AI安全团队终于有了一个从理论到工具都落地的威胁建模框架——STRIDE-AI把NIST和OWASP的鸿沟填上了，做LLM应用安全评估的可以直接用它的Web工具跑一遍评估流程。
传统网络安全方法无法应对AI系统的概率性本质，导致模型反转、数据投毒和提示注入等攻击向量频发。STRIDE-AI框架填补了高层风险标准（如NIST AI RMF）与技术漏洞分类（如OWASP LLM Top 10）之间的空白。该框架定义了六阶段评估生命周期，并基于经典STRIDE模型进行了AI系统适配。通过一个部署的LLM聊天机器人的黑盒评估案例，攻击成功率从80%降至15%。该框架还提供了一个专用Web工具，便于安全团队直接使用。
STRIDE-AI: A Threat Modeling Framework for Generative AI Security Assessment
Traditional cybersecurity methodologies target deterministic systems and fail to address the probabilistic nature of AI, leaving systems vulnerable to attack vectors such as model inversion, data poisoning, and prompt injection. Recent industry reports indicate that a majority of organizations deploying AI lack a dedicated security strategy, with adversarial attacks increasing rapidly year-over-year. We present \textit{STRIDE-AI}, a framework that bridges the gap between high-level risk standards (NIST AI RMF) and technical vulnerability taxonomies (OWASP LLM Top 10). The framework defines a six-phase assessment lifecycle, introduces a threat modeling adaptation of classical STRIDE for AI systems, and is operationalized through a purpose-built web tool. We provide an initial validation of the approach through a black-box assessment of a deployed LLM chatbot, which successfully reduced the attack success rate from 80\% to 15\% in our sandbox case study.