A threat causal chain-based attack path generation method and system

Abstract

This invention discloses an attack path generation method and system based on threat causal chains, relating to the field of risk assessment technology. It includes: acquiring a vehicle's electronic and electrical architecture diagram; acquiring project asset information; acquiring attack pattern information and an attack pattern library; analyzing various attack pattern information and determining the identity category of the attack pattern based on the scores of various features; constructing an attack pattern index based on the attack pattern information and the weights of each dimension; and acquiring a threat causal chain list. This invention uses the vehicle's EE architecture diagram as the basis for path search, ensuring that attack paths must extend along ECU nodes and communication edges, thus avoiding the generation of invalid paths that cannot propagate in actual vehicle networks and effectively improving the consistency between attack paths and the vehicle's EE topology.

Description

Technical Field

[0001] This invention relates to the field of risk assessment technology, specifically to a method and system for generating attack paths based on threat causal chains. Background Technology

[0002] With the rapid development of intelligent connected vehicles, the internal electronic and electrical architecture of vehicles is becoming increasingly complex, typically including multiple electronic control units (ECUs) such as T-Boxes, gateways, domain controllers, chassis controllers, body controllers, powertrain controllers, and various sensor control units. These ECUs interconnect through various communication interfaces such as CAN, CANFD, LIN, Ethernet, cellular communication, Wi-Fi, Bluetooth, USB, OBD, and charging interfaces. In the process of developing vehicle cybersecurity, performing threat analysis and risk assessment (TARA) according to regulations and standards such as ISO / SAE21434 and UNR155 has become an essential part of the industry. Attack path analysis, in particular, describes how attackers gradually influence target ECUs or target assets from external entry points or a controlled node, and is an important basis for assessing risk levels and formulating security protection strategies.

[0003] In existing technologies, vehicle network security attack path analysis mainly employs the following methods: Manual enumeration: Security engineers manually enumerate attack paths based on experience using tables or modeling tools, such as describing attack chains like "cellular network attack T-Box → gateway forwarding anomaly → affecting braking ECU"; Threat template matching: Applying preset threat templates based on asset type or security attributes to map certain communication assets to threats such as forgery, tampering, and denial of service, but typically only outputting a threat list; Vulnerability scanning or vulnerability graph methods: Identifying high-risk components based on vulnerability information such as CVE, CNVD, and SBOM, and analyzing based on vulnerability relationships; Static attack tree methods: Using predefined attack tree templates to describe attack steps, expressing attack logic but not dynamically bound to the specific project's EE architecture topology; General attacks... Graph technology has been applied in general network security, generating attack paths through state space search and precondition-postcondition matching, mainly targeting host-service-vulnerability models in enterprise IT networks; MITREATT & CK for Vehicles and AUTO-ISAC frameworks provide knowledge bases for classifying vehicle attack tactics and techniques; PASTA and STRIDE solutions combined with graph search use STRIDE as a threat classification label for threat modeling; commercial tools such as ANSYSmedinianalyze and SynopsysDefensics support model-based threat analysis, but their attack path generation logic is usually based on predefined rule bases or template matching.

[0004] However, the existing technologies still have many shortcomings. First, current methods fail to fully utilize the connections between ECU nodes and communication interfaces in the vehicle's electrical and electronic architecture diagram, resulting in attack paths that are inconsistent with the actual vehicle topology and lack topological authenticity. Second, the lack of constraints on the threat type propagation relationships between attack steps easily leads to attack chains with discontinuous attack semantics, and the matching granularity between attack patterns and project assets and ECU instances is coarse, failing to accurately distinguish between different assets, interfaces, and security attributes. Third, in scenarios with multiple ECUs, multiple interfaces, and multiple assets, simple graph search is prone to combinatorial explosion, generating a large number of invalid candidate paths, severely impacting analysis efficiency. Furthermore, inconsistencies in data sources can easily arise between the attack path generation results and subsequent attack tree display and TARA report consumption. Therefore, an automatic attack path generation scheme that combines vehicle electrical and electronic architecture topology, communication interfaces, project assets, and causal relationships of threat types is needed to improve the topological authenticity, semantic legitimacy, and automation efficiency of attack path generation, effectively supporting the high-quality implementation of vehicle TARA work. Summary of the Invention

[0005] Based on this, the purpose of this invention is to provide an attack path generation method and system based on threat causal chains, in order to solve the technical problems existing in vehicle TARA attack path analysis, such as attack paths relying on manual enumeration leading to low efficiency, inability to truly reflect the vehicle EE topology, discontinuous semantics of multi-hop attacks, coarse granularity in matching attack patterns with project assets, and the tendency of simple graph search under complex architectures to generate a large number of invalid paths due to combinatorial explosion. At the same time, it solves the problem of inconsistent data sources between the attack path generation results and subsequent attack tree display and TARA report consumption.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] The first aspect of this application provides a method for generating attack paths based on threat causal chains, comprising: obtaining a vehicle electronic and electrical architecture diagram, the vehicle electronic and electrical architecture diagram including multiple ECU nodes and edges representing the communication relationships between ECUs, each edge having an interface type; obtaining project asset information, the project asset information including the ECU to which the asset belongs, asset type, asset identifier, and security attributes; obtaining attack pattern information and an attack pattern library, the attack pattern information including applicable asset type, applicable asset identifier, applicable interface type, threat type, direct attack identifier, and lateral impact identifier; analyzing each attack pattern information, and determining the identity category of the attack pattern based on the scores of each feature; constructing an attack pattern index based on the attack pattern information and the weights of each dimension; and obtaining a threat causal chain. The threat causal chain table is used to indicate whether the threat type of the previous attack step can affect the threat type of the subsequent attack step. For the target ECU or target asset, a path search is performed on the vehicle's electronic and electrical architecture diagram. When expanding the current path, candidate attack patterns are retrieved from the attack pattern index based on the interface type of the communication edge between the current ECU and adjacent ECUs. It is determined whether the candidate attack pattern simultaneously satisfies asset matching constraints, interface consistency constraints, and threat causal chain constraints. When the above constraints are satisfied, the attack step corresponding to the candidate attack pattern is added to the current path. If the candidate attack pattern is a direct attack pattern, a complete attack path is formed; if it is a lateral influence pattern, the expanded path is added to the search queue for further searching. The system outputs the vehicle network security attack path that satisfies the constraints.

[0008] The second aspect of this application provides an attack path generation system based on threat causal chains, comprising: a data preheating module for loading project assets, vehicle EE architecture diagrams, attack pattern libraries, and threat causal chain lists; an EE topology modeling module for converting the vehicle's electronic and electrical architecture into a set of ECU nodes and a set of communication edges, and recording the interface types of the edges; an attack pattern index construction module for performing feature analysis on attack pattern information to determine the identity category, and constructing an attack pattern index based on asset type, asset identifier, interface type, threat type, and identity category combined with the weights of each dimension; a threat causal chain management module for maintaining the causal relationships between threat types and providing threat causal chain judgment functions; an attack path search module for performing path search on the EE topology diagram, and applying asset matching constraints, interface consistency constraints, threat causal chain constraints, loop prevention constraints, and depth constraints to generate attack paths when expanding paths; and an attack path output module for outputting the attack path node chain, attack description, path length, risk score, target ECU, target asset, and security attribute information.

[0009] In summary, the present invention has the following main advantages:

[0010] This invention uses the vehicle EE architecture graph as the basis for path search, ensuring that attack paths extend along ECU nodes and communication edges. This avoids generating invalid paths that cannot propagate in actual vehicle networks, effectively improving the consistency between attack paths and the vehicle EE topology. By introducing a quantitative scoring and identity classification mechanism for various attack pattern characteristics, combined with an index construction method that uses weights for each dimension, the matching granularity between attack patterns and project assets and ECU instances becomes finer, accurately distinguishing different assets, interfaces, and security attributes. Furthermore, during index retrieval, candidate attack patterns are weighted and sorted based on the search context, significantly improving retrieval efficiency and the accuracy of path extension. Through interface consistency constraints, path extension is only allowed when the applicable interface of the attack pattern matches the interface of the communication edge in the EE architecture graph, avoiding mismatches in interface types. The system expands invalid branches; through threat causal chain constraints, it determines whether there is a transitive relationship between the threat types of the preceding and following attack steps during the path expansion stage, effectively avoiding the generation of paths with discontinuous attack semantics and ensuring the semantic legality and logical coherence of the attack chain; the interface consistency constraints, threat causal chain constraints, anti-loop constraints, and depth constraints work together to filter out a large number of invalid branches before candidate attack patterns enter the search queue, effectively controlling the scale of path search under complex vehicle architectures and avoiding combinatorial explosion problems; at the same time, the attack path generation results maintain data source consistency with subsequent attack tree construction and TARA report consumption, and the generated paths can support path scoring, master path election, and attack tree visualization, fully meeting the requirements of vehicle TARA work for automation, authenticity, and auditability in attack path analysis. Attached Figure Description

[0011] Figure 1 This is the control flowchart of the present invention;

[0012] Figure 2 This is a system module diagram of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0014] The embodiments of the present invention will now be described.

[0015] A method and system for generating attack paths based on threat causal chains, such as Figure 1-2 As shown, it includes: a data preheating module, an EE topology modeling module, an attack pattern index construction module, a threat causal chain management module, an attack path search module, and an attack path output module.

[0016] The data preheating module loads all the basic data required for the operation of subsequent modules before the attack path search process begins. This includes project asset information, vehicle electronic and electrical architecture diagrams, attack pattern libraries, and threat causal chain lists. By connecting to the project database, architecture model files, attack pattern configuration files, and causal chain configuration tables, the data preheating module reads all of the above data into system memory at once and establishes corresponding data structure instances. This ensures that subsequent modules such as EE topology modeling, attack pattern index construction, threat causal chain management, and path search can directly and quickly access the required data from memory during runtime. This avoids frequent disk I / O or database query overhead during the search process, thereby significantly improving the efficiency of attack path generation and system response speed under large-scale vehicle EE architectures.

[0017] The EE topology modeling module is used to convert the vehicle's electronic and electrical architecture into a set of ECU nodes and a set of communication edges, and to record the interface type of the edges. Specifically, the EE topology modeling module reads the vehicle's EE architecture diagram from the project database or model file, obtaining the set of ECU nodes V and the set of communication edges E. For each communication edge, it records its starting ECU, target ECU, interface type, communication direction, network domain, and harness or link identifier.

[0018] The attack pattern index construction module is used to perform feature analysis on attack pattern information to determine the identity category, and construct the attack pattern index based on asset type, asset identifier, interface type, threat type, and identity category, combined with the weights of each dimension. The specific working method of this module will be described in detail below.

[0019] The Threat Causality Chain Management module maintains the causal relationships between threat types and provides functions for determining threat causal chains. This module loads a threat causal chain list, which records whether there is a valid influence relationship between preceding and subsequent threat types.

[0020] The attack path search module performs path searches on the EE topology graph. When expanding paths, it applies asset matching constraints, interface consistency constraints, threat causal chain constraints, loop prevention constraints, and depth constraints to generate attack paths. This module employs a breadth-first search algorithm or other graph search algorithms to perform a reverse tracing search on the EE topology graph starting from the target ECU or target asset, or a forward search starting from an external entry point. In a preferred embodiment, a reverse tracing search starting from the target ECU or target asset is used.

[0021] The attack path output module outputs the attack path node chain, attack description, path length, risk score, target ECU, target asset, and security attribute information. This module reorders the searched paths from the attacker's perspective before outputting them. For example, the path obtained from the reverse search can be presented as "external entry point attack steps → intermediate lateral propagation steps → target asset impact steps" after being reversed.

[0022] Furthermore, the system of the present invention may also include a path scoring module, a main path election module, and an attack tree construction module. The path scoring module is used to quantitatively score the generated paths based on attack patterns, attack potential parameters, CVSS parameters, or vulnerability snapshots. The main path election module is used to group multiple attack paths according to the target object and select a representative main attack path. The attack tree construction module is used to construct an attack tree based on the generated attack path chain for display and auditing purposes.

[0023] The data model includes the EE architecture diagram data model, project asset data model, attack pattern data model, threat causal chain data model, and attack path node data model.

[0024] EE Architecture Diagram Data Model: The vehicle EE architecture diagram is represented as G=(V,E), where V represents the set of ECU nodes and E represents the set of communication edges between ECU nodes. Each edge e∈E includes at least the starting ECU, the target ECU, the interface type, the communication direction, the network domain, and the harness or link identifier. The interface type is used to represent the communication method or attack entry point type, such as CAN, Ethernet, Cellular, Wi-Fi, Bluetooth, USB, OBD, etc.

[0025] Project asset data model: Project asset information includes project identifier (project_id), asset-owning ECU identifier (ecu_id), asset instance or global asset definition identifier (asset_id), asset type identifier (asset_type_id), and security attribute set (security_attr_flags). The security attribute set represents the security objectives or threat attributes involved in the asset.

[0026] Attack Pattern Data Model: Attack pattern information includes pattern identifier (pattern_id), applicable asset category (asset_type_id), applicable asset identifier (asset_id), applicable interface type (interface_id), threat type (threat_type), direct attack identifier (direct_attack_flag), lateral impact identifier (lateral_affect_flag), affected ECU identifier (affect_ecu_flag), attack description (attack_description), and quantitative parameters (quantitative_parameters). The direct attack identifier indicates that the attacker can act on an ECU or asset from an external entry point or by directly exposing an interface. The lateral impact identifier indicates that the attack can further affect adjacent ECUs or assets from one ECU or asset.

[0027] Threat Causal Chain Data Model: The threat causal chain is represented as ThreatCausalLink, including the preceding threat type (source_threat_type), the following threat type (target_threat_type), the impact flag (affect_flag), the optional interface condition (optional_interface_condition), and the optional direction condition (optional_direction_condition). The impact flag (affect_flag) indicates whether the propagation of this threat type is effective.

[0028] Attack Path Node Data Model: Each node in the attack path is represented as AttackPathNode, including the ECU identifier ecu_id, the asset identifier asset_id, the asset type asset_type_id, the interface type interface_id, the threat type threat_type, the attack pattern identifier attack_pattern_id, the previous node previous_node, the list of communication edge identifiers route_link_ids, and the corresponding security attribute security_attr.

[0029] Attack pattern information acquisition and identification includes applicable asset type, applicable asset identifier, applicable interface type, threat type, direct attack identifier, and lateral impact identifier.

[0030] After acquiring attack pattern information, this invention analyzes the various attack pattern details and determines the identity category of the attack pattern based on the scores of each feature. Specifically, the attack pattern is quantitatively scored for the breadth of applicable asset types, the accuracy of applicable asset identification, the heterogeneity of applicable interface types, the propagation capability of threat types, the confidence level of direct attack identification, and the confidence level of lateral impact identification. The scores of each feature are calculated using the following formula:

[0031] ;

[0032] in, The score represents the breadth of matching applicable asset types. It is dimensionless and ranges from 0 to 1.

[0033] This represents the number of asset instances that match the applicable asset type in the attack pattern library, expressed in units of individual instances. It is obtained through statistical queries of the attack pattern library.

[0034] The first adjustment coefficient is dimensionless, and in this embodiment, it is set to 0.02 / each.

[0035] This is the first offset, dimensionless, and has 10 values.

[0036] ;

[0037] in, The accuracy score for applicable asset identification is dimensionless and ranges from 0 to 1.

[0038] As a definiteness factor for the applicable asset identifier, when the applicable asset identifier is a specific instance identifier. When it is a wildcard value (such as asset_id=0 or asset_id=null) , dimensionless.

[0039] This represents the total number of instances corresponding to the asset type for which the applicable asset identifier is applied, expressed in units of individuals, and is obtained from the project asset information.

[0040] The clarity weight is dimensionless, and in this embodiment, it is set to 0.7.

[0041] The value is dimensionless and is set to 0.3 in this embodiment for accuracy weighting.

[0042] ;

[0043] in, The score represents the degree of heterogeneity of the applicable interface type. It is dimensionless and ranges from 0 to 1.

[0044] This represents the number of interface types applicable to the attack mode, expressed in units of individual types. It is obtained by counting the number of interface types included in the "Applicable Interface Types" field of the attack mode.

[0045] For the first The category coverage coefficient for each interface type is dimensionless and is applied when the interface types belong to different communication categories. Otherwise, the value is 0. The communication categories are divided as follows: wired vehicle network category includes CAN, CANFD, and LIN; Ethernet category includes Ethernet; wireless communication category includes Cellular, Wi-Fi, and Bluetooth; and external interface category includes USB, OBD, and charging interface.

[0046] ;

[0047] in, The score represents the ability of a threat type to spread; it is dimensionless and ranges from 0 to 1.

[0048] This represents the number of subsequent threat types that a threat type can influence as a preceding threat type in the causal chain, expressed in units of one, obtained by querying the threat causal chain.

[0049] This represents the number of times a threat type is affected by a preceding threat type as a subsequent threat type in the causal chain, expressed in units of [number], obtained by querying the threat causal chain.

[0050] ;

[0051] in, The confidence score for the direct attack identifier is dimensionless and takes the value of 0 or 1, determined by the direct attack identifier field of the attack mode.

[0052] ;

[0053] in, The confidence score for the lateral impact identifier is dimensionless and takes the value of 0 or 1, determined by the lateral impact identifier field of the attack mode.

[0054] The overall identity discrimination score is calculated based on the scores of each feature:

[0055] ;

[0056] in, The score is a dimensionless score for overall identity determination, ranging from 0 to 1.

[0057] To match the breadth weight, which is dimensionless, a value of 0.15 is used in this embodiment.

[0058] The precision weight is dimensionless, and in this embodiment, it is set to 0.15.

[0059] This is the weight for the degree of heterogeneity, which is dimensionless and is set to 0.15 in this embodiment.

[0060] The propagation capability weight is dimensionless, and in this embodiment, it is set to 0.20.

[0061] The direct attack identifier weight is dimensionless, and in this embodiment, it is set to 0.175.

[0062] The horizontal influence label weight is dimensionless and has a value of 0.175.

[0063] and + + + .

[0064] The rule for classifying identity categories is: when and When, it is determined to be a direct attack mode; when and When, it is determined to be a horizontal influence mode; when and At that time, if Then it is determined to be a combination of direct attack mode and lateral influence mode. Then according to and Auxiliary discrimination (when) and If all values ​​are greater than or equal to 0.5, the horizontal impact mode is prioritized; otherwise, the direct attack mode is prioritized.

[0065] An attack pattern index is constructed based on the asset type, asset identifier, interface type, threat type, and identity category of the attack pattern, combined with the weights of each dimension.

[0066] Specifically, the combination of asset type and asset identifier is used as the first-level index key:

[0067] ;

[0068] in, For the first-level index key, For asset type (asset_type_id), a dimensionless identifier. For asset identification (asset_id), a dimensionless identifier;

[0069] Use the interface type as the second-level index key:

[0070] ;

[0071] in, For the second-level index key, The interface type (interface_id) is a dimensionless enumeration value, with values ​​including CAN, Ethernet, Cellular, Wi-Fi, Bluetooth, USB, OBD, etc. For direct attack mode, the interface type is either the preset self-attack interface (SELF) or the external entry interface.

[0072] Using threat type and identity category as the third-level index key:

[0073] ;

[0074] in, For the third-level index key, Threat type (threat_type), a dimensionless enumeration value. This is a dimensionless enumeration of identity categories, with values ​​for direct attack mode, lateral influence mode, hybrid mode, or bridging mode.

[0075] Weights are assigned to each dimension, including asset type, asset identifier, interface type, threat type, and identity category. The weight vector is as follows:

[0076] ;

[0077] in, Weights for asset types, Assign weights to asset identifiers. For interface type weights, Threat type weights, The weights are for identity categories. Each weight is dimensionless, ranging from 0 to 1, and the sum is 1. Each weight is dynamically configured by the system based on the current search context. For example, when the security attribute of the target asset is integrity, the system increases the weight of the threat type dimension; when the communication interface of the current ECU is CAN, the system increases the weight of the interface type dimension.

[0078] During index retrieval, the weighted score of candidate attack patterns is calculated using the following formula:

[0079]

[0080] in, This is the weighted total score of the candidate attack patterns, dimensionless, and ranging from 0 to 1.

[0081] For the first Preset weighting coefficients for each dimension, dimensionless;

[0082] For candidate attack patterns in the first The matching score is a dimensionless value that ranges from 0 to 1. When there is a complete match, the value is 1. When there is a partial match, the value is an intermediate value between 0 and 1 depending on the degree of matching. When there is no match, the value is 0.

[0083] The total number of dimensions participating in the weighted calculation is a positive integer. In this embodiment... These correspond to five dimensions: asset type, asset identifier, interface type, threat type, and identity category.

[0084] Match score The determination method is as follows: for dimensions of exact matching (such as asset type and asset identifier), when the dimension value of the candidate attack pattern is exactly the same as the search key... ,otherwise For similarity matching dimensions (such as interface type), when the interface type of the candidate attack pattern is the same as the retrieved interface type or belongs to the same communication category... Otherwise, take a value between 0 and 1 based on interface compatibility. For example, when Ethernet and Wi-Fi belong to the same network communication category, a value between 0 and 1 can be used. For the dimensions of classification matching (such as threat type and identity category), the degree of matching between the candidate attack pattern and the target category is determined. value.

[0085] The hit results are weighted and scored based on the current search context. The system sorts the candidate attack patterns, prioritizing those with higher weighted scores. For example, when the search context determines that the target ECU is a GatewayECU, the target asset is a routing and forwarding configuration, the interface is Ethernet, and the threat type is Tampering, the system configures the weights of each dimension as follows: , , , , Then, the weighted score for each candidate attack mode is calculated. ,according to The values ​​are sorted from highest to lowest to return a list of candidate attack patterns.

[0086] The construction process includes the following steps: traversing the attack pattern library; reading the asset category, asset identifier, interface type, and threat type for each attack pattern; writing the attack pattern to the corresponding index bucket; when the attack pattern applies to all sub-assets under a certain asset class, using a wildcard asset identifier (such as asset_id=0 or asset_id=null); when the attack pattern is a direct attack pattern, writing it to the direct attack interface or a preset self-attack interface (such as interface_id=SELF); when the attack pattern is a lateral influence pattern, writing it to the corresponding communication interface.

[0087] Retrieve the threat causal chain, which indicates whether the threat type of a previous attack step can influence the threat type of a subsequent attack step. The threat causal chain is read from a configuration file, database, or table.

[0088] The threat causal chain judgment function is defined as follows: query whether there is a record in the threat causal chain list such that the source_threat_type of the record is equal to prevThreatType, the target_threat_type is equal to nextThreatType, and the affect_flag is true. If it exists, return true; otherwise, return false.

[0089] Attack path generation methods based on threat causal chains include:

[0090] Obtain the vehicle's electronic and electrical architecture diagram: The system reads the EE architecture diagram from the project database or model file, obtaining the ECU node set V and the communication edge set E, where each edge has an interface type. For each ECU node, an adjacency relationship is established.

[0091] Obtain project asset information: The system reads the project asset table to obtain the project assets configured on each ECU. Each project asset includes the ECU to which the asset belongs, the asset type, the asset identifier, and the security attributes.

[0092] Acquiring attack pattern information: The system reads attack pattern information from the attack pattern library. Each attack pattern includes the applicable asset type, applicable asset identifier, applicable interface type, threat type, direct attack identifier, and lateral impact identifier.

[0093] Analyze and classify attack patterns to determine identity categories: Using the method described above, quantify and score each attack pattern and calculate the score for each feature. Combined with identity assessment score The identity category is determined according to the discrimination rules. For example, if the direct attack identifier of attack mode P1 is true and the lateral influence identifier is false, it is judged as a direct attack mode; if the direct attack identifier of attack mode P2 is false and the lateral influence identifier is true, it is judged as a lateral influence mode; if the direct attack identifier of attack mode P3 is false and the lateral influence identifier is true, it is judged as a lateral influence mode.

[0094] Construct an attack pattern index: Based on the above index structure, construct an attack pattern index according to the asset type, asset identifier, interface type, threat type, and identity category of the attack pattern, combined with the weights of each dimension.

[0095] Obtain the threat causal chain: The system loads the threat causal chain, for example, the causal chain records Spoofing→Tampering as yes, Tampering→DenialofService as yes.

[0096] Target ECU or target asset path search: In a preferred embodiment, a reverse source tracing search method is used to search for possible attack entry points by starting from the target ECU or target asset and tracing back along the EE topology.

[0097] First, target node seeds are generated. In the reverse tracing search method, the system generates two types of seed nodes for the target ECU or target asset: direct attack seed nodes and internal impact seed nodes. Direct attack seed nodes indicate that the target asset can be directly attacked by external entry points, forming a complete single-node path. Internal impact seed nodes indicate that the target asset may be laterally affected by adjacent ECUs or internal paths, requiring further searching along the EE topology for preceding attack steps.

[0098] The direct attack seed node is generated by querying the attack pattern index for direct attack patterns applicable to the target asset, i.e., the index key. Match the target asset's asset type and asset identifier. Equal to SELF The attack patterns are categorized as direct attack patterns. For each matching attack pattern, an AttackPathNode is created, where ecu_id is set to the target ECU identifier, asset_id is set to the target asset identifier, interface_id is set to SELF, threat_type is set to the threat type of the attack pattern, attack_pattern_id is set to the pattern identifier of the attack pattern, previous_node is set to empty, route_link_ids is set to an empty list, and security_attr is set to the target security attribute.

[0099] The method for generating internal impact seed nodes is as follows: query the attack pattern index for lateral impact patterns applicable to the target asset, i.e., the index key. Match the target asset's asset type and asset identifier. Not equal to SELF The attack patterns are categorized as either lateral influence or hybrid attack patterns. For each matching attack pattern, an AttackPathNode is created, where interface_id is set to the interface type of that attack pattern.

[0100] For example, for the brake control parameter asset on BrakeECU (target security attribute is Integrity), the system queries attack mode P3 (threat type is DenialofService, interface type is CAN, identity category is Lateral Influence Mode) as an internal influence seed node and adds it to the search queue.

[0101] Expanding the current path: The system uses a breadth-first search algorithm to expand the path on the EE topology graph. When the search queue is not empty, the current path is retrieved from the queue, and the last node of the current path is obtained.

[0102] Obtain the adjacent links of the current ECU. For example, if the current ECU is BrakeECU, its adjacent link is the CAN edge between it and GatewayECU.

[0103] Application loop prevention constraints: The combination of ECU identifier, asset identifier, interface type, threat type and attack mode identifier is used as the access mark. If the access mark corresponding to the candidate node already exists in the current path, expansion is prohibited.

[0104] Apply depth constraints: Set the maximum number of path nodes. When the current path length reaches the maximum value, it will no longer be expanded.

[0105] For each adjacent link, obtain the peer ECU and the interface type of the communication edge. Apply interface consistency constraints: the applicable interface type of the candidate attack pattern must be consistent with the interface type of the communication edge to be expanded. For example, if the current node is an affected node on BrakeECU (threat type: DenialofService, interface type: CAN), and the peer GatewayECU is found along the CAN edge, the interface type of subsequent candidate attack patterns must be CAN.

[0106] Retrieve candidate attack patterns from the attack pattern index. Based on the project asset information on the peer ECU and the interface type of the current communication edge, query the attack pattern index.

[0107] Asset matching constraints apply: the applicable asset type of the candidate attack pattern must be consistent with the project asset type on the current ECU, and the applicable asset identifier of the candidate attack pattern must be consistent with or a wildcard value of the project asset identifier. Furthermore, the security attributes of the candidate attack pattern must match the target security attributes. A security attribute matching function determines whether the candidate attack pattern matches the target security attributes.

[0108] Apply threat causal chain constraints (reverse search): the threat type of a candidate preceding attack step can influence the threat type of the current following attack step.

[0109] When all the above constraints are met, a new attack path node is constructed and added to the current path. The identity category of the candidate attack mode is determined: if it is a direct attack mode, a complete attack path is formed, the path is reversed and added to the result set; if it is a lateral influence mode, the expanded path is added to the search queue to continue the search.

[0110] For example, following the search process described above, the search proceeds backward from the BrakeECU's braking control parameters along the CAN edge to the GatewayECU, matching attack mode P2 (threat type Tampering, interface type Ethernet). The causal chain indicates that Tampering → DenialofService is true, thus passing the constraint. Continuing the search backward from the GatewayECU along the Ethernet edge to the T-BoxECU, the search matches attack mode P1 (threat type Spoofing, interface type Cellular, identity category: direct attack mode). The causal chain indicates that Spoofing → Tampering is true, thus passing the constraint. This ultimately forms the complete attack path.

[0111] Output attack path: When a direct attack node or external entry point node is found, the system outputs the complete path. The output can be reversed to reflect the attacker's perspective: external entry point attack steps → intermediate lateral propagation steps → target asset impact steps.

[0112] The output attack path includes: attack path node chain, attack mode hit by each node, path start point, end point, ECUs and interfaces passed through, target ECU, target asset and security attributes, path length, risk score, main path identifier, and path node chain that can be used to construct the attack tree.

[0113] Preferably, the invention also includes a path scoring method: In one embodiment, the invention further includes a path scoring step: quantifying and scoring the generated attack path, wherein the scoring factors include at least one of attack potential score, CVSS exploitability score, vulnerability stacking score, path length, and target asset importance.

[0114] Attack Potential (AP) Score: For multiple attack steps in the path, obtain the attack potential parameters corresponding to each attack mode, including vulnerability discovery time, attacker's expertise level, target knowledge requirements, attack opportunity window, and attack device requirements. In one implementation, the AP parameter of the path is taken as the most difficult link in the path as the path dimension parameter.

[0115] CVSS exploitability score: For CVSS parameters associated with attack patterns or vulnerabilities, exploitability scores are calculated based on the dimensions AttackVector, AttackComplexity, PrivilegesRequired, UserInteraction, and AttackRequirements, according to their weights.

[0116] Vulnerability Overlay Scoring: Combining SBOM and CVE / CNVD vulnerability snapshots, vulnerability information hitting a specific ECU or asset is overlaid into the attack path score. For example, if a software component corresponding to an asset hits a high-exploitability CVE, the attack potential requirement is lowered or the path exploitability score is increased.

[0117] Path search caching: In one implementation, the system caches information on direct attack nodes, internally affected nodes, and connected edges of the ECU. The direct attack cache (DirectAttackCache) uses `ecu_id` as the key and a list of direct attack nodes on the ECU as the value. The internal attack cache (InnerAttackCache) uses `ecu_id` as the key and a list of internally affected nodes on the ECU as the value. The link cache (LinkCache) uses `ecu_id` as the key and a list of adjacent links on the ECU as the value. Caching reduces redundant queries and improves path generation efficiency in large-scale EE architectures.

[0118] Preferably, the process also includes a main path election step: grouping multiple attack paths according to the target object, and selecting a main attack path from each group based on risk score and path length.

[0119] When multiple attack paths exist under the same target object, group them according to the key (item_id, ecu_id, asset_id, security_attr_id). Within each group, select one primary path: sorted in ascending order by attack_risk_score, then by attack_length, and finally by path_id. The selected path is marked as the primary attack path for TARA reporting; other paths are reserved as variant paths for auditing or attack tree display. Terminology definition:

[0120] Vehicle Electrical and Electronic Architecture Diagram (EE Diagram): A topology diagram used to represent the relationships between ECUs, domain controllers, communication links, and interfaces in a vehicle.

[0121] ECU node: Electronic control unit, domain controller or other communicable control node in the EE architecture diagram.

[0122] Communication edge: Represents the communication relationship between two ECU nodes. The communication edge has an interface type.

[0123] Interface type: Indicates the communication method or attack entry point type, such as CAN, Ethernet, Cellular, Wi-Fi, Bluetooth, USB, OBD, etc.

[0124] Project assets: Asset instances that are bound to an ECU in a specific project, such as communication modules, diagnostic services, firmware, control parameters, etc.

[0125] Security attributes: The security objectives or threat attributes involved in the asset, such as confidentiality, integrity, availability, authenticity, non-repudiation, and identity authentication.

[0126] Attack pattern: refers to the pattern of rules by which attackers carry out attacks against a certain type of asset, interface, and threat.

[0127] Direct attack mode: This refers to an attack mode in which the attacker can act on the ECU or assets from an external entry point or by directly exposing an interface.

[0128] Lateral Impact Pattern: This indicates an attack pattern where an attack can further affect adjacent ECUs or assets from one ECU or asset.

[0129] Threat type: Indicates the threat category of the attack steps, which can be STRIDE type or other security threat classifications.

[0130] Threat causal chain: This represents the mapping relationship between whether the threat type of the previous attack step can trigger, influence, or cause the threat type of the subsequent attack step.

[0131] Interface consistency constraint: Path expansion is allowed only when the applicable interface of the attack mode is consistent with the interface type of the communication edge to be expanded in the EE architecture diagram.

[0132] Attack path: A path consisting of multiple attack steps arranged in the order of attack propagation, used to represent the process by which an attacker gradually affects a target asset from the entry point.

[0133] The steps of the methods or algorithms described in this application can be directly embedded in hardware, software units executed by a processor, or a combination of both. Exemplarily, a storage medium can be connected to a processor so that the processor can read information from and write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. Optionally, the processor and the storage medium can also be located in different components within a terminal. These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0134] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely illustrative examples of this application and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Thus, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A method for generating attack paths based on threat causal chains, characterized in that: The method includes: Obtain the vehicle electronic and electrical architecture diagram, which includes multiple ECU nodes and edges representing the communication relationships between ECUs, with each edge having an interface type; Obtain project asset information, which includes the ECU to which the asset belongs, the asset type, the asset identifier, and the security attributes; Acquire attack pattern information and an attack pattern library. The attack pattern information includes applicable asset type, applicable asset identifier, applicable interface type, threat type, direct attack identifier, and lateral impact identifier. Analyze the information on various attack patterns and determine the identity category of the attack pattern based on the scores of various features; An attack pattern index is constructed based on attack pattern information and the weights of each dimension; Obtain a threat causal chain, which indicates whether the threat type of the previous attack step can affect the threat type of the subsequent attack step. For a target ECU or target asset, perform path search on the vehicle's electronic and electrical architecture diagram. When expanding the current path, retrieve candidate attack modes from the attack mode index based on the interface type of the communication edge between the current ECU and adjacent ECUs. Determine whether candidate attack patterns simultaneously satisfy asset matching constraints, interface consistency constraints, and threat causal chain constraints; When the above constraints are met, the attack steps corresponding to the candidate attack mode are added to the current path. If the candidate attack mode is a direct attack mode, a complete attack path is formed. If it is a lateral influence mode, the expanded path is added to the search queue to continue searching. Output the vehicle network security attack path that satisfies the constraints.

2. The attack path generation method based on threat causal chain according to claim 1, characterized in that: The analysis of various attack pattern information, and the determination of the attack pattern's identity category based on various feature scores, includes: The attack pattern is quantitatively scored based on the breadth of applicable asset types, the accuracy of applicable asset identification, the heterogeneity of applicable interface types, the propagation capability of threat types, the confidence level of direct attack identification, and the confidence level of lateral impact identification. The scores for each feature are calculated using the following formula: ； in, The score is given for the breadth of matching applicable asset types. The number of asset instances that match the applicable asset type in the attack pattern library. The first adjustment coefficient, This is the first offset; ； in, To score the accuracy of applicable asset identification, To determine the clarity factor for applicable asset identification, The total number of instances corresponding to the asset type for which the applicable asset identifier is applied. For clarity weighting, For accuracy weighting; ； in, Scoring is given based on the degree of heterogeneity of the applicable interface types. The number of interface types applicable to the attack mode. For the first Category coverage coefficient for each interface type; ； in, Scoring the propagation ability of threat types, This represents the number of subsequent threat types that a threat type, as a preceding threat type, can influence in the causal chain. The number of times a threat type is affected by a preceding threat type as a subsequent threat type in the causal chain; ； in, The confidence score for the direct attack identifier; ； in, The confidence score for the horizontal influence of the identifier; The overall identity discrimination score is calculated based on the scores of each feature: ； in, As a comprehensive score for identity determination, To match breadth weights, For accuracy weighting, Weights for heterogeneity Weighting for propagation capability, To directly attack the identifier weight, To influence the weight of the identifier horizontally.

3. The attack path generation method based on threat causal chain according to claim 2, characterized in that: The construction of the attack pattern index based on attack pattern information and the weights of each dimension includes: The first-level index key is a combination of asset type and asset identifier: ； in, For the first-level index key, For asset type, For asset identification; Use the interface type as the second-level index key: ； in, For the second-level index key, For interface type; Using threat type and identity category as the third-level index key: ； in, For the third-level index key, Threat type For identity categories; Weights are assigned to each dimension, including asset type, asset identifier, interface type, threat type, and identity category. The weight vector is as follows: ； in, Weights for asset types, Assign weights to asset identifiers. For interface type weights, Threat type weights, Weights based on identity category; During index retrieval, the weighted score of candidate attack patterns is calculated using the following formula: ； in, The weighted total score for candidate attack patterns. For the first Preset weight coefficients for each dimension, For candidate attack patterns in the 1st Matching scores across all dimensions The total number of dimensions involved in the weighted calculation; The hit results are weighted and scored based on the current search context. Sort the candidate attack patterns and return those with the highest weighted scores first.

4. The attack path generation method based on threat causal chain according to claim 3, characterized in that: The threat causal chain constraint is as follows: in reverse source tracing search, the threat type of the candidate preceding attack step can affect the threat type of the current subsequent attack step; in forward search, the threat type of the current attack step can affect the threat type of the candidate subsequent attack step.

5. The attack path generation method based on threat causal chain according to claim 4, characterized in that: The asset matching constraints are as follows: the applicable asset type of the candidate attack mode is consistent with the project asset type on the current ECU, the applicable asset identifier of the candidate attack mode is consistent with the project asset identifier or is a wildcard value, and the security attributes of the candidate attack mode match the target security attributes.

6. The attack path generation method based on threat causal chain according to claim 5, characterized in that: The interface consistency constraint is that the applicable interface type of the candidate attack mode is consistent with the interface type of the communication edge to be extended. For the direct attack mode, the applicable interface type is the preset self-attack interface or the external entry interface.

7. The attack path generation method based on threat causal chain according to claim 6, characterized in that: The path search also includes loop prevention constraints: a combination of ECU identifier, asset identifier, interface type, threat type and attack mode identifier is used as an access marker. If the access marker corresponding to the candidate node already exists in the current path, expansion is prohibited.

8. The attack path generation method based on threat causal chain according to claim 7, characterized in that: It also includes a path scoring step: quantifying and scoring the generated attack paths, with scoring factors including at least one of attack potential score, CVSS exploitability score, vulnerability stacking score, path length, and target asset importance.

9. The attack path generation method based on threat causal chain according to claim 8, characterized in that: It also includes a main path election step: grouping multiple attack paths according to the target object, and selecting a main attack path in each group based on risk score and path length.

10. An attack path generation system based on threat causal chains, characterized in that: The system includes: Data preheating module: used to load project assets, vehicle EE architecture diagram, attack pattern library, and threat causal chain; The EE topology modeling module is used to convert the vehicle's electronic and electrical architecture into a set of ECU nodes and a set of communication edges, and to record the interface type of the edges; The attack pattern index construction module is used to perform feature analysis on attack pattern information to identify the identity category, and construct the attack pattern index based on asset type, asset identifier, interface type, threat type and identity category combined with the weights of each dimension. The threat causal chain management module is used to maintain the causal relationships between threat types and provide threat causal chain judgment functions; The attack path search module is used to perform path search on the EE topology graph. When expanding the path, it applies asset matching constraints, interface consistency constraints, threat causal chain constraints, loop prevention constraints, and depth constraints to generate attack paths. The attack path output module is used to output the attack path node chain, attack description, path length, risk score, target ECU, target asset, and security attribute information.

Images