AI-driven Threat Modeling-as-a-Code (TaaC-AI)
TaaC-AI is an open-source tool developed by yevh that automates threat modeling using AI. It integrates with multiple large language models (LLMs) to analyze service descriptions, identify potential security threats, and generate actionable remediation suggestions based on established frameworks like STRIDE and OWASP guidelines.
The project was initiated in 2023 under the MIT License, making it freely accessible for testing, red teaming, and robustness assessments in software development pipelines.
How It Works
TaaC-AI operates through a structured workflow that begins with the ingestion of a YAML file containing detailed service descriptions. This file is validated before the AI-driven analysis phase, where the tool leverages LLMs to identify security threats. The process includes cross-validation of results using multiple models to enhance accuracy.
- YAML File Processing: The tool loads and validates a YAML file that outlines service details, including functionality, data processing specifics, components, pipeline configurations, and network information. This structured input serves as the foundation for threat analysis.
- AI Threat Analysis: If an API key for OpenAI, Anthropic, or Ollama (for Mistral) is provided, TaaC-AI uses the specified LLM to generate a comprehensive threat model. The analysis adheres to the STRIDE framework (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and OWASP guidelines to ensure alignment with industry best practices.
- AI Threat Cross-Validation: The tool supports cross-validation by running threat assessments through multiple LLMs, such as GPT-3.5, GPT-4, Claude 3 Haiku, or Mistral 7b.
- This includes mapping interactions between components, encryption status, authentication mechanisms, and communication protocols, providing a clear overview of potential attack surfaces.
- This feature ensures that human expertise complements automated findings, addressing false positives or context-specific threats that AI might overlook.
- Report Generation: The tool produces a detailed HTML report that consolidates AI-generated threats, manually added risks, and their respective remediation suggestions. The report is designed for easy review and includes a status tracking system for identified vulnerabilities.
The supported models for threat analysis include GPT-3.5, GPT-4, Claude 3 Haiku, and Mistral 7b (via Ollama). Integration with Gemini is planned for future updates.
Use Cases
TaaC-AI is primarily targeted at security professionals, developers, and red teams engaged in robustness and stress testing of software systems.
- Automated Threat Modeling: Accelerates the identification of security threats in service architectures by reducing manual effort.
- Compliance and Auditing: Generates structured reports that align with frameworks like STRIDE and OWASP, facilitating compliance audits and internal security reviews. The inclusion of manual risk assessment features ensures that regulatory requirements are met with human oversight.
- Red Teaming and Penetration Testing: Provides a foundation for red team exercises by highlighting potential vulnerabilities in data flows and service interactions. The visual data flow diagrams help teams prioritize testing efforts based on criticality and attack surface exposure.
- The combination of automated analysis and manual review allows learners to understand both the technical and analytical aspects of security assessments.
Key Features & Capabilities
TaaC-AI distinguishes itself through several technical features that enhance its utility in security assessments:
- Multi-Model Support: Compatibility with GPT-3.5, GPT-4, Claude 3 Haiku, and Mistral 7b ensures that users can choose models based on availability, cost, or performance requirements. Cross-validation between models improves the accuracy of threat detection.
- STRIDE and OWASP Alignment: The tool’s threat identification process is grounded in widely recognized security frameworks, ensuring that outputs are both actionable and aligned with industry standards.
- Manual Risk Customization: Users can edit the generated report by adding, modifying, or resolving risks. This feature is critical for addressing context-specific threats or false positives that automated tools might miss.
- HTML Report Generation: The final output is a comprehensive HTML report that includes AI-generated threats, manual additions, and remediation suggestions.
- API Key Configuration: TaaC-AI supports environment variable-based configuration for OpenAI and Anthropic API keys, as well as local deployment of Mistral via Ollama.
To use TaaC-AI, users must first install dependencies via pip and configure API keys for their chosen LLM. For Mistral, users need to install Ollama and pull the Mistral model before running the script. The tool provides command-line options to specify the model and enable cross-validation, as demonstrated below:
export OPENAIKEY=sk-ApiKeyExample
set OPENAIKEY=sk-ApiKeyExample
- Installing Mistral via Ollama
- Download and install Ollama from ollama.ai.
- Pull the Mistral model using the command:
- Start the Ollama service with:
Users can execute the script with default settings (GPT-3.5) or specify a model and enable cross-validation:
python3 TaaC-AI.py --model gpt-4
python3 TaaC-AI.py --model claude --cross-validation mistral
An example YAML service description for an authentication service is provided to guide users in structuring their input files. This includes details such as service functionality, data processing specifics, components, pipeline configurations, and data flow interactions. The generated HTML report can then be reviewed, edited, and downloaded for further action.
Example Workflow
- Create a Service Description: Users draft a YAML file detailing the service architecture, such as an authentication service handling user logins and token generation. The file must include sections for service functionality, data processing, components, pipeline configurations, and data flows.
- Execute the Script: The script is run with the specified model and cross-validation options. For instance, using GPT-4 for analysis and Mistral for validation would involve the command:
python3 TaaC-AI.py --model gpt-4 --cross-validation mistral
- Review the HTML Report: The generated report is opened and reviewed. Users can assess AI-identified threats, mark resolved issues, or add manual risks.
- Download the Report: The finalized report, incorporating both automated and manual inputs, is downloaded for documentation or further review.
This workflow ensures that threat modeling is both efficient and comprehensive, combining the strengths of AI with human expertise.