Unmanned aerial vehicle safety risk quantification assessment method and system based on mbse

Abstract

The present application relates to the technical field of unmanned aerial vehicle system safety, and particularly relates to a method and system for quantitatively evaluating the safety risk of an unmanned aerial vehicle based on MBSE. A system modeling language is used to model the safety of an unmanned aerial vehicle cyber-physical system, and an unmanned aerial vehicle system architecture safety model is obtained. The safety attributes of each component are pre-labeled in the unmanned aerial vehicle system architecture safety model. The unmanned aerial vehicle system architecture safety model is converted into a fact file, a pre-set rule base is called to generate a multi-step attack path, and the attack path is used to obtain unmanned aerial vehicle cyber-physical system attack graph data. Topological analysis is performed on the unmanned aerial vehicle cyber-physical system attack graph, and key nodes and paths and attack indicators are extracted. The CVSS scoring model is used to quantitatively evaluate the attack indicators and the safety attribute related indicators of the unmanned aerial vehicle system architecture model, and a comprehensive risk score of the unmanned aerial vehicle cyber-physical system is obtained. The present application pre-positions the safety analysis of the unmanned aerial vehicle system to the design stage, and reduces the repair cost in the later stage.

Description

Technical Field

[0001] This invention relates to the field of unmanned aerial vehicle (UAV) system safety technology, and in particular to a method and system for quantitative assessment of UAV safety risks based on MBSE (Mobile Safety Optimization and Detection). Background Technology

[0002] Unmanned aerial vehicle (UAV) systems typically include a flight platform (containing flight control computing units, actuators, and power management), a ground control station (for operation and mission planning), a communication module (for data exchange between control and telemetry links), navigation and attitude sensors (such as GNSS receivers and IMUs), and a mission payload (for mission execution, data acquisition, and storage). These systems rely on wireless communication to interact with the external environment while maintaining real-time control loops and physical motion safety, making them typical cyber-physical systems (CPS). As UAVs are increasingly used in surveying, inspection, logistics, emergency response, and public safety, their vulnerabilities are becoming more diverse: communication links may be exposed to public networks or complex electromagnetic environments; ground stations may be connected to corporate networks; and firmware and interfaces for flight control and sensors may have supply chain risks or configuration defects. Furthermore, the threats faced by UAVs are not limited to traditional IT vulnerability exploitation but also include attack types that better reflect the characteristics of CPS, such as positioning deviations caused by GNSS / GPS spoofing, command leakage and tampering caused by communication link hijacking and eavesdropping, and abnormal control decisions caused by sensor data forgery injection.

[0003] Traditional security analysis methods, such as vulnerability scanning, penetration testing, black-box testing, or interface auditing, are often implemented after system deployment or prototype completion. A direct problem with this approach is that by the time security bottlenecks are discovered, the system architecture is already fixed. Remediation often requires changing communication protocols, increasing authentication and encryption overhead, adjusting connection topologies, or even replacing hardware and firmware, resulting in high costs and long development cycles. Furthermore, post-deployment testing focuses more on exploitable vulnerabilities in the already implemented system, making it difficult to systematically cover cascading attack paths caused by architectural dependencies. In particular, it struggles to answer system-level questions during the design phase, such as "Where might the attack enter from?", "How many hops are needed?", "Which nodes are inevitable bottlenecks?", and "Which components have the highest risk priority?".

[0004] Therefore, the industry emphasizes "shifting security left," which means bringing security analysis forward to the design phase, making security an inherent activity in the systems engineering process. However, conducting security analysis at the design stage requires solving two core challenges: first, how to form a computable and inferable security representation from system design information; and second, how to quantify the analysis results and feed them back to design decisions. However, delaying security analysis leads to high error correction costs. UAV systems are coupled hardware and software systems, especially communication and flight control systems, which are often strongly related to hardware selection, link protocols, encryption modules, and real-time performance. If architectural-level security bottlenecks are discovered after deployment, remediation is usually not a simple matter of software patches, but requires structural adjustments or even hardware replacement. Furthermore, traditional penetration testing or scanning often starts from a single vulnerability or entry point, easily leading to "locally exploitable" conclusions, but struggling to exhaustively or structurally reason about all possible attack paths from external entry points to critical assets, and also failing to explain the importance of critical nodes at the topological level. The standard MulVAL rule base is primarily geared towards traditional IT network environments and lacks comprehensive semantic coverage for UAV CPS-specific threats (such as GNSS spoofing, link hijacking, and sensor injection). Commonly used scoring systems often fail to consider time-varying sensitivity and physical consequences during flight phases, leading to risk rankings that deviate from engineering realities. Analysis results are typically output in report form, lacking traceable links to the system model and hindering the formation of a closed-loop "design-analysis-improvement" process. Therefore, an end-to-end analysis method is urgently needed to proactively identify risk bottlenecks and prioritize protection measures for unmanned aerial vehicle (UAV) systems. Summary of the Invention

[0005] To address the security risks of existing unmanned aerial vehicle (UAV) systems, this invention provides a method and system for quantitative assessment of UAV security risks based on Model-Based Systems Engineering (MBSE). It utilizes Model-Based Systems Engineering (MBSE) with SysML as its core platform for system modeling, Model-to-Text Transformation (M2T / MTT), and attack graph generation and inference analysis based on logic programming (MulVAL and its extensions) to achieve risk scoring and classification decisions for UAV scenarios. This brings UAV system security analysis forward to the design stage, reducing later repair costs.

[0006] According to the design scheme provided by this invention, on the one hand, a method for quantitative assessment of drone safety risks based on MBSE is provided, comprising:

[0007] A security modeling model of the UAV cyber-physical system is obtained by using a system modeling language. The security attributes of each component are pre-marked in the UAV system architecture security model.

[0008] The security model of the UAV system architecture is converted into a MulVAL fact file, and a multi-step attack path is generated by calling a preset rule base, so as to obtain UAV cyber-physical system attack graph data by using the attack path.

[0009] A topology analysis was performed on the attack graph of the UAV cyber-physical system to extract key nodes, paths, and attack indicators. The CVSS scoring model was then used to quantitatively evaluate the attack indicators and security attribute-related indicators of the UAV system architecture model to obtain a comprehensive risk score for the UAV cyber-physical system. The security attribute-related indicators include: security attribute indicators, property security indicators, and privacy security indicators.

[0010] The safety model of the unmanned aerial vehicle (UAV) system architecture is iteratively optimized based on the comprehensive risk score until the expected safety requirements are met, resulting in the final UAV system architecture model.

[0011] As part of the MBSE-based UAV security risk quantification assessment method of this invention, the security modeling of the UAV cyber-physical system is further performed using a system modeling language, including:

[0012] The unmanned aerial vehicle (UAV) system is divided into several sub-modules, including a flight platform, a ground control station, a communication module, a navigation and attitude sensor, and a mission payload module.

[0013] Configure the composition relationships, interfaces, and security attributes of each module component among the submodules.

[0014] As part of the MBSE-based method for quantitatively assessing drone safety risks in this invention, the drone system architecture security model is further converted into a text file, comprising:

[0015] Extract logical facts from the information of each element in the model. The element information includes: components, security attributes, connection relationships, and attacker locations.

[0016] According to the transformation syntax specification, logical facts in the security model are mapped to MulVAL fact statements, and MulVAL fact files are generated. The MulVAL fact statements include attacker location, asset claims, reachability, host service information, and attack targets.

[0017] As part of the MBSE-based drone security risk quantification assessment method of this invention, a multi-step attack path is generated by calling a preset rule base, including:

[0018] Based on the MulVAL rule base and through logical reasoning, the configuration and vulnerability facts of the UAV system architecture security model are transformed into a multi-stage attack path. This allows for the acquisition and visualization of edges and nodes in the attack graph through the attack path. The MulVAL rule base includes: general vulnerability rules and a feature incremental extension library that pre-collects and describes the semantic information of threats to UAV cyber-physical systems.

[0019] As part of the MBSE-based quantitative assessment method for UAV security risks in this invention, a topology analysis is further performed on the attack graph of the UAV cyber-physical system to extract key nodes, paths, and attack indicators, including:

[0020] Extract all nodes and their attributes from the attack graph, evaluate the risk value of each node, and output the key nodes by sorting them so that the key nodes can be prioritized for hardening.

[0021] Traverse each path in the attack graph, assess the risk of each path, and output the critical path based on the assessment results;

[0022] Attack metrics are constructed based on critical nodes and critical paths. These metrics include: attack path richness described by the number of effective attack paths or critical paths, and average attack success rate obtained by using the attack success probability.

[0023] As part of the MBSE-based quantitative assessment method for UAV security risks in this invention, the CVSS scoring model is further used to quantitatively assess attack indicators and security attribute-related indicators of the UAV system architecture model, including:

[0024] Risk indicators are mapped to attack graph data and UAV system architecture models based on attack indicators and security attribute-related indicators to obtain risk indicators for quantitative assessment under a unified scoring framework.

[0025] Risk indicators are used to obtain exploitability scores, which describe the difficulty of describing vulnerabilities, and impact scores, which describe the extent of damage caused by the exploitation of vulnerabilities.

[0026] The availability score and the impact score are weighted and summed to obtain the comprehensive risk score of the unmanned aerial vehicle cyber-physical system.

[0027] As a method for quantitatively assessing UAV safety risks based on MBSE, this invention further includes iteratively optimizing the UAV system architecture safety model based on the comprehensive risk score, comprising:

[0028] Risk levels are classified using a comprehensive risk score and based on a preset CVSS standard threshold.

[0029] Based on the risk level classification results and using preset level improvement measures, the security model of the UAV system architecture is optimized. The level improvement measures include: isolation and deployment of corresponding security mechanisms.

[0030] Furthermore, this invention also provides a quantitative assessment system for drone safety risks based on MBSE, comprising: a modeling module, a conversion module, an assessment module, and an optimization module, wherein...

[0031] The modeling module is used to perform security modeling of the UAV cyber-physical system using a system modeling language to obtain a UAV system architecture security model, in which the security attributes of each component are pre-marked.

[0032] The conversion module is used to convert the security model of the UAV system architecture into a MulVAL fact file and call the preset rule base to generate a multi-step attack path, so as to use the attack path to obtain the attack graph data of the UAV cyber-physical system.

[0033] The evaluation module is used to perform topology analysis on the attack graph of the UAV cyber-physical system, extract key nodes and paths and attack indicators; and use the CVSS scoring model to quantitatively evaluate the attack indicators and security attribute related indicators of the UAV system architecture model to obtain the comprehensive risk score of the UAV cyber-physical system. The security attribute related indicators include: security attribute indicators, property security indicators and privacy security indicators.

[0034] The optimization module is used to iteratively optimize the UAV system architecture security model based on the comprehensive risk score until the expected security requirements are met, thus obtaining the final UAV system architecture model.

[0035] The beneficial effects of this invention are:

[0036] This invention moves security analysis activities to the system design stage, reducing later remediation costs. It identifies attack entry points, attack paths, and bottleneck nodes during the design phase. Through model-to-text conversion, it automatically generates inference facts from SysML models, improving consistency and reproducibility. Furthermore, it incrementally expands the rule base for UAV CPS-specific threat scenarios, covering multi-step, multi-host, and multi-hop attack chains, avoiding blind spots in local analysis and improving attack graph coverage and relevance. In risk assessment, it introduces flight phase sensitivity and integrates attack graph indicators, making the ranking more consistent with UAV scenarios, outputting risk scores from 0 to 10 and grading results to support engineering resource allocation. Utilizing a design-analysis-improvement closed-loop mechanism, the results can be fed back to the SysML model, supporting iterative development and ensuring the consistency and traceability of security engineering and system engineering in UAV systems. Attached Figure Description

[0037] Figure 1This is a schematic diagram of the MBSE-based quantitative assessment process for drone safety risks in the embodiment.

[0038] Figure 2 This is a schematic diagram of the end-to-end toolchain architecture in the embodiment;

[0039] Figure 3 This is a schematic diagram of the UAV system BDD in the embodiment;

[0040] Figure 4 This is a schematic diagram of the IBD unmanned aerial vehicle platform of the UAV system in the embodiment;

[0041] Figure 5 This is a schematic diagram of the IBD ground control station of the UAV system in the embodiment;

[0042] Figure 6 This is a schematic diagram of the overall UAV attack in the embodiment. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0044] To address the problems in existing UAV security analysis, such as high error correction costs due to delayed analysis timing, difficulty in systematically covering multi-step attack chains, insufficient adaptation of attack graph scenarios, lack of CPS / flight phase features, and disconnect between the analysis and modeling processes, this invention provides an embodiment, see [link to embodiment]. Figure 1 As shown, a method for quantitative assessment of drone safety risks based on MBSE is provided, including:

[0045] S101. Using a system modeling language, a security model of the UAV cyber-physical system is performed to obtain a security model of the UAV system architecture. The security model of the UAV system architecture is pre-marked with the security attributes of each component.

[0046] Specifically, the unmanned aerial vehicle (UAV) system can be divided into several sub-modules, including a flight platform, a ground control station, a communication module, a navigation and attitude sensor, and a mission payload module; the composition relationship, interfaces, and security attributes of each module component are set.

[0047] exist Figure 2 In the end-to-end analysis toolchain shown, the SysML modeling front-end uses Eclipse Papyrus to build a UAV system architecture model and extends security meta-terminals through custom Profiles to uniformly express component, connection, service and security attributes at the model layer.

[0048] During the design phase, a SysML system model is established by acquiring the architecture information of the UAV system. The model covers functional modules such as flight platform, control, communication, and external environment, and at least expresses: component structure, connections and information flow, security attribute annotations, and attack entry points and areas. Figure 3 The system's BDD view is presented, showing these high-level modules and their relationships. Figure 4 and Figure 5 The IBD view shown further reveals the detailed structure and interaction methods of each module. The information flow arrows in the diagram indicate the data transmission paths between components. The flight platform integrates sub-components such as a flight controller, communication module, GPS receiver, IMU sensor, and motor controller. These components interact with each other through information flow. The ground control station establishes a connection with the communication module on the flight platform to achieve remote monitoring and control functions. The internet environment is connected to the communication module; this connection path also constitutes a possible channel for potential attackers to enter the system.

[0049] S102. Convert the UAV system architecture security model into a MulVAL fact file and call the preset rule base to generate a multi-step attack path, so as to use the attack path to obtain UAV cyber-physical system attack graph data.

[0050] Specifically, logical facts can be extracted from the information of each element in the model. The element information includes: components, security attributes, connection relationships, and attacker location. According to the conversion syntax specification, the logical facts in the security model are mapped to MulVAL fact statements, and a MulVAL fact file is generated. The MulVAL fact statements include attacker location, asset claims, reachability, host service information, and attack targets.

[0051] The SysML model undergoes Model-to-Text (MTT) transformation, extracting information such as components, connections, services, and attacker location from the model into a set of logical facts. This is then used to generate a structured fact file conforming to Prolog syntax. The fact file must include at least attacker location, asset claims, reachability, host service information, and attack targets.

[0052] Based on the MulVAL rule base and through logical reasoning, the configuration and vulnerability facts of the UAV system architecture security model are transformed into a multi-stage attack path. This allows for the acquisition and visualization of edges and nodes in the attack graph through the attack path. The MulVAL rule base includes: general vulnerability rules and a feature incremental extension library that pre-collects and describes the semantic information of threats to UAV cyber-physical systems.

[0053] Based on the fact file, the MulVAL rule base is loaded and logical reasoning is performed to generate an attack graph. In addition to general rules, the rule base is preferably expanded incrementally according to the CPS characteristics of the UAV system to cover threat semantics such as GNSS spoofing, link hijacking / eavesdropping, sensor injection, and CVE vulnerability exploitation. Figure 6 The overall attack graph shown indicates that the leaf nodes at the top of the graph represent potential entry points into the system. As illustrated, attackers can achieve this through two methods: first, by using accessible machines to compromise stakeholders; and second, by directly interacting with the communication module via an internet connection (nodes 5 and 6). Both methods ultimately result in the communication module becoming a target (node ​​1).

[0054] S103. Perform topology analysis on the attack graph of the UAV cyber-physical system to extract key nodes, paths, and attack indicators; and use the CVSS scoring model to quantitatively evaluate the attack indicators and security attribute-related indicators of the UAV system architecture model to obtain the comprehensive risk score of the UAV cyber-physical system. The security attribute-related indicators include: security attribute indicators, property security indicators, and privacy security indicators.

[0055] Specifically, all nodes and their attributes in the attack graph can be extracted, and the risk value of each node can be evaluated. Key nodes can be sorted and output to prioritize them for hardening. Each path in the attack graph can be traversed and the risk of each path can be evaluated. Based on the evaluation results, key paths can be output. Attack metrics can be constructed based on key nodes and key paths. The attack metrics include: attack path richness described by the number of effective attack paths or the number of key paths, and average attack success rate obtained by using the attack success probability.

[0056] Perform topology analysis and statistics on the attack graph to extract objective indicators for quantitative evaluation, including at least: attack path richness P, the number of effective attack paths against the target asset, or the number of critical paths after considering path independence; average attack success rate A, the average success probability set by the rule base for the success probability of each step or derived from path combinations; and identification of critical nodes / bottlenecks, such as communication modules, which are often essential nodes from external entry points to core assets and are considered architectural bottlenecks.

[0057] Risk indicators are mapped to attack graph data and UAV system architecture models based on attack indicators and security attribute-related indicators to obtain risk indicators for quantitative assessment under a unified scoring framework. The exploitability score, which describes the difficulty of a vulnerability, and the impact score, which describes the damage caused by the exploitation of a vulnerability, are obtained using the risk indicators. The exploitability score and the impact score are weighted and summed to obtain the comprehensive risk score of the UAV cyber-physical system.

[0058] To quantify and compare the safety risks of various drone components under a unified dimension, this case introduces an improved CVSS (Common Vulnerability Scoring System) scoring model from the automotive field. It expands the "Exploitability" and "Impact" parts of the traditional CVSS by introducing two characteristic dimensions for cyber-physical systems: Safety of Property and Privacy.

[0059] According to the official CVSS specification, the exploitability score is expressed as follows:

[0060] The official values ​​for each coefficient are as follows:

[0061]

[0062] Impact score is expressed as:

[0063] The coefficients of C / I / A:

[0064] No effect (N) = 0

[0065] Low impact (L) = 0.22

[0066] High impact (H) = 0.56

[0067] Then, the final influence score is calculated based on the scope (S):

[0068] If the scope remains unchanged (U):

[0069] If the Scope changes (C):

[0070] Based on the SysML security model and attack graph analysis results established above, system-level information is mapped to the improved CVSS metric, summarized as follows:

[0071] 1. Attack-related indicator mapping: Attack vector (AV), attack complexity (AC), required permissions (PR), and user interaction (UI) are determined by a combination of attack path length, intrusion starting point location, and preconditions in the attack graph. For example, communication modules directly exposed to the Internet are assigned high exploitability parameters such as "network vector, low complexity, no permissions, and no interaction," while execution mechanisms that require multi-hop penetration correspond to higher complexity and higher permission requirements.

[0072] 2. Security Attribute Indicator Mapping: Confidentiality (C), Integrity (I), and Availability (A) are determined by the security attribute annotations of each component in the SysML model. For example, the flight controller and ground control station are highly sensitive to integrity and availability, while the mission payload has a more significant impact on confidentiality and privacy.

[0073] 3. Expanded Impact Indicator Mapping: Property security is used to measure whether component failure can directly or indirectly lead to physical consequences such as drone crashes or serious damage; privacy security is used to measure whether component failure will cause privacy losses such as leakage of mission data or exposure of surveillance footage.

[0074] Specifically, the Scope value for each component of the drone can be represented as:

[0075]

[0076]

[0077] Mapping this system information to CVSS metrics is as follows:

[0078]

[0079] Among them, S and P are indicators specifically extended for drone / CPS systems, drawing on literature from the automotive field.

[0080] Through the above mapping, the "attack graph analysis results" and "MBSE security modeling results" can be transformed into a set of quantifiable risk indicators under a unified scoring framework, providing a basis for subsequent component risk comparison and ranking.

[0081] After completing the indicator mapping, the overall risk score RS is calculated. RS is composed of Exploitability and Impact, with a value of 0-10, and is used to characterize the overall risk level of a component under a given threat scenario. The expression for the overall risk score RS is as follows:

[0082]

[0083] Exploitability and Impact are calculated from the mapping results of the above indicators. Used to adjust the weights of application scenarios / task characteristics.

[0084] Taking the "communication module" as an example

[0085] Step 1: Extract raw information from the system model and attack graph

[0086] From SysML model:

[0087] The host (communication module) is exposed to the internet and listens via the TCP port commport.

[0088] Security attributes: confidentiality=high, integrity=high, availability=high (According to the table above, C=4, which maps to high).

[0089] Attack surface annotation:

[0090] From the MulVAL attack graph:

[0091] Attack origin: attackerLocated(internet)

[0092] Attack path:

[0093] Path description: "The success rate of an attack implemented using the RULE26 rule is 0.8".

[0094] Target asset: targetAsset(communicationmodule, confidentiality)

[0095] Step 2: Map CVSS metrics one by one

[0096]

[0097] Step 3: Substitute into the official CVSS formula for calculation.

[0098] Using the official CVSS v3.1 formula (Scope unchanged, U):

[0099] 1. Calculate Availability (ESC)

[0100]

[0101]

[0102]

[0103]

[0104] 2. Calculate the base influence score (ISC_base)

[0105]

[0106]

[0107]

[0108]

[0109]

[0110]

[0111] 3. Calculate the Influence Score (ISC)

[0112] When the Scope remains unchanged (U):

[0113]

[0114] 4. Calculate the comprehensive basic score

[0115]

[0116]

[0117]

[0118]

[0119]

[0120] 5. Final CVSS score (ignoring timeliness indicators E / RL / RC, all taken as 1.0)

[0121]

[0122] S104. Based on the comprehensive risk score, iteratively optimize the UAV system architecture security model until the expected security requirements are met, and obtain the final UAV system architecture model.

[0123] Specifically, risk levels can be classified using a comprehensive risk score and based on a preset CVSS standard threshold; the security model of the UAV system architecture can be optimized based on the risk level classification results and preset level improvement measures, including: isolation and deployment of corresponding security mechanisms.

[0124] Considering that unmanned aerial vehicle (UAV) systems are cyber-physical systems with critical security implications, and the failure of their components can often lead to personal injury and significant property damage, this invention, based on the CVSS standard threshold, appropriately shifts and subdivides the risk level, classifying it into four levels:

[0125] 1. Critical Risk: .

[0126] 2. High Risk: .

[0127] 3. Medium risk: .

[0128] 4. Low risk: .

[0129] Severe risks require fundamental mitigation or isolation design at the system architecture level; high risks necessitate the deployment of stringent security mechanisms during the design and implementation phases; medium risks can be controlled to an acceptable level by adopting industry-standard security measures; and low risks can be managed through routine controls.

[0130] Based on RS (Risk Level) scores and grading results, a component risk ranking list, key risk clusters, and design phase improvement suggestions can be output, and the results can be written back to the SysML model to form a closed loop. The risk quantification output includes results such as "entry point / attack method (from the attack graph) - specific component - RS - grade" for each component, enabling engineers to understand the scoring source and prioritize accordingly. Key risk identification includes: model-based key asset identification, which uses the SysML security extension model to identify the set of key assets of the UAV system at the model layer by applying importance and securityProperty attributes to components such as Host, Device, and Program; and attack surface analysis based on connectivity, where the InformationFlow and Connection components in the model characterize the communication relationships within the system and with external networks. TCP connections describe the remote links between the ground station, communication module, and external network, while UART, I2C, PWM, and other connections correspond to key data and control channels from sensors to flight controllers and from flight controllers to motor controllers. By associating Attacker with hosts such as the Internet and CommunicationModule, the model can explicitly identify potential attack paths such as "external attacker - external network - communication module / ground station - flight control / actuator", exposing major attack surfaces such as remote intrusion, link eavesdropping and data tampering, and bus injection.

[0131] Based on four dimensions—asset importance, security attributes (confidentiality, integrity, and availability), attack accessibility, and consequences for mission and security—situations simultaneously meeting the criteria of "highly important assets, critical security attributes, high attack accessibility, and severe consequences" are identified as critical risks. Key risks that can be summarized in the model include: remote compromise of ground stations leading to tampering or theft of mission commands; attacks on communication modules causing link interruptions or data tampering; falsification of navigation and attitude sensor data leading to distorted flight control decisions; and malicious alteration of motor control commands resulting in thrust anomalies.

[0132] Key nodes, critical paths, component RS and levels, and hierarchical reinforcement recommendations are written back to the SysML model in a traceable manner, supporting the iterative cycle of "design-analysis-improvement-reanalysis".

[0133] Furthermore, based on the above method, this embodiment of the invention also provides a drone safety risk quantification assessment system based on MBSE, comprising: a modeling module, a conversion module, an assessment module, and an optimization module, wherein,

[0134] The modeling module is used to perform security modeling of the UAV cyber-physical system using a system modeling language to obtain a UAV system architecture security model, in which the security attributes of each component are pre-marked.

[0135] The conversion module is used to convert the security model of the UAV system architecture into a MulVAL fact file and call the preset rule base to generate a multi-step attack path, so as to use the attack path to obtain the attack graph data of the UAV cyber-physical system.

[0136] The evaluation module is used to perform topology analysis on the attack graph of the UAV cyber-physical system, extract key nodes and paths and attack indicators; and use the CVSS scoring model to quantitatively evaluate the attack indicators and security attribute related indicators of the UAV system architecture model to obtain the comprehensive risk score of the UAV cyber-physical system. The security attribute related indicators include: security attribute indicators, property security indicators and privacy security indicators.

[0137] The optimization module is used to iteratively optimize the UAV system architecture security model based on the comprehensive risk score until the expected security requirements are met, thus obtaining the final UAV system architecture model.

[0138] Without altering the core idea of ​​this invention, various equivalent alternatives are permitted. The attack graph generation and inference engine can be replaced by MulVAL with other logical inference or attack graph frameworks, as long as it can still derive the attack path set based on formal facts and rules and output an analyzable graph structure. The system modeling language can be replaced by SysML with other modeling languages ​​capable of expressing component, connection, service, and security attributes and extracting equivalent facts, such as AADL or UML with security extensions. The risk scoring model can adjust weights or adopt other multi-index decision-making methods according to different application scenarios, but should maintain the basic principle of at least integrating component criticality, exposure, flight phase sensitivity, and attack graph structure indicators. The method can also be extended to a hybrid mode combining design-phase prediction and runtime verification, such as introducing runtime monitoring data or digital twin simulation to verify and correct the prediction results, but this extension does not affect the core value of this invention in achieving predictive security modeling and risk quantification assessment during the design phase.

[0139] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0140] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0141] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0142] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0143] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for quantitatively assessing the safety risks of unmanned aerial vehicles (UAVs) based on MBSE, characterized in that, Include: A security modeling model of the UAV cyber-physical system is obtained by using a system modeling language. The security attributes of each component are pre-marked in the UAV system architecture security model. The security model of the UAV system architecture is converted into a MulVAL fact file, and a multi-step attack path is generated by calling a preset rule base, so as to obtain UAV cyber-physical system attack graph data by using the attack path. A topology analysis was performed on the attack graph of the UAV cyber-physical system to extract key nodes, paths, and attack indicators. The CVSS scoring model was then used to quantitatively evaluate the attack indicators and security attribute-related indicators of the UAV system architecture model to obtain a comprehensive risk score for the UAV cyber-physical system. The security attribute-related indicators include: security attribute indicators, property security indicators, and privacy security indicators. The safety model of the unmanned aerial vehicle (UAV) system architecture is iteratively optimized based on the comprehensive risk score until the expected safety requirements are met, resulting in the final UAV system architecture model.

2. The method for quantitative assessment of UAV safety risks based on MBSE according to claim 1, characterized in that, Security modeling of unmanned aerial vehicle (UAV) cyber-physical systems using system modeling languages, including: The unmanned aerial vehicle (UAV) system is divided into several sub-modules, including a flight platform, a ground control station, a communication module, a navigation and attitude sensor, and a mission payload module. Configure the composition relationships, interfaces, and security attributes of each module component among the submodules.

3. The method for quantitative assessment of UAV safety risks based on MBSE according to claim 1, characterized in that, Convert the unmanned aerial vehicle (UAV) system architecture security model into a text file, including: Extract logical facts from the information of each element in the model. The element information includes: components, security attributes, connection relationships, and attacker locations. According to the transformation syntax specification, logical facts in the security model are mapped to MulVAL fact statements, and MulVAL fact files are generated. The MulVAL fact statements include attacker location, asset claims, reachability, host service information, and attack targets.

4. The method for quantitative assessment of UAV safety risks based on MBSE according to claim 1, characterized in that, The system calls a pre-defined rule base to generate a multi-step attack path, which includes: Based on the MulVAL rule base and through logical reasoning, the configuration and vulnerability facts of the UAV system architecture security model are transformed into a multi-stage attack path. This allows for the acquisition and visualization of edges and nodes in the attack graph through the attack path. The MulVAL rule base includes: general vulnerability rules and a feature incremental extension library that pre-collects and describes the semantic information of threats to UAV cyber-physical systems.

5. The method for quantitative assessment of UAV safety risks based on MBSE according to claim 1, characterized in that, Topology analysis was performed on the attack graph of the UAV cyber-physical system to extract key nodes, paths, and attack indicators, including: Extract all nodes and their attributes from the attack graph, evaluate the risk value of each node, and output the key nodes by sorting them so that the key nodes can be prioritized for hardening. Traverse each path in the attack graph, assess the risk of each path, and output the critical path based on the assessment results; Attack metrics are constructed based on critical nodes and critical paths. These metrics include: attack path richness described by the number of effective attack paths or critical paths, and average attack success rate obtained by using the attack success probability.

6. The method for quantitative assessment of UAV safety risks based on MBSE according to claim 1, characterized in that, The CVSS scoring model is used to quantitatively evaluate attack metrics and security attributes of unmanned aerial vehicle (UAV) system architecture models, including: Risk indicators are mapped to attack graph data and UAV system architecture models based on attack indicators and security attribute-related indicators to obtain risk indicators for quantitative assessment under a unified scoring framework. Risk indicators are used to obtain exploitability scores, which describe the difficulty of describing vulnerabilities, and impact scores, which describe the extent of damage caused by the exploitation of vulnerabilities. The availability score and the impact score are weighted and summed to obtain the comprehensive risk score of the unmanned aerial vehicle cyber-physical system.

7. The method for quantitative assessment of UAV safety risks based on MBSE according to claim 1, characterized in that, The safety model of the unmanned aerial vehicle (UAV) system architecture is iteratively optimized based on the comprehensive risk score, including: Risk levels are classified using a comprehensive risk score and based on a preset CVSS standard threshold. Based on the risk level classification results and using preset level improvement measures, the security model of the UAV system architecture is optimized. The level improvement measures include: isolation and deployment of corresponding security mechanisms.

8. A quantitative assessment system for unmanned aerial vehicle (UAV) safety risks based on MBSE, characterized in that, It includes: a modeling module, a transformation module, an evaluation module, and an optimization module. The modeling module is used to perform security modeling of the UAV cyber-physical system using a system modeling language to obtain a UAV system architecture security model, in which the security attributes of each component are pre-marked. The conversion module is used to convert the security model of the UAV system architecture into a MulVAL fact file and call the preset rule base to generate a multi-step attack path, so as to use the attack path to obtain the attack graph data of the UAV cyber-physical system. The evaluation module is used to perform topology analysis on the attack graph of the UAV cyber-physical system, extract key nodes and paths and attack indicators; and use the CVSS scoring model to quantitatively evaluate the attack indicators and security attribute related indicators of the UAV system architecture model to obtain the comprehensive risk score of the UAV cyber-physical system. The security attribute related indicators include: security attribute indicators, property security indicators and privacy security indicators. The optimization module is used to iteratively optimize the UAV system architecture security model based on the comprehensive risk score until the expected security requirements are met, thus obtaining the final UAV system architecture model.

9. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 7.

Images