STRIDE GPT is an AI-powered threat modelling tool that leverages OpenAI's GPT models to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the application is internet-facing or processes sensitive data. The GPT model then generates its output based on the provided information.

Table of Contents

• Star the Repo
• Features
• Talk at Open Security Summit
• Changelog
• Installation
• Usage
• Contributing
• License

Star the Repo

If you find STRIDE GPT useful, please consider starring the repository on GitHub. This helps more people discover the tool. Your support is greatly appreciated! ⭐

Features

• Simple and user-friendly interface
• Generates threat models based on the STRIDE methodology
• Generates attack trees to enumerate possible attack paths
• Suggests possible mitigations for identified threats
• Utilises OpenAI's powerful GPT models for AI-driven threat analysis
• No data storage; application details are not saved
• Supports both OpenAI API and Azure OpenAI Service
• Available as a Docker container image for easy deployment

Talk at Open Security Summit

I recently gave a talk about STRIDE GPT at the Open Security Summit. During the talk, I discussed the project's inception, its core functionalities, recent updates, and some future plans. You can watch the full presentation below:

This video is an excellent resource for anyone interested in understanding how STRIDE GPT works and how it can be used to improve threat modelling.

Changelog

Version 0.5

Version 0.5 brings some enhancements that significantly extend STRIDE GPT's utility and ease of use for businesses, especially those using Azure. Here's what's new:

• Azure OpenAI Service Integration: Users can now opt to use OpenAI 1106-preview models hosted on the Azure OpenAI Service, in addition to the standard OpenAI API. This integration provides businesses with a seamless and secure way to incorporate STRIDE GPT into their existing Azure ecosystems, benefitting from established commercial and confidentiality agreements. This is especially valuable for those wanting to include sensitive data in their threat models since, when STRIDE GPT is also run from Azure, it ensures that application descriptions and other data do not leave the Azure environment.

• Docker Container Image: To make it easier to deploy STRIDE GPT on public and private clouds, the tool is now available as a Docker container image on Docker Hub. This is particularly beneficial for businesses and other users seeking a quick and secure way to run STRIDE GPT on their existing infrastructure.

These updates are designed to enhance STRIDE GPT's adaptability and user-friendliness, particularly for users that don't want to utilise the OpenAI API directly. I hope you find the new features valuable and look forward to hearing your feedback on them.

Version 0.4

Release highlights:

• Integration of New GPT Models: The application now supports the latest "gpt-4-1106-preview" and "gpt-3.5-turbo-1106" models, offering advanced capabilities and more accurate responses for threat modelling and attack tree generation.
• Direct OpenAI API Calls: STRIDE GPT now makes direct calls to the OpenAI API in order to take advantage of the recently introduced JSON Mode. This should greatly reduce the reduce the likelihood of syntax errors when generating threat models.
• Refined Attack Tree Generation: The process for generating attack trees has been overhauled to be more reliable, minimising syntax errors when generating Mermaid diagrams and improving the overall quality of the visualisations.
• New Logo and Color Scheme: A refreshed colour scheme and new logo (generated by DALL·E 3).
• Continued Bug Fixes and Performance Improvements: I've made a small number of additional updates to address existing bugs and optimise the application for better performance, ensuring a smoother and more efficient user experience.

Version 0.3

Release highlights:

• Threat Mitigations: STRIDE GPT can now suggest potential mitigations for the threats identified in the threat modelling phase. This helps users develop strategies to prevent or minimise the impact of the identified threats.
• Downloadable Output: Users can now download the generated threat model, attack tree, and mitigations as Markdown files directly from the application. This makes it easy to share and document the generated outputs.
• Improved User Interface: I've further refined the user interface to provide a smoother and more intuitive user experience. The application layout has been optimised for better readability and usability.
• Updated GPT Models: STRIDE GPT now supports the latest 0613 versions of the GPT-3.5-turbo and GPT-4 models. These updated models provide improved performance and increased control over the generated output.
• Bug Fixes and Performance Enhancements: I've addressed several bugs and made performance improvements to ensure a more stable and responsive application.

Click to view release notes for earlier versions.

Version 0.2

Release highlights:

• Attack Tree Generation: In addition to generating threat models, STRIDE GPT can now generate attack trees for your applications based on the provided details. This helps users better understand potential attack paths for their applications.
• Attack Tree Visualisation: This is an experimental feature that allows users to visualise the generated attack tree directly in the app using Mermaid.js. This provides a more interactive experience within the STRIDE GPT interface.
• GPT-4 Model Support: STRIDE GPT now supports the use of OpenAI's GPT-4 model, provided the user has access to the GPT-4 API. This allows users to leverage the latest advancements in GPT technology to generate more accurate and comprehensive threat models and attack trees.
• Improved Layout and Organisation: I've restructured the app layout to make it easier to navigate and use. Key sections, such as Threat Model and Attack Tree, are now organised into collapsible sections for a cleaner and more intuitive user experience.

Version 0.1

Initial release of the application.

Installation

Option 1: Cloning the Repository

1. Clone this repository:

   git clone https://github.com/mrwadams/stride-gpt.git

2. Change to the cloned repository directory:

   cd stride-gpt

3. Install the required Python packages:

   pip install -r requirements.txt

Option 2: Using Docker Container

1. Pull the Docker image from Docker Hub:

   docker pull mrwadams/stridegpt:latest

Usage

Option 1: Running the Streamlit App Locally

1. Run the Streamlit app:

   streamlit run main.py

2. Open the app in your web browser using the provided URL.

3. Follow the steps in the Streamlit interface to use STRIDE GPT.

Option 2: Using Docker Container

1. Run the Docker container:

   docker run -p 8501:8501 mrwadams/stridegpt

   This command will start the container and map port 8501 (default for Streamlit apps) from the container to your host machine.

2. Open a web browser and navigate to http://localhost:8501 to access the app running inside the container.

3. Follow the steps in the Streamlit interface to use STRIDE GPT.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

License

MIT