42 results about "Attack tree" patented technology

The invention discloses a data safety protection method for a photovoltaic power station in an intelligent power grid environment, and relates to the technical field of intelligent water supply equipment inspection. The method comprises the following steps of: 1, identifying and evaluating a data security risk of a photovoltaic power station by utilizing an attack tree model and a threat model, and evaluating a risk level; and meanwhile, on the basis of a block chain technology, a unique digital identity label is generated for the photovoltaic power station equipment and a service scene thereof, and access control is implemented. According to the data security protection method for the photovoltaic power station in the intelligent power grid environment, a large amount of data can be efficiently processed, the security and integrity of the data in the transmission, storage and processing processes are ensured, information leakage or hostile attacks can be avoided, the data security of the photovoltaic power station is improved, and safe and stable operation of a power system is ensured.

The invention provides an attack technique clustering and attributing method for attack modes, and relates to the technical field of network security. The attack technique clustering and attributing method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate a triple, and fusing the triple with a network security knowledge graph to obtain TTPs data; clustering TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; and constructing attack trees based on a soft clustering result, carrying out weight distribution based on an attention mechanism, and carrying out matching on the attack trees in the knowledge graph based on a similarity calculation method to obtain an attribution result. According to the method, a complete attack behavior attribution implementation framework is provided, the advantages of the frontier technology are combined, and efficient, accurate, reliable, extensible and high-interpretability attribution can be achieved.

The invention relates to an information security TARA report automatic generation system based on an SQL database, and the system comprises a framework definition unit which is used for defining a TARA report framework; the demand acquisition unit is used for acquiring a TARA analysis demand input by a user; the data query unit is used for querying the SQL database according to the TARA analysis requirement and obtaining a query result; the data analysis unit is used for analyzing the query result to obtain an attack tree diagram; and the processing unit is used for generating a TARA report file according to the defined TARA report framework, acquiring corresponding data from the query result so as to write the data into a corresponding part of the generated TARA report file, and writing the attack tree diagram into the corresponding part of the generated TARA report file, so that automatic generation of the TARA report is completed. The report generation efficiency is greatly improved, the visualization degree of the report is guaranteed, and the report content can be understood conveniently.

An exposure management system and an exposure management method for assessing exposure of assets of an organization, the assets comprising at least one host, such as a computer or a server. The method comprises creating a model of the organization controlling the assets, creating models of plurality of threat actors able to attack the assets of the organization, producing a reduced set of threat actors relevant for the organization based on the relevance of a specific threat actor to the organization in view of the created threat actor models and the created model of the organization. The method further comprises, for each threat actor of the reduced set of threat actors, determining available attack paths for the assets of the organization with an attack path simulator and combining the determined available attack paths for the assets of the organization to attack trees for a specific threat actor.

In one aspect, a distributed security-testing infrastructure is used for attack-tree modeling for penetration testing. An API framework, fully distributed and scalable, is used to access the attack-tree modeling based on attack trees, or decision trees, to emulate attacker behavior and decisions taken during an attack. The API framework allows developers to implement the security tools into existing software to perform actions based on desired conditions as defined by the nodes of the attack tree. For example, APIs can be used along with if / else-type statements to create advanced threat models that react based on given conditions to test multiple paths through the attack tree. Nodes of the attack tree are configured to perform actions based on the output of previous attacks in other nodes. This flexible design allows for the easy modification of the threat modeling system to test new scenarios.

The invention discloses an attack tree generation method and device, and the method comprises the steps: obtaining a data stream which is used for indicating a plurality of devices through which a target service flows in sequence; and generating an attack tree according to the data stream, the attack tree comprising a plurality of device nodes, each of the plurality of device nodes being configured to indicate one of the plurality of devices. In this way, the attack tree of the service (or called service or function) level type can be quickly and automatically generated, and the efficiency of network security risk analysis for the service (or called service or function) can be improved.

The invention provides an automatic attack path analysis and evaluation method and device based on a large language model, and the method comprises the steps: firstly, determining a to-be-analyzed system architecture, determining an attack entrance and an attack exit, constructing a tag tree, and extracting the target information of each tag node in the tag tree; analyzing a potential attack surface and an attack purpose of each tag node in the tag tree by using a large language model; obtaining domain knowledge corresponding to the to-be-analyzed system architecture, and generating an attack tree according to the target information of each label node, the corresponding potential attack surface, the attack purpose and the domain knowledge; and finally, evaluating the feasibility of the attack tree based on a large language model, scoring, and optimizing to obtain a target attack tree. According to the embodiment, the problems of subjectivity, updating difficulty, information abstraction and the like of a traditional threat database-based method are solved, and meanwhile, the method has cross-domain application capability and is suitable for various fields such as intelligent automobiles, intelligent ships, industrial equipment, unmanned aerial vehicles and aerospace.

The invention relates to the technical field of train wireless network communication, in particular to an information security risk assessment method for a train wireless network control system, which comprises the following steps of: establishing an attack tree model according to a risk assessment object, assessing the occurrence possibility of a security event by using a triangular fuzzy number, analyzing attack paths, and calculating the interval probability of each attack path, the method comprises the following steps: obtaining a point probability according to an attack path interval probability, calculating an attack occurrence possibility, evaluating a security event influence by using a fuzzy analytic hierarchy process, calculating a security event risk value by quantifying the occurrence possibility and an influence value of the security event, and determining a risk level and a security level of a system according to a system risk evaluation value. And formulating corresponding protection requirements. According to the method, the information security risk of the train wireless network control system is effectively evaluated and managed, a basis is provided for formulating an effective security protection strategy, and the overall security capability of the train wireless network is improved.

The present application discloses a method, apparatus, electronic device and readable storage medium for constructing an attack tree, which is applied to the field of network security technology. The method for constructing an attack tree includes: obtaining network attack data; selecting a target attack matrix framework corresponding to the network attack data according to the application object type corresponding to the network attack data; determining attack information corresponding to the network attack data according to the target attack matrix framework; and constructing an attack tree for the network attack data according to the attack information. The present application solves the technical problem of relatively high limitations in the use of attack trees.

The invention discloses a vehicle safety assessment method and device based on an AI-assisted attack tree, equipment and a medium, and belongs to the technical field of computers. The method comprises the following steps: automatically generating an attack tree containing a dynamic risk level by adopting a hierarchical agent workflow based on a vehicle type architecture; extracting a threat scene from the attack tree and generating a structured description; matching a historical knowledge base by utilizing a retrieval enhancement generation technology, and generating an asset list and a threat score through a large language model; and synthesizing the attack tree and the scoring result to generate an evaluation conclusion containing security disposal suggestions. According to the technical scheme, the attack tree can be automatically generated based on the vehicle model architecture, intelligent scoring is linked, finally, the safety evaluation conclusion containing specific disposal suggestions is output, and the evaluation efficiency, accuracy and engineering practicability are remarkably improved.

The invention relates to the technical field of risk assessment, and provides a multi-dimensional risk real-time assessment method and system for dynamic confrontation. The method comprises the following steps: accessing a data source to execute data acquisition, and establishing a multi-source dynamic data set; carrying out attack intention and behavior attribution analysis on the multi-source dynamic data set, and outputting an attacker strategy intention graph; modeling an attacker strategy by using a random game based on the strategy intention graph, and configuring a dynamic attack tree; constructing a conditional dependency graph according to the dynamic attack tree path dependency relationship, and mapping the conditional dependency graph into a Bayesian network structure; according to a Bayesian network, a risk propagation model is constructed, a node state is updated, and risk probability mapping is established, so that the technical problem that a traditional static risk assessment method cannot reflect risk evolution in a dynamic confrontation process in real time is solved, and the aim of improving the risk evolution in a dynamic confrontation process is achieved through collection and analysis of a multi-dimensional dynamic data source. And real-time modeling and risk propagation evaluation of attacker behaviors are realized, so that the technical effects of improving the adaptive capability and the real-time response capability of network security protection are achieved.

The present invention causes a computer to execute: a process for acquiring tree configuration information indicating the configuration of an attack tree including information for each of a plurality of first nodes that are root nodes of a plurality of sub-trees and that are associated with information indicating an attack to be established, and a plurality of second nodes that are root nodes of a plurality of sub-trees and that are associated with information indicating an attack to be established; a plurality of second nodes that are hierarchically connected to the plurality of first nodes, respectively, and that correspond to a first condition for establishing an attack; acquiring a degree of damage when an attack is established for each of the plurality of first nodes; the processor acquires a first ease indicating a satisfaction difficulty of a condition for establishing a correspondence relationship with each terminal node among the plurality of second nodes, calculates a second ease indicating an ease of an attack for each of the plurality of first nodes based on the tree structure information and the first ease, and calculates a second ease indicating an ease of the attack for each of the plurality of first nodes based on the degree of damage and the second ease. Priorities for taking countermeasures against the attack are calculated for each of the plurality of first nodes, and the priorities and information indicating the subtrees having the first nodes corresponding to the priorities are output.

The application discloses a kind of multi-round jailbreak defense methods and devices for Text-to-SQL system, it is related to network security technical field, the method includes: based on multi-round Text-to-SQL dataset Construction contains multi-class attack scene's jailbreak attack dataset, constructs and trains the attacker model based on pre-training language model, to generate multi-round natural language question with attack intention, establish multi-round jailbreak attack tree, to structured representation by attack target decomposition Multiple-step attack path, based on attack tree generation with semantic coherence multi-round attack question sequence, the sequence is input target Text-to-SQL system, execute the SQL query of its output, and according to evaluation index quantification attack effectiveness, the present application can systematize gradually progressive jailbreak attack in multi-round dialogue Simulation, realize the automatic testing and evaluation of Text-to-SQL model security, provide basis for system reinforcement and defense strategy formulation.

The invention relates to the technical field of risk assessment, and discloses an information security and function security integrated risk assessment system and method, which can integrate the cross influence between information security and function security and perform comprehensive risk assessment on the system. The system comprises a data acquisition module configured to obtain target data in a plurality of station subsystems, and a risk identification module configured to extract information security risk data by adopting an attack tree threat model, detect system vulnerabilities of the station subsystems according to the target data, obtain functional security risk data, and send the functional security risk data to the station subsystems. The risk assessment module is configured to optimize risk scores, obtain correlation between information security risk data and functional security risk data by adopting an Apriori algorithm, and predict risk changes by adopting an ARIMA model, the risk management module is configured to determine risk measures, and the risk reporting module is configured to generate a risk assessment report. The method has the characteristic of comprehensive and integrated risk assessment.

The invention provides an artificial intelligence-based automobile information security attack tree model establishment method, which comprises the following steps that: at least one item of source data of an automobile is obtained, and the at least one item of source data comprises an electronic control unit log, a vehicle-mounted network data packet, and a communication record or sensor data of the automobile and an external server; extracting and constructing feature data for the automobile information security attack tree model based on the at least one item of source data; constructing the automobile information security attack tree model, and training by using historical attack data to optimize model parameters; and identifying an attack means or an attack form by using the automobile information security attack tree model, and updating nodes of the model or modifying a relationship between the nodes. The invention further discloses an artificial intelligence-based automobile information security attack tree model establishment device and electronic equipment applying the method.

The application provides an attack method clustering and attribution method for attack patterns, and relates to the technical field of network security. The attack method clustering and attribution method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate triplets, fusing the triplets with a network security knowledge graph to obtain TTPs data; clustering the TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; constructing an attack tree based on the soft clustering result, performing weight distribution based on an attention mechanism, and matching the attack tree in the knowledge graph based on a similarity calculation method to obtain an attribution result. The application provides a complete attack behavior attribution implementation framework, combines the advantages of cutting-edge technologies, and can realize efficient, accurate, reliable, scalable and highly interpretable attribution.

The present invention relates to an automatic generation system of information security TARA reports based on SQL database, comprising: a framework definition unit, used to define a TARA report framework; a requirement acquisition unit, used to acquire the TARA analysis requirements input by a user; a data query unit, used to query an SQL database according to the TARA analysis requirements and obtain query results; a data analysis unit, used to analyze the query results to obtain an attack tree dendrogram; a processing unit, used to generate a TARA report file according to the defined TARA report framework, and also used to acquire corresponding data from the query results to write into the corresponding part of the generated TARA report file, and also used to write the attack tree dendrogram into the corresponding part of the generated TARA report file, thereby completing the automatic generation of a TARA report. The present invention greatly improves the efficiency of report generation while ensuring the visualization of the report and facilitating the understanding of the report content.

The present invention discloses a detection device and a detection method for adversarial attacks on deep neural networks, including a detection device body. On one side of the top of the detection device body, a first switch and a second switch are sequentially fixed. At the top inside the detection device body, a first filter plate is movably connected, and a second filter plate is movably connected at the top inside the detection device body, and the second filter plate is located at the bottom of the first filter plate. A fixing block is fixed on one side of the first filter plate, and a fixing column is fixed on one side of the second filter plate. This device can perform dust-proof and moisture-proof work. This detection method for adversarial attacks on deep neural networks can quickly and instantaneously repair the data chain at the attacked location, so as to ensure that the data can be quickly restored. After each attack, the attack samples can be retained, thus forming a growing adversarial attack tree, and further ensuring that each attack can avoid the same type of attack in the next time. Repeating this way can effectively improve the robustness of the neural network classifier.

The present application relates to train wireless network communication technical field, specifically to a kind of train wireless network control system information security risk assessment method, including according to the object of risk assessment to establish attack tree model, the possibility of security event is assessed using triangular fuzzy number and occurs, attack path is analyzed, and the interval probability of each attack path is calculated, point probability is obtained according to attack path interval probability, the possibility of attack is calculated, the influence of security event is evaluated using fuzzy analytic hierarchy process, the possibility of security event and impact value are quantified, security event risk value is calculated, the risk level and security level of system are determined according to system risk assessment value, corresponding protection requirements are formulated.The present application effectively evaluates and manages the information security risk of train wireless network control system, provides basis for formulating effective security protection strategy, and improves the overall security capability of train wireless network.

In one aspect, a distributed security-testing infrastructure is used for attack-tree modeling for penetration testing. An API framework, fully distributed and scalable, is used to access the attack-tree modeling based on attack trees, or decision trees, to emulate attacker behavior and decisions taken during an attack. The API framework allows developers to implement the security tools into existing software to perform actions based on desired conditions as defined by the nodes of the attack tree. For example, APIs can be used along with if / else-type statements to create advanced threat models that react based on given conditions to test multiple paths through the attack tree. Nodes of the attack tree are configured to perform actions based on the output of previous attacks in other nodes. This flexible design allows for the easy modification of the threat modeling system to test new scenarios.

The present disclosure provides an automated attack path analysis and assessment method and device based on a large language model. The method comprises: first, determining the system architecture to be analyzed, and determining the attack entry and attack exit, constructing a label tree, and extracting the target information of each label node in the label tree; using the large language model to analyze the potential attack surface and attack purpose of each label node in the label tree; then obtaining the domain knowledge corresponding to the system architecture to be analyzed, and then generating an attack tree based on the target information of each label node, the corresponding potential attack surface, the attack purpose, and the domain knowledge; finally, evaluating the feasibility of the attack tree and scoring it based on the large language model, and optimizing the target attack tree. This embodiment overcomes the problems of subjectivity, update difficulty, and information abstraction of traditional threat database-based methods, and at the same time has cross-domain application capabilities, and is suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

The application discloses a data security protection method for a photovoltaic power station in a smart grid environment, and relates to the technical field of smart water supply equipment inspection, and comprises the following steps: step one: using an attack tree model and a threat model to identify and evaluate the data security risks of the photovoltaic power station, and evaluating the risk level; at the same time, based on a blockchain technology, a unique digital identity is generated for the photovoltaic power station equipment and its business scene, and access control is implemented. The data security protection method for the photovoltaic power station in the smart grid environment can not only efficiently process a large amount of data, but also ensure the security and integrity of the data in the transmission, storage and processing process, can avoid information leakage or malicious attacks, improve the data security of the photovoltaic power station, and guarantee the safe and stable operation of the power system.

This invention discloses an automated method for constructing vehicle-mounted attack trees based on knowledge graphs and large-scale model agents, relating to the field of vehicle-mounted information security technology. The invention includes the following steps: S1, constructing an ontology model of a vehicle-mounted attack domain knowledge graph, defining two types of entities: threat nodes and threat scenario nodes, causal relationship types, and entity attribute constraints; S2, collecting vehicle-mounted security threat data and constructing a vehicle-mounted attack knowledge graph with a directed acyclic graph structure; S3, acquiring electronic and electrical architecture asset data of the target vehicle system and extracting asset security attributes through an asset identification agent; S4, constructing an attack topology graph from system modeling data, enumerating all reachable attack paths from externally exposed nodes to the target asset. This invention, through the collaboration of large-scale model agents and vehicle-mounted attack knowledge graphs, achieves fully automated construction of vehicle-mounted attack trees, ensuring attack path integrity with quantifiable path coverage metrics, and improving construction efficiency and attack path integrity.

Embodiments of the present disclosure relates to a system (100) and method (300) for enhancing Threat and Risk Assessment (TARA) through the integration of Zero Trust Access Control (ZT-AC) principles. The system (100) utilizes a processor (104) to acquire and analyze system assets, define strict access policies based on Zero Trust, and categorize vulnerabilities by their relevance and impact. The system (100) maps threats to assets, incorporates ZT-AC policies to minimize exposure, and develops AI-powered attack tree models to simulate potential attack scenarios. The system (100) validates adherence to Zero Trust principles, simulates mitigating effects within attack trees, and scores risk based on likelihood, impact, and ZT-AC mitigations. Detailed cybersecurity risk assessments are generated, providing actionable recommendations for refining Zero Trust policies and improving overall security.

The application discloses an AI-assisted attack tree-based vehicle safety evaluation method, device, equipment and medium, and belongs to the technical field of computers. The method comprises the following steps: automatically generating an attack tree containing a dynamic risk level based on a vehicle architecture by adopting a hierarchical intelligent agent workflow; extracting a threat scenario from the attack tree and generating a structured description; matching a historical knowledge base by using a retrieval enhancement generation technology, and generating an asset list and a threat score by a large language model; and generating an evaluation conclusion containing a safety disposal suggestion by comprehensively combining the attack tree and the score result. The technical scheme can automatically generate an attack tree based on a vehicle architecture and link intelligent scoring, finally output a safety evaluation conclusion containing specific disposal suggestions, and significantly improve the evaluation efficiency, accuracy and engineering practicability.

The invention belongs to the technical field of dynamic defense, and particularly relates to a dynamic defense method and system fused with water conservancy network security situation awareness, so as to solve the technical problems that data isomerism is difficult to process, model static state lacks timeliness, threat prediction is incomplete, and defense decisions are not balanced in an existing attitude awareness method. The defense method comprises the following steps: constructing a multi-layer attack tree model of the water conservancy network; obtaining heterogeneous security data collected by monitoring nodes in a network, quantifying the heterogeneous security data into normalized threat values in one-to-one correspondence with leaf nodes in the model based on an asset vulnerability incidence matrix and a situation element fuzzy membership function, and taking the normalized threat values as conditional occurrence probabilities of the leaf nodes; and traversing all attack paths in the multi-layer attack tree model, and executing an operation on any path. According to the defense method, interference to normal operation of the water conservancy core business is reduced, and balance between safety and business is achieved.

The invention discloses a function optimization method based on an improved cuckoo search algorithm, and the method comprises the steps: S1, determining a system boundary: determining which parts belong to a system range and which parts do not belong to the system range, and facilitating the subsequent formulation of a corresponding strategy in the system range; s2, determining the role of an attacker: according to the attack mode, means and angle of the attacker, preliminarily determining the type of the attacker, such as hackers, internal employees and the like; s3, constructing an attack tree: generally, determining a final target of an attacker, dividing the final target into sub-targets and constructing a tree diagram of the attack tree; wherein the final target is a tree root, the sub-target is a branch, and the means for completing the sub-target is a leaf; s4, analyzing an attack tree: identifying heavy vulnerabilities and weaknesses of the system, and formulating a corresponding defense strategy; and S5, actively setting the trapping vulnerabilities: actively setting the trapping vulnerabilities on the final target and the sub-target so as to obtain the information of an attacker or capture the attacker when the attacker attacks the trapping vulnerabilities.

A design support device (1) comprises a test item extraction unit (20) that creates a test item (4) for a security and safety test on the basis of: an attack tree (2) describing, in terms of a tree structure, an event that a security attack provides to functional blocks forming a to-be-designed object; and a fault tree (3) describing, in terms of the tree structure, an event that a safety failure provides to the functional blocks forming the to-be-designed object. The test item extraction unit (20) extracts a security measure and a safety measure having a similarity relationship with each other from the attack tree (2) and the fault tree (3) on the basis of information about the security measure for the event of the leaves of the attack tree (2) and information about the safety measure for the event of the leaves of the fault tree (3), and creates the test item (4), with either one of the security measure and the safety measure having a similarity relationship with each other being excluded.

A non-transitory computer-readable recording medium stores therein a risk calculation program that causes a computer to execute a process including, storing a weight for every attack condition, calculated with reference to a usage rate of each of the attack conditions, and a presence rate of each of a plurality of specification elements contained in a specification of the AI system, regarding the conditions for establishing the attack, the presence rate being defined in specifications of a plurality of existing AI systems, identifying an establishment status of the attack condition, with reference to information regarding the specification element extracted from information regarding the specification of an AI system subject to the risk determination, and calculating a risk score for every attack tree of the AI system subject to the risk determination, with reference to the weight for every attack condition, and the identified establishment status of the attack condition.

The present invention causes a computer to execute processing for: storing a weight for each attack condition, which is an element for establishing a predetermined attack on an AI system, the weight being calculated on the basis of the usage ratio of each attack condition and the existence ratio, in the specifications of a plurality of existing AI systems, of each of a plurality of specification elements which are included in the AI system specifications and are related to a condition for establishing the attack; receiving information on the specifications of an AI system for which a risk is to be determined; for each attack tree created in advance, identifying the attack condition establishment state on the basis of information about the specification elements extracted from the information on the specifications of the AI system for which a risk is to be determined; and on the basis of the weight for each attack condition and the establishment state of the identified attack condition, calculating a risk value for each attack tree of the AI system for which a risk is to be determined.