ATM: Automated Threat Modelling for Enterprise AI-enabled Assets

在当今的人工智能和数字时代，大多数公司都在使用、部署或正在使用包含机器学习/深度学习模型的人工智能资产。在这种情况下，人工智能帮助企业进行决策。然而，支持ai的资产制造商主要专注于设计、培训和部署基于ai的解决方案，而不考虑安全需求。因此，近年来基于人工智能的攻击变得越来越普遍。这些攻击可能会以人类无法察觉的方式操纵人工智能资产的决策。最常见的AI/ML建模攻击，数据中毒和迁移学习攻击。尽管自主ai辅助威胁建模不仅可以促进设计全面准确的威胁模型，还可以帮助做出适当的响应。据我们所知，目前还没有自主的人工智能威胁建模解决方案来深入分析针对人工智能资产的威胁。此外，现有的脆弱性评估方法并不能保证客户数据的保密性。在这方面，我们建议开发一个人工智能辅助的自动威胁建模（ATM）系统，该系统将通过生成威胁模型、提供对策并对其进行优先排序以减轻发现的威胁，从而帮助检测与人工智能启用的资产相关的所有威胁。

In today's AI and Digital era, most companies work with, deploy, or are using AI assets incorporating machine learning/deep learning models. In this context, AI assists enterprises in their decision-making process. However, AI-enabled asset manufacturers mainly focus on designing, training and deploying AI-based solutions without considering security requirements. As a result, AI-based attacks have become common over recent years. These attacks can potentially manipulate the decision-making of AI-enabled assets in a way that would be imperceptible to humans. The most common attacks on AI/ML Modelling, Data Poisoning and Transfer Learning Attacks.Although autonomous AI-assisted threat modelling can facilitate not only the design of a comprehensive and accurate threat model but also assist with making an appropriate response. To the best of our knowledge, there is no autonomous AI-enabled threat-modelling solution to analyse threats against AI-enabled assets in great depth. Moreover, existing vulnerability assessment approaches do not ensure the confidentiality of clients' data.In this regard, we propose to develop an AI-assisted Automated Threat Modelling(ATM) System that will help detect all the threats related to the AI-enabled asset by generating a Threat Model, providing countermeasures, and prioritising them to mitigate discovered threats.