Threat analyses using vulnerability databases —Possibility of utilizing past analysis results—

Abstract

We propose a threat analysis method utilizing topic model analysis and vulnerability databases. The method is based on attack tree analysis. We create an attack tree on an evaluation target system and some attack trees of known vulnerability. And we combine the two types of attack trees to create more concrete attack trees, that is, attack trees of target system that contain vulnerabilities. Specifically, matching processing of attack trees nodes written in natural language was automated using latent Dirichlet allocation and cosine similarity. The concrete attack tree enables us to calculate the probability of occurrence of a safety accident. In this paper, we show that our proposed method can use the results of past threat analysis for the next one using the case of Tesla model S, Jeep Cherokee and IRB140 industrial robot.