The invention provides an automatic
attack path analysis and evaluation method and device based on a large
language model, and the method comprises the steps: firstly, determining a to-be-analyzed
system architecture, determining an
attack entrance and an
attack exit, constructing a tag tree, and extracting the target information of each tag node in the tag tree; analyzing a potential
attack surface and an attack purpose of each tag node in the tag tree by using a large
language model; obtaining
domain knowledge corresponding to the to-be-analyzed
system architecture, and generating an
attack tree according to the target information of each
label node, the corresponding potential
attack surface, the attack purpose and the
domain knowledge; and finally, evaluating the feasibility of the
attack tree based on a large
language model, scoring, and optimizing to obtain a target
attack tree. According to the embodiment, the problems of subjectivity, updating difficulty, information abstraction and the like of a traditional
threat database-based method are solved, and meanwhile, the method has cross-domain application capability and is suitable for various fields such as intelligent automobiles, intelligent ships,
industrial equipment, unmanned aerial vehicles and
aerospace.