35 results about "Attack tree" patented technology

The invention discloses a data safety protection method for a photovoltaic power station in an intelligent power grid environment, and relates to the technical field of intelligent water supply equipment inspection. The method comprises the following steps of: 1, identifying and evaluating a data security risk of a photovoltaic power station by utilizing an attack tree model and a threat model, and evaluating a risk level; and meanwhile, on the basis of a block chain technology, a unique digital identity label is generated for the photovoltaic power station equipment and a service scene thereof, and access control is implemented. According to the data security protection method for the photovoltaic power station in the intelligent power grid environment, a large amount of data can be efficiently processed, the security and integrity of the data in the transmission, storage and processing processes are ensured, information leakage or hostile attacks can be avoided, the data security of the photovoltaic power station is improved, and safe and stable operation of a power system is ensured.

The invention provides an attack technique clustering and attributing method for attack modes, and relates to the technical field of network security. The attack technique clustering and attributing method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate a triple, and fusing the triple with a network security knowledge graph to obtain TTPs data; clustering TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; and constructing attack trees based on a soft clustering result, carrying out weight distribution based on an attention mechanism, and carrying out matching on the attack trees in the knowledge graph based on a similarity calculation method to obtain an attribution result. According to the method, a complete attack behavior attribution implementation framework is provided, the advantages of the frontier technology are combined, and efficient, accurate, reliable, extensible and high-interpretability attribution can be achieved.

An exposure management system and an exposure management method for assessing exposure of assets of an organization, the assets comprising at least one host, such as a computer or a server. The method comprises creating a model of the organization controlling the assets, creating models of plurality of threat actors able to attack the assets of the organization, producing a reduced set of threat actors relevant for the organization based on the relevance of a specific threat actor to the organization in view of the created threat actor models and the created model of the organization. The method further comprises, for each threat actor of the reduced set of threat actors, determining available attack paths for the assets of the organization with an attack path simulator and combining the determined available attack paths for the assets of the organization to attack trees for a specific threat actor.

In one aspect, a distributed security-testing infrastructure is used for attack-tree modeling for penetration testing. An API framework, fully distributed and scalable, is used to access the attack-tree modeling based on attack trees, or decision trees, to emulate attacker behavior and decisions taken during an attack. The API framework allows developers to implement the security tools into existing software to perform actions based on desired conditions as defined by the nodes of the attack tree. For example, APIs can be used along with if / else-type statements to create advanced threat models that react based on given conditions to test multiple paths through the attack tree. Nodes of the attack tree are configured to perform actions based on the output of previous attacks in other nodes. This flexible design allows for the easy modification of the threat modeling system to test new scenarios.

The invention relates to the technical field of train wireless network communication, in particular to an information security risk assessment method for a train wireless network control system, which comprises the following steps of: establishing an attack tree model according to a risk assessment object, assessing the occurrence possibility of a security event by using a triangular fuzzy number, analyzing attack paths, and calculating the interval probability of each attack path, the method comprises the following steps: obtaining a point probability according to an attack path interval probability, calculating an attack occurrence possibility, evaluating a security event influence by using a fuzzy analytic hierarchy process, calculating a security event risk value by quantifying the occurrence possibility and an influence value of the security event, and determining a risk level and a security level of a system according to a system risk evaluation value. And formulating corresponding protection requirements. According to the method, the information security risk of the train wireless network control system is effectively evaluated and managed, a basis is provided for formulating an effective security protection strategy, and the overall security capability of the train wireless network is improved.

The present application discloses a method, apparatus, electronic device and readable storage medium for constructing an attack tree, which is applied to the field of network security technology. The method for constructing an attack tree includes: obtaining network attack data; selecting a target attack matrix framework corresponding to the network attack data according to the application object type corresponding to the network attack data; determining attack information corresponding to the network attack data according to the target attack matrix framework; and constructing an attack tree for the network attack data according to the attack information. The present application solves the technical problem of relatively high limitations in the use of attack trees.

The invention discloses a vehicle safety assessment method and device based on an AI-assisted attack tree, equipment and a medium, and belongs to the technical field of computers. The method comprises the following steps: automatically generating an attack tree containing a dynamic risk level by adopting a hierarchical agent workflow based on a vehicle type architecture; extracting a threat scene from the attack tree and generating a structured description; matching a historical knowledge base by utilizing a retrieval enhancement generation technology, and generating an asset list and a threat score through a large language model; and synthesizing the attack tree and the scoring result to generate an evaluation conclusion containing security disposal suggestions. According to the technical scheme, the attack tree can be automatically generated based on the vehicle model architecture, intelligent scoring is linked, finally, the safety evaluation conclusion containing specific disposal suggestions is output, and the evaluation efficiency, accuracy and engineering practicability are remarkably improved.

The invention relates to the technical field of risk assessment, and provides a multi-dimensional risk real-time assessment method and system for dynamic confrontation. The method comprises the following steps: accessing a data source to execute data acquisition, and establishing a multi-source dynamic data set; carrying out attack intention and behavior attribution analysis on the multi-source dynamic data set, and outputting an attacker strategy intention graph; modeling an attacker strategy by using a random game based on the strategy intention graph, and configuring a dynamic attack tree; constructing a conditional dependency graph according to the dynamic attack tree path dependency relationship, and mapping the conditional dependency graph into a Bayesian network structure; according to a Bayesian network, a risk propagation model is constructed, a node state is updated, and risk probability mapping is established, so that the technical problem that a traditional static risk assessment method cannot reflect risk evolution in a dynamic confrontation process in real time is solved, and the aim of improving the risk evolution in a dynamic confrontation process is achieved through collection and analysis of a multi-dimensional dynamic data source. And real-time modeling and risk propagation evaluation of attacker behaviors are realized, so that the technical effects of improving the adaptive capability and the real-time response capability of network security protection are achieved.

The present invention causes a computer to execute: a process for acquiring tree configuration information indicating the configuration of an attack tree including information for each of a plurality of first nodes that are root nodes of a plurality of sub-trees and that are associated with information indicating an attack to be established, and a plurality of second nodes that are root nodes of a plurality of sub-trees and that are associated with information indicating an attack to be established; a plurality of second nodes that are hierarchically connected to the plurality of first nodes, respectively, and that correspond to a first condition for establishing an attack; acquiring a degree of damage when an attack is established for each of the plurality of first nodes; the processor acquires a first ease indicating a satisfaction difficulty of a condition for establishing a correspondence relationship with each terminal node among the plurality of second nodes, calculates a second ease indicating an ease of an attack for each of the plurality of first nodes based on the tree structure information and the first ease, and calculates a second ease indicating an ease of the attack for each of the plurality of first nodes based on the degree of damage and the second ease. Priorities for taking countermeasures against the attack are calculated for each of the plurality of first nodes, and the priorities and information indicating the subtrees having the first nodes corresponding to the priorities are output.

The application discloses a kind of multi-round jailbreak defense methods and devices for Text-to-SQL system, it is related to network security technical field, the method includes: based on multi-round Text-to-SQL dataset Construction contains multi-class attack scene's jailbreak attack dataset, constructs and trains the attacker model based on pre-training language model, to generate multi-round natural language question with attack intention, establish multi-round jailbreak attack tree, to structured representation by attack target decomposition Multiple-step attack path, based on attack tree generation with semantic coherence multi-round attack question sequence, the sequence is input target Text-to-SQL system, execute the SQL query of its output, and according to evaluation index quantification attack effectiveness, the present application can systematize gradually progressive jailbreak attack in multi-round dialogue Simulation, realize the automatic testing and evaluation of Text-to-SQL model security, provide basis for system reinforcement and defense strategy formulation.

The invention relates to the technical field of risk assessment, and discloses an information security and function security integrated risk assessment system and method, which can integrate the cross influence between information security and function security and perform comprehensive risk assessment on the system. The system comprises a data acquisition module configured to obtain target data in a plurality of station subsystems, and a risk identification module configured to extract information security risk data by adopting an attack tree threat model, detect system vulnerabilities of the station subsystems according to the target data, obtain functional security risk data, and send the functional security risk data to the station subsystems. The risk assessment module is configured to optimize risk scores, obtain correlation between information security risk data and functional security risk data by adopting an Apriori algorithm, and predict risk changes by adopting an ARIMA model, the risk management module is configured to determine risk measures, and the risk reporting module is configured to generate a risk assessment report. The method has the characteristic of comprehensive and integrated risk assessment.

The invention provides an artificial intelligence-based automobile information security attack tree model establishment method, which comprises the following steps that: at least one item of source data of an automobile is obtained, and the at least one item of source data comprises an electronic control unit log, a vehicle-mounted network data packet, and a communication record or sensor data of the automobile and an external server; extracting and constructing feature data for the automobile information security attack tree model based on the at least one item of source data; constructing the automobile information security attack tree model, and training by using historical attack data to optimize model parameters; and identifying an attack means or an attack form by using the automobile information security attack tree model, and updating nodes of the model or modifying a relationship between the nodes. The invention further discloses an artificial intelligence-based automobile information security attack tree model establishment device and electronic equipment applying the method.

The application provides an attack method clustering and attribution method for attack patterns, and relates to the technical field of network security. The attack method clustering and attribution method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate triplets, fusing the triplets with a network security knowledge graph to obtain TTPs data; clustering the TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; constructing an attack tree based on the soft clustering result, performing weight distribution based on an attention mechanism, and matching the attack tree in the knowledge graph based on a similarity calculation method to obtain an attribution result. The application provides a complete attack behavior attribution implementation framework, combines the advantages of cutting-edge technologies, and can realize efficient, accurate, reliable, scalable and highly interpretable attribution.

The present invention discloses a detection device and a detection method for adversarial attacks on deep neural networks, including a detection device body. On one side of the top of the detection device body, a first switch and a second switch are sequentially fixed. At the top inside the detection device body, a first filter plate is movably connected, and a second filter plate is movably connected at the top inside the detection device body, and the second filter plate is located at the bottom of the first filter plate. A fixing block is fixed on one side of the first filter plate, and a fixing column is fixed on one side of the second filter plate. This device can perform dust-proof and moisture-proof work. This detection method for adversarial attacks on deep neural networks can quickly and instantaneously repair the data chain at the attacked location, so as to ensure that the data can be quickly restored. After each attack, the attack samples can be retained, thus forming a growing adversarial attack tree, and further ensuring that each attack can avoid the same type of attack in the next time. Repeating this way can effectively improve the robustness of the neural network classifier.

The present application relates to train wireless network communication technical field, specifically to a kind of train wireless network control system information security risk assessment method, including according to the object of risk assessment to establish attack tree model, the possibility of security event is assessed using triangular fuzzy number and occurs, attack path is analyzed, and the interval probability of each attack path is calculated, point probability is obtained according to attack path interval probability, the possibility of attack is calculated, the influence of security event is evaluated using fuzzy analytic hierarchy process, the possibility of security event and impact value are quantified, security event risk value is calculated, the risk level and security level of system are determined according to system risk assessment value, corresponding protection requirements are formulated.The present application effectively evaluates and manages the information security risk of train wireless network control system, provides basis for formulating effective security protection strategy, and improves the overall security capability of train wireless network.

In one aspect, a distributed security-testing infrastructure is used for attack-tree modeling for penetration testing. An API framework, fully distributed and scalable, is used to access the attack-tree modeling based on attack trees, or decision trees, to emulate attacker behavior and decisions taken during an attack. The API framework allows developers to implement the security tools into existing software to perform actions based on desired conditions as defined by the nodes of the attack tree. For example, APIs can be used along with if / else-type statements to create advanced threat models that react based on given conditions to test multiple paths through the attack tree. Nodes of the attack tree are configured to perform actions based on the output of previous attacks in other nodes. This flexible design allows for the easy modification of the threat modeling system to test new scenarios.

The present disclosure provides an automated attack path analysis and assessment method and device based on a large language model. The method comprises: first, determining the system architecture to be analyzed, and determining the attack entry and attack exit, constructing a label tree, and extracting the target information of each label node in the label tree; using the large language model to analyze the potential attack surface and attack purpose of each label node in the label tree; then obtaining the domain knowledge corresponding to the system architecture to be analyzed, and then generating an attack tree based on the target information of each label node, the corresponding potential attack surface, the attack purpose, and the domain knowledge; finally, evaluating the feasibility of the attack tree and scoring it based on the large language model, and optimizing the target attack tree. This embodiment overcomes the problems of subjectivity, update difficulty, and information abstraction of traditional threat database-based methods, and at the same time has cross-domain application capabilities, and is suitable for a variety of fields such as smart cars, smart ships, industrial equipment, drones, aerospace, etc.

The application discloses a data security protection method for a photovoltaic power station in a smart grid environment, and relates to the technical field of smart water supply equipment inspection, and comprises the following steps: step one: using an attack tree model and a threat model to identify and evaluate the data security risks of the photovoltaic power station, and evaluating the risk level; at the same time, based on a blockchain technology, a unique digital identity is generated for the photovoltaic power station equipment and its business scene, and access control is implemented. The data security protection method for the photovoltaic power station in the smart grid environment can not only efficiently process a large amount of data, but also ensure the security and integrity of the data in the transmission, storage and processing process, can avoid information leakage or malicious attacks, improve the data security of the photovoltaic power station, and guarantee the safe and stable operation of the power system.

This invention discloses an automated method for constructing vehicle-mounted attack trees based on knowledge graphs and large-scale model agents, relating to the field of vehicle-mounted information security technology. The invention includes the following steps: S1, constructing an ontology model of a vehicle-mounted attack domain knowledge graph, defining two types of entities: threat nodes and threat scenario nodes, causal relationship types, and entity attribute constraints; S2, collecting vehicle-mounted security threat data and constructing a vehicle-mounted attack knowledge graph with a directed acyclic graph structure; S3, acquiring electronic and electrical architecture asset data of the target vehicle system and extracting asset security attributes through an asset identification agent; S4, constructing an attack topology graph from system modeling data, enumerating all reachable attack paths from externally exposed nodes to the target asset. This invention, through the collaboration of large-scale model agents and vehicle-mounted attack knowledge graphs, achieves fully automated construction of vehicle-mounted attack trees, ensuring attack path integrity with quantifiable path coverage metrics, and improving construction efficiency and attack path integrity.

Embodiments of the present disclosure relates to a system (100) and method (300) for enhancing Threat and Risk Assessment (TARA) through the integration of Zero Trust Access Control (ZT-AC) principles. The system (100) utilizes a processor (104) to acquire and analyze system assets, define strict access policies based on Zero Trust, and categorize vulnerabilities by their relevance and impact. The system (100) maps threats to assets, incorporates ZT-AC policies to minimize exposure, and develops AI-powered attack tree models to simulate potential attack scenarios. The system (100) validates adherence to Zero Trust principles, simulates mitigating effects within attack trees, and scores risk based on likelihood, impact, and ZT-AC mitigations. Detailed cybersecurity risk assessments are generated, providing actionable recommendations for refining Zero Trust policies and improving overall security.

The application discloses an AI-assisted attack tree-based vehicle safety evaluation method, device, equipment and medium, and belongs to the technical field of computers. The method comprises the following steps: automatically generating an attack tree containing a dynamic risk level based on a vehicle architecture by adopting a hierarchical intelligent agent workflow; extracting a threat scenario from the attack tree and generating a structured description; matching a historical knowledge base by using a retrieval enhancement generation technology, and generating an asset list and a threat score by a large language model; and generating an evaluation conclusion containing a safety disposal suggestion by comprehensively combining the attack tree and the score result. The technical scheme can automatically generate an attack tree based on a vehicle architecture and link intelligent scoring, finally output a safety evaluation conclusion containing specific disposal suggestions, and significantly improve the evaluation efficiency, accuracy and engineering practicability.

The invention belongs to the technical field of dynamic defense, and particularly relates to a dynamic defense method and system fused with water conservancy network security situation awareness, so as to solve the technical problems that data isomerism is difficult to process, model static state lacks timeliness, threat prediction is incomplete, and defense decisions are not balanced in an existing attitude awareness method. The defense method comprises the following steps: constructing a multi-layer attack tree model of the water conservancy network; obtaining heterogeneous security data collected by monitoring nodes in a network, quantifying the heterogeneous security data into normalized threat values in one-to-one correspondence with leaf nodes in the model based on an asset vulnerability incidence matrix and a situation element fuzzy membership function, and taking the normalized threat values as conditional occurrence probabilities of the leaf nodes; and traversing all attack paths in the multi-layer attack tree model, and executing an operation on any path. According to the defense method, interference to normal operation of the water conservancy core business is reduced, and balance between safety and business is achieved.

The invention discloses a function optimization method based on an improved cuckoo search algorithm, and the method comprises the steps: S1, determining a system boundary: determining which parts belong to a system range and which parts do not belong to the system range, and facilitating the subsequent formulation of a corresponding strategy in the system range; s2, determining the role of an attacker: according to the attack mode, means and angle of the attacker, preliminarily determining the type of the attacker, such as hackers, internal employees and the like; s3, constructing an attack tree: generally, determining a final target of an attacker, dividing the final target into sub-targets and constructing a tree diagram of the attack tree; wherein the final target is a tree root, the sub-target is a branch, and the means for completing the sub-target is a leaf; s4, analyzing an attack tree: identifying heavy vulnerabilities and weaknesses of the system, and formulating a corresponding defense strategy; and S5, actively setting the trapping vulnerabilities: actively setting the trapping vulnerabilities on the final target and the sub-target so as to obtain the information of an attacker or capture the attacker when the attacker attacks the trapping vulnerabilities.

A design support device (1) comprises a test item extraction unit (20) that creates a test item (4) for a security and safety test on the basis of: an attack tree (2) describing, in terms of a tree structure, an event that a security attack provides to functional blocks forming a to-be-designed object; and a fault tree (3) describing, in terms of the tree structure, an event that a safety failure provides to the functional blocks forming the to-be-designed object. The test item extraction unit (20) extracts a security measure and a safety measure having a similarity relationship with each other from the attack tree (2) and the fault tree (3) on the basis of information about the security measure for the event of the leaves of the attack tree (2) and information about the safety measure for the event of the leaves of the fault tree (3), and creates the test item (4), with either one of the security measure and the safety measure having a similarity relationship with each other being excluded.

A non-transitory computer-readable recording medium stores therein a risk calculation program that causes a computer to execute a process including, storing a weight for every attack condition, calculated with reference to a usage rate of each of the attack conditions, and a presence rate of each of a plurality of specification elements contained in a specification of the AI system, regarding the conditions for establishing the attack, the presence rate being defined in specifications of a plurality of existing AI systems, identifying an establishment status of the attack condition, with reference to information regarding the specification element extracted from information regarding the specification of an AI system subject to the risk determination, and calculating a risk score for every attack tree of the AI system subject to the risk determination, with reference to the weight for every attack condition, and the identified establishment status of the attack condition.

This invention discloses a large-scale model-based TARA risk quantification modeling method, relating to the field of vehicle-mounted information security technology. The invention includes the following steps: Step a: Using a system modeling agent, the vehicle system architecture document is parsed to extract components, communication channels, and data flows, establishing a structured asset model; Step b: Using an asset identification agent, the seven-dimensional security attributes of each asset are identified, completing standardized annotation of asset security attributes; Step c: Using a damage scenario agent, standardized damage scenarios are generated based on a damage knowledge graph, and a four-dimensional impact assessment is performed; Step d: Using a threat analysis agent, threat scenarios are generated based on damage scenarios and a threat knowledge graph, an attack tree is constructed, and compliance mapping is performed. This invention achieves fully automated risk quantification of the TARA process through multi-agent phased collaboration and scenario reasoning enhanced by dual knowledge graphs, eliminating human subjective bias and improving the consistency and completeness of assessment results.

The application discloses a kind of multi-round jailbreak attack evaluation method and device for Text-to-SQL system, it is related to network security technical field, the method includes: based on multi-round Text-to-SQL dataset Construction contains multi-class attack scene's jailbreak attack dataset, constructs and trains the attacker model based on pre-training language model, to generate multi-round natural language question with attack intention, establish multi-round jailbreak attack tree, to structured representation by attack target decomposition Multiple-step attack path, based on attack tree generation with semantic coherence multi-round attack question sequence, the sequence is input target Text-to-SQL system, execute the SQL query of its output, and according to evaluation index quantification attack effectiveness, the present application can systematize gradually progressive jailbreak attack in multi-round dialogue, realize the automatic testing and evaluation of Text-to-SQL model security, provide basis for system reinforcement and defense strategy formulation.

The present invention discloses a deep reinforcement learning-based attack tree honeypot deployment defense method and device. The method comprises the following steps: obtaining network topology information and sequentially constructing an attack tree; combining a convolutional neural network with a Q-Learning algorithm to create a DQN model; training an intelligent agent based on the DQN model, wherein the intelligent agent serves as a penetration attack party and the training goal is to generate a current optimal penetration attack path; according to the current optimal penetration attack path, all nodes traversed by the current optimal attack path are regarded as nodes that may be attacked, and vulnerable nodes are determined by monitoring the traffic changes of each potentially attacked node; calculating the difficulty of the attack vulnerability corresponding to each vulnerable node; obtaining a node with the highest attack probability based on the traffic changes of the vulnerable node and the difficulty of the attack vulnerability, and deploying a honeypot at the node; and continuously updating the deployment of the honeypot to lure attackers into the deployed honeypot, thereby completing the defense.

The embodiment of the invention provides a risk assessment method, system and device for in-vehicle wireless communication and a medium, and belongs to the technical field of vehicle safety. The method comprises the following steps: acquiring functional module information of a vehicle; according to the function module information, each function module configured by the vehicle is divided into a first type of modules and a second type of modules, damage scenes of the first type of modules and the second type of modules are determined according to the first preset dimension, the first type of modules apply the star flash communication technology, and the second type of modules do not apply the star flash communication technology; constructing a forward attack tree and a reverse attack tree based on the damage scene, and aggregating the forward attack tree and the reverse attack tree according to the first type of modules and the second type of modules to obtain a target attack tree; and calculating a feasibility score for the target attack tree according to a second preset dimension, and determining a risk assessment result of the vehicle according to the feasibility score and the damage scene. The embodiment of the invention aims to improve the wireless communication security of the vehicle.

The invention relates to the technical field of data security management, in particular to a data security management method for online detection. The method comprises the following steps: performing network data online detection on a user network interaction process to obtain a user network interaction online detection data set; performing user interaction event inference analysis and attacked path identification analysis on the user network interaction process based on the user network interaction online detection data set, and performing causal relationship mining analysis and potential attack tree construction at the same time to generate a user network interaction potential security attacked tree; and performing security threat assessment calculation and security threat level division on the user network interaction potential security attacked tree, performing dynamic security management analysis, and generating a dynamic management scheme of the user network potential security threat level so as to execute data security management response work corresponding to the potential security threat level. According to the invention, dynamic monitoring management of network data security can be realized.