, attack tool data mart, attack technique data mart, etc., performs correlation factor matching algorithm operation, and finally outputs the attack plan.

[0073] For example, an attack scheme obtained through the correlation factor algorithm involves a specific attack path (including the target and attack stage). At a certain attack stage (e.g., the execution stage), an attack tool (e.g., a system intrusion tool) is used to apply attack techniques (e.g., privilege escalation, unauthorized modification of personal information) to a specific target (e.g., the TBOX automotive operating system) to complete the attack. In other words, the attack scheme obtained through the correlation factor algorithm is: during the execution stage, a system intrusion tool is used to escalate privileges and unauthorizedly modify personal information on the TBOX automotive operating system to complete the attack.

[0074] In some embodiments, the different attack phases include at least one of the following: a first phase (reconnaissance), which indicates the phase of searching for vulnerabilities in the target; a second phase (exploitation), which indicates the phase of determining how to exploit the vulnerability; a third phase (deployment), which indicates the phase of building an attack environment to exploit the vulnerability; a fourth phase (control), which indicates the phase of deploying the attack program; a fifth phase (execution), which indicates the phase of using the attack program to carry out the attack; and a sixth phase (maintenance), which indicates the phase of continuing the attack while circumventing security tools.

[0075] For example, the attack stages involved differ at different attack nodes and for different targets. The attack stages include: searching for vulnerabilities in the target; determining how to exploit the vulnerabilities; building the attack environment to exploit the vulnerabilities; deploying the attack program; using the attack program to launch the attack; and continuing the attack while evading detection by security tools. Some targets may only involve some of these attack stages. At each attack stage, the attacker uses attack tools and corresponding attack techniques.

[0076] In one possible implementation, the attack phase consists of the following stages: Reconnaissance Phase: Analyzing network topology and entry points to search for target weaknesses, such as using reconnaissance tools to traverse open interfaces; Exploitation Phase: Determining the exploitation method based on reconnaissance results, such as using attack tools to access open interfaces; Control Phase: Exploiting vulnerabilities to create a platform for deploying attack weapons, such as gaining write access to the system through privilege escalation; Deployment Phase: Deploying attack weapons, such as deploying modified applications through technical means; Execution Phase: Executing attack actions, such as illegally obtaining data using the modified application; Maintenance Phase: Maintaining the ability to continue the attack, such as bypassing defense tools to continue the attack. The specific attack stages involved for the target may vary at different attack nodes.

[0077] In some embodiments, the second correspondence includes impact range data mart, attack path data mart, time data mart, attack tool data mart, attack technique data mart, etc.

[0078] Specifically, the impact scope data mart refers to a data mart related to the scope of impact, the attack path data mart is related to the attack path, the time data mart is related to the attack time, the attack tool data mart is related to the attack tools, and the attack technique data mart is related to the attack techniques. These data marts are derived from vulnerability information in the attack and defense framework; details are provided below.

[0079] The details of the source of the data mart in step S203, namely the vulnerability information of the attack and defense framework, are described below:

[0080] Understandably, the vulnerability information in the attack and defense framework is based on the attack path, divided into multiple attack points, with each attack point having a corresponding target. For each target, there are six attack stages: reconnaissance, exploitation, deployment, control, execution, and maintenance. Each stage includes attack techniques, attack entry points, mitigation measures, preconditions, and scope of impact. This information is used to train a big data model to form a data mart. The data mart can include impact scope data marts, attack path data marts, time data marts, attack tool data marts, and attack technique data marts.

[0081] Figure 3 This is a schematic diagram of a vehicle attack and defense framework vulnerability information structure provided in an embodiment of this application. The vulnerability information of the attack and defense framework is divided into multiple attack nodes based on the attack path, namely attack node 1, attack node 2 to attack node n. Each attack node includes the attack target and information about the vehicle information security attack and defense framework. The attack target and attack stage information include elements from six stages in sequence: reconnaissance, exploitation, deployment, control, execution, and maintenance. Specific details of the vehicle information security attack and defense framework are as follows. Figure 4 As shown.

[0082] Figure 4 This is a schematic diagram of a vehicle information security attack and defense framework provided in an embodiment of this application. The framework constructs experience information templates for attacked targets such as hardware systems, operating systems, application systems, near-end communication, and far-end communication. The framework includes attack phases such as reconnaissance, exploitation, deployment, control, execution, and maintenance. Each attack phase includes elements such as attack techniques, scope of impact, attack entry point, mitigation measures, and preconditions.

[0083] This can be understood as constructing a vehicle attack and defense framework vulnerability information targeting vehicle hardware systems, vehicle operating systems, vehicle application systems, vehicle near-end communication, and vehicle far-end communication. When collecting, testing, and reproducing vehicle security vulnerabilities, the details, steps, and attack paths of vulnerability discovery or reproduction are recorded in the vehicle attack and defense framework vulnerability information according to the requirements of the vehicle information security attack and defense framework. A data mart is then obtained through big data training.

[0084] This concludes the detailed explanation of the source of the data mart in step S203, namely, the vulnerability information of the attack and defense framework.

[0085] Based on the above, it can be concluded that, according to the attack target, the data analysis vectors of attack paths, attack targets, attack stages, attack techniques, and attack tools in the data mart are analyzed, and an association factor matching algorithm based on feature rule analysis is applied. Through rule-based or big data-based matching methods, an attack plan can be obtained.

[0086] S204. Based on the attack plan, determine the corresponding threat type.

[0087] In this embodiment of the application, the attack scheme includes information such as attack path, attack target, attack stage, attack technology, and attack tools. To determine the threat type, the key information of the attack technology in the attack scheme is extracted and input into the threat classification model to obtain the threat type.

[0088] In some embodiments, determining the corresponding threat type based on the attack scheme includes: extracting key information associated with the attack technique from the attack scheme; inputting the key information into a threat classification model to obtain the threat type; the threat type includes: deception, tampering, repudiation, information disclosure, denial of service, and privilege escalation.

[0089] In some implementations, extracting key information about attack techniques from an attack scheme requires using a key field text recognition machine learning algorithm. This algorithm refers to machine learning techniques that automatically identify and extract specific key information from unstructured or semi-structured documents. These algorithms are typically used to process specific field information in various documents, and major algorithm types include CNN / LSTM combined models, Transformer architectures, and graph neural networks.

[0090] For example, an attack scheme obtained through the correlation factor algorithm involves a certain attack path (including the target and the attack stage). At a certain attack stage (e.g., the execution stage), an attack tool (e.g., a system intrusion tool) is used to apply attack techniques (e.g., privilege escalation, illegal modification of personal information) to complete the attack on a certain target (e.g., the TBOX automotive operating system). The attack techniques are privilege escalation and illegal modification of personal information. The key information related to the attack techniques obtained through the key field text recognition machine learning algorithm is "privilege escalation" and "illegal modification".

[0091] The threat classification model is the STRIDE model, used to systematically identify potential security threats to a system or application. STRIDE is an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. These acronyms also represent the corresponding threat types: Spoofing indicates an attacker impersonating a legitimate user or system; Tampering indicates unauthorized modification of data or code; Repudiation indicates a user denying performing an operation and the system cannot trace the evidence; Information Disclosure indicates sensitive data being exposed to an unauthorized party; Denial of Service indicates system resources becoming unavailable or overloaded; and Elevation of Privilege indicates an ordinary user illegally obtaining higher privileges.

[0092] In some implementations, the threat classification model is a STRIDE rule classifier. The process involves first manually labeling a training set using STRIDE rules, then training the algorithm using machine learning, and finally obtaining a set of STRIDE classification rules. Essentially, key attack technique information extracted from attack schemes is input into the STRIDE rule classifier, and this key information is then classified using the STRIDE rule set to determine the threat type.

[0093] For example, when extracting key attack technology information from an attack scheme, such as "TBOX data assets" needing to be "tamper-resistant," this key information is input into the STRIDE rule classifier, ultimately resulting in the threat type "Tampering (T)." Based on this threat type, the potential sources and methods of harm to the assets can be identified, providing a data foundation for threat scenario identification and supporting the vehicle risk assessment process.

[0094] An embodiment is given for steps S201-S204, specifically as follows: Figure 5 As shown, Figure 5 This is a schematic diagram illustrating a risk assessment method provided in an embodiment of this application. First, a security asset object is input. Attack targets are then matched using keywords or a matching list. Based on datasets such as impact scope data marts, attack path data marts, time data marts, attack tool data marts, and attack technique data marts, matching results are obtained using an association factor data mart information connection algorithm and a key field text recognition machine learning algorithm. The key field information from the matching results is input into a STRIDE rule classifier. Finally, the STRIDE type corresponding to the security asset object is matched. Figure 5 The security assets in this context are security asset objects. The STRIDE rule classifier implementation process involves first manually labeling the STRIDE training set, then training the algorithm using machine learning, and finally obtaining the STRIDE classification rule set.

[0095] For example, if the input security asset is a T-BOX data asset, and the target is matched to the T-BOX operating system through keywords or a matching list, based on various data marts, the matching result obtained by using the association factor data mart information connection algorithm and the key field text recognition machine learning algorithm is that the "TBOX data asset" needs to be "tamper-resistant". The key field information in the matching result is input into the STRIDE rule classifier, and finally the threat type is "Tampering (T)", where tampering refers to modifying data in transmission or storage.

[0096] S205. Conduct risk assessments based on attack schemes and threat types.

[0097] Understandably, attack plans include information such as attack paths, targets, stages, techniques, and tools. These elements, along with the threat types, provide a real and effective data foundation for risk assessment.

[0098] In some embodiments, risk assessment based on attack schemes and threat types includes: risk assessment based on threat types to determine corresponding threat scenarios; risk assessment based on attack paths to determine multiple nodes involved in the attack; risk assessment based on the scope of attack impact and multiple nodes to determine the depth of attack impact on each node; the depth of attack impact includes at least one of the following: functional safety, property, operability, and privacy regulations; and risk assessment based on attack techniques and tools to determine the attack feasibility level for each node.

[0099] In some embodiments, the content of risk assessment based on attack schemes and threat types can be understood in conjunction with the risk assessment structure diagram.

[0100] Figure 6 This is a flowchart illustrating a risk assessment method provided in this application embodiment. It is divided into a vehicle threat analysis and risk assessment process and a vulnerability database. The vehicle threat analysis and risk assessment process includes asset identification, threat scenario identification, impact level assessment, attack path analysis, attack feasibility, and risk determination. The vulnerability database includes attack and defense framework vulnerability information and a risk assessment engine module. The risk assessment engine module, corresponding to steps S201-204, first inputs a security asset object, matches the security asset object with the target object, obtains the target object, then matches it with a data mart using an association factor matching algorithm, outputs a technical solution, and subsequently outputs the threat type STRIDE. The relationship between the risk assessment engine module and the traditional risk assessment process is also as follows... Figure 6 As shown, the specific explanation is as follows.

[0101] The asset identification module is used to identify the assets that need to be protected and their value. In this embodiment, the asset identification module can be used to obtain the secure asset object, i.e., step S201.

[0102] Threat scenario identification aims to identify the sources and methods of threats that may harm assets. In this embodiment, it involves conducting a risk assessment based on the threat types obtained in step S204 to determine which "integrity" information security attributes require protection, thereby achieving threat scenario identification. This relies on data from a data mart.

[0103] For example, tampering is a direct means of compromising security attributes (especially integrity), and security attributes provide a structured framework for analyzing the impact of tampering and designing protective measures. When the key information of the attack technique extracted from the attack scheme is that "TBOX data assets" need to be "tamper-resistant," this key information is input into the STRIDE rule classifier, and the final threat type is "Tampering (T)". This will directly affect the information security attribute of integrity.

[0104] The impact level assessment, also known as the attack impact depth assessment in this application embodiment, includes functional safety, financial, operational, and privacy regulations. In this application embodiment, based on the technical solution determined in step S203, a risk assessment is performed on the data regarding the attack impact scope contained in that solution to determine the attack impact depth. This is based on a data mart related to the impact scope, i.e., the impact scope data mart.

[0105] Attack path analysis aims to analyze how threats exploit vulnerabilities to achieve attacks. In this embodiment, the attack path determined in step S203 is evaluated, attack steps are decomposed, and multiple nodes involved in the attack are identified. This is based on a data mart related to the attack path, i.e., an attack path data mart.

[0106] The attack feasibility level includes time spent, expertise, level of understanding, window of opportunity, and equipment / tools. In this embodiment, the determination of the attack feasibility level is based on the attack techniques and tools in the technical solution determined in step S203, and a risk assessment is conducted accordingly. This is based on data marts related to time, attack tools, and attack techniques, namely, a time data mart, an attack tool data mart, and an attack technique data mart.

[0107] Among them, risk determination is based on the risk matrix calculation obtained from the results of the above-mentioned steps to obtain the risk level.

[0108] In some embodiments, risk management strategies are developed based on the results of risk assessments.

[0109] Understandably, risk assessments based on attack schemes and threat types include attack paths, attack techniques, attack tools, attack impact scope, and threat types. Different aspects will yield different assessment results. For different assessment results, comprehensive analysis using large language models and other methods is used to obtain risk management strategies.

[0110] For example, a complete example of threat analysis and risk assessment for T-Box data asset tamper resistance is provided. First, critical T-Box data assets are identified and assessed, and their sensitive data is categorized. Threat scenario identification reveals that GPS data can be tampered with via Bluetooth to forge vehicle locations. Attack path analysis shows that because GPS data is transmitted in plaintext with partial encryption, the impact level assessment considers functional security, financial aspects, operability, and privacy regulations, resulting in a comprehensive assessment level of 4. The attack feasibility level is considered medium. Finally, the overall risk level is assessed as 4, with levels ranging from 1 to 5. Based on the above analysis and assessment process, risk mitigation strategies can be implemented through cryptographic binding (such as hardware-level encryption and signatures), minimizing the attack surface (such as disabling unnecessary functions), and dynamic monitoring.

[0111] Figure 7 This is a schematic diagram illustrating the complete process of a risk identification method provided in an embodiment of this application. Figure 7 As shown, the specific steps include S701-S705.

[0112] S701, Obtain security asset objects in the vehicle.

[0113] For example, you can directly identify the security assets that need to be assessed and then perform the subsequent risk assessment.

[0114] S702. Identify the target of the attack.

[0115] For example, based on the relationship between security asset objects and attacked objects, the attacked objects can be obtained by matching keywords or matching lists.

[0116] S703. Determine the attack plan.

[0117] For example, vulnerability information in the attack and defense framework is used to generate a data mart through big data model training. The target to be attacked and the data mart are then input into an association factor matching algorithm for matching to obtain an attack plan.

[0118] S704. Determine the threat type.

[0119] For example, the attack scheme is input into a key field text recognition machine learning algorithm to extract key information associated with the attack technique, and the key information is input into a threat classification model to obtain the threat type.

[0120] S705. Conduct risk assessments based on attack schemes and threat types.

[0121] For example, risk assessments are conducted based on various information included in the attack plan, such as attack paths, targets, stages, techniques, and tools, as well as threat types. Specifically, this includes: risk assessment based on the attack path to identify multiple nodes involved in the attack; risk assessment based on attack techniques and tools to determine the feasibility level of the attack against each node; risk assessment based on the scope of attack impact to determine the depth of attack impact against each node; the depth of attack impact includes at least one of the following: functional safety, property, operational safety, and privacy regulations; and risk assessment based on threat type to determine the corresponding information security attributes. Based on the above assessment results, risks are determined, and then risk mitigation strategies are implemented.

[0122] It is understood that this application provides a risk assessment method, which includes: identifying the target of attack based on security asset objects acquired from a vehicle, using keywords or a matching list; inputting the target of attack and a data mart into an association factor matching algorithm to determine an attack scheme; the attack scheme indicating the attack techniques and tools used against the target of attack at different stages of the target attack path, as well as the corresponding attack impact range; inputting the attack scheme into a key field text recognition machine learning algorithm to extract key information associated with the attack techniques; inputting the key information into a threat classification model to determine the corresponding threat type; and performing a risk assessment based on the attack scheme and threat type. It can be seen that the target of attack is identified by acquiring security asset objects, the attack scheme is determined based on the target of attack, the threat type is determined based on the attack scheme, and a risk assessment is performed based on the attack scheme and threat type. Through the above method, the association factor matching algorithm and key field text recognition machine learning algorithm used reduce risk assessment errors. Furthermore, the real data in the data mart and the obtained attack schemes and threat types effectively provide data support for risk assessment, thereby effectively ensuring the accuracy and consistency of the analysis results.

[0123] This application embodiment can divide the above-described electronic device into functional modules based on the method example described above. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0124] In some embodiments, this application also provides a risk assessment apparatus, which may include one or more functional modules for implementing the risk assessment method described in the above method embodiments.

[0125] For example, Figure 8 This is a schematic diagram illustrating the composition of a risk assessment device provided in an embodiment of this application. Figure 8 As shown, the device includes an acquisition module 801, a processing module 802, and an evaluation module 803.

[0126] A risk assessment device includes an acquisition module 801, a processing module 802, and an assessment module 803. The acquisition module 801 is used to acquire security asset objects in a vehicle. The processing module 802 is used to determine the target of attack from a first correspondence based on the security asset objects. The target of attack is a platform or system supporting the security asset objects. The processing module 802 is used to determine an attack scheme from a second correspondence based on the target of attack. The attack scheme indicates the attack techniques and tools used against the target of attack at different stages in the target attack path, as well as the corresponding attack impact range. The processing module 802 is used to determine the corresponding threat type based on the attack scheme. The assessment module 803 is used to perform a risk assessment based on the attack scheme and the threat type.

[0127] Optionally, the processing module 802 is used to determine the corresponding threat type according to the attack scheme, including: the processing module 802 is specifically used to extract key information related to the attack technology from the attack scheme; the processing module 802 is specifically used to input the key information into the threat classification model to obtain the threat type; the threat type includes: deception, tampering, repudiation, information disclosure, denial of service and privilege escalation.

[0128] Optionally, different attack phases may include at least one of the following: Phase 1; Phase 1 is used to indicate the phase of searching for vulnerabilities in the target; Phase 2; Phase 2 is used to indicate the phase of determining how to exploit the vulnerability; Phase 3; Phase 3 is used to indicate the phase of building an attack environment to exploit the vulnerability; Phase 4; Phase 4 is used to indicate the phase of deploying the attack program; Phase 5; Phase 5 is used to indicate the phase of using the attack program to carry out the attack; Phase 6; Phase 6 is used to indicate the phase of continuing the attack while evading the detection of protection tools.

[0129] Optionally, the processing module 802 is used to determine an attack scheme from the second correspondence based on the attacked object, including: the processing module 802 is specifically used to obtain different data query results from each data mart in the second correspondence using the attacked object as the correlation factor through an association factor matching algorithm, so as to form an attack scheme.

[0130] Optionally, the second correspondence includes: attack path data mart; impact scope data mart; time data mart; attack tool data mart; attack technique data mart.

[0131] Optionally, the assessment module 803 is used to conduct risk assessments based on attack schemes and threat types, including: conducting risk assessments based on threat types to determine the corresponding threat scenarios; conducting risk assessments based on attack paths to determine the multiple nodes involved in the attack; conducting risk assessments based on the scope of attack impact and multiple nodes to determine the depth of attack impact against each node; the depth of attack impact includes at least one of the following: functional safety, property, operability, and privacy regulations; and conducting risk assessments based on attack techniques and tools to determine the attack feasibility level against each node.

[0132] Optionally, the strategy development module is used to further develop risk management strategies based on the risk assessment results.

[0133] Figure 9 This is a schematic diagram of the structure of a risk assessment electronic device provided in an embodiment of this application. Figure 9 As shown, the device may include: a processor 901 and a memory 902; the memory 902 stores instructions executable by the processor 901; when the processor 901 is configured to execute the instructions, it causes an electronic device or network device or manager to implement the methods described in the foregoing method embodiments.

[0134] Optionally, this application provides a computer-readable storage medium comprising: computer software instructions; when the computer software instructions are executed in an electronic device, they cause the electronic device to implement the above-described method. The computer may be an electronic device, a network device, or a manager. The computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0135] In the description of the embodiments of this application, specific features, structures, materials or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0136] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A risk assessment method, characterized in that, The method includes: Retrieve security asset objects from the vehicle; Based on the security asset object, the attacked object is determined from the first correspondence relationship; the attacked object is the platform or system supporting the security asset object; Based on the target being attacked, an attack plan is determined from the second correspondence; the attack plan is used to indicate the attack techniques and tools used against the target being attacked at different stages in the target attack path, as well as the corresponding attack impact range. Based on the attack scheme, determine the corresponding threat type; A risk assessment is conducted based on the attack scheme and the threat type described.

2. The method according to claim 1, characterized in that, The step of determining the corresponding threat type based on the attack scheme includes: Extract key information related to the attack techniques from the attack scheme; The key information is input into the threat classification model to obtain the threat type; the threat type includes: deception, tampering, repudiation, information disclosure, denial of service, and privilege escalation.

3. The method according to claim 1, characterized in that, The different attack phases include at least one of the following: The first phase; the first phase is used to indicate the phase of searching for vulnerabilities in the target object; The second phase; the second phase is used to indicate how the vulnerability will be exploited; Phase Three; The third phase is used to indicate the stage of building an attack environment to exploit vulnerabilities; Phase Four; The fourth phase is used to indicate the phase in which the attack program is deployed; Phase 5; The fifth stage is used to indicate the stage in which an attack is carried out using an attack program; Phase 6; The sixth phase is used to indicate the phase of continuous attack while evading reconnaissance by protective tools.

4. The method according to any one of claims 1-3, characterized in that, Based on the target of the attack, an attack scheme is determined from the second correspondence, including: Using an association factor matching algorithm, with the attacked object as the association factor, different data query results are obtained from each data mart in the second correspondence to form the attack scheme.

5. The method according to claim 4, characterized in that, The second correspondence includes: Attack path data mart; Impact scope: Data marts; Time data mart; Attack tools data mart; Attack techniques data mart.

6. The method according to claim 1, characterized in that, Risk assessment based on the attack scheme and threat type includes: Risk assessments are conducted based on the threat types to identify the corresponding threat scenarios; A risk assessment is conducted based on the attack path to identify the multiple nodes involved in the attack; A risk assessment is conducted based on the scope of the attack and the multiple nodes to determine the depth of attack impact for each node; the depth of attack impact includes at least one of the following: functional safety, property, operability, and privacy regulations. A risk assessment is conducted based on the aforementioned attack techniques and tools to determine the attack feasibility level for each node.

7. The method according to claim 1, characterized in that, The method further includes: Based on the risk assessment results, a risk management strategy will be developed.

8. A risk assessment device, characterized in that, It includes an acquisition module, a processing module, and an evaluation module; The acquisition module is used to acquire security asset objects in the vehicle; The processing module is used to determine the attacked object from the first correspondence relationship based on the security asset object; the attacked object is the platform or system supporting the security asset object; The processing module is used to determine an attack scheme from the second correspondence based on the attacked object; the attack scheme is used to indicate the attack techniques and tools used against the attacked object at different attack stages in the target attack path, as well as the corresponding attack impact range. The processing module is used to determine the corresponding threat type based on the attack scheme; The assessment module is used to perform risk assessment based on the attack scheme and the threat type.

9. An electronic device, characterized in that, The controller includes: a processor and a memory; The memory stores instructions that the processor can execute; When the processor is configured to execute the instructions, the controller causes the controller to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes: computer software instructions; When computer software instructions are executed in an electronic device, the electronic device causes the electronic device to perform the method as described in any one of claims 1-7.

Images