Abstract:The rapid development of intelligent connected vehicles has increased the attack surface of vehicles and made the complexity of vehicle systems unprecedented. Original equipment manufacturers (OEMs) need to accurately represent and identify threats and match corresponding security requirements. Meanwhile, the fast iteration cycle of modern vehicles requires development engineers to quickly obtain cybersecurity requirements for new features in their developed systems in order to develop system code that meets cybersecurity requirements. However, existing threat identification and cybersecurity requirement methods in the automotive domain cannot accurately describe and identify threats for a new feature while also quickly matching appropriate cybersecurity requirements. This article proposes a cybersecurity requirements management system (CRMS) framework to assist OEM security experts in conducting comprehensive automated threat analysis and risk assessment and to help development engineers identify security requirements prior to software development. The proposed CRMS framework enables development engineers to quickly model their systems using the UML-based (i.e., capable of describing systems using UML) Eclipse Modeling Framework and security experts to integrate their security experience into a threat library and security requirement library expressed in Alloy formal language. In order to ensure accurate matching between the two, a middleware communication framework called the component channel messaging and interface (CCMI) framework, specifically designed for the automotive domain, is proposed. The CCMI communication framework enables the fast model of development engineers to match with the formal model of security experts for threat and security requirement matching, achieving accurate and automated threat and risk identification and security requirement matching. To validate our work, we conducted experiments on the proposed framework and compared the results with the HEAVENS approach. The results showed that the proposed framework is superior in terms of threat detection rates and coverage rates of security requirements. Moreover, it also saves analysis time for large and complex systems, and the cost-saving effect becomes more pronounced with increasing system complexity.

ODFa${}^{2}$: Overall Defense Framework Against Cyber-Attacks on Intelligent Connected Vehicles

Towards Automatically Reverse Engineering Vehicle Diagnostic Protocols

A Framework for Cybersecurity Requirements Management in the Automotive Domain

Cybersecurity Framework for Connected and Automated Vehicles: A Modeling Perspective

On the Criteria for Cybersecurity and Risk Assessment Based on ISO/SAE 21434 for the Application of Autonomous Vehicle

Autonomous Driving Security: State of the Art and Challenges

Cybersecurity Testing for Automotive Domain: A Survey

Revisiting Automotive Attack Surfaces: a Practitioners’ Perspective

A novel framework for detection and prevention of denial of service attacks on autonomous vehicles using fuzzy logic

A Security Evaluation Framework for Intelligent Connected Vehicles Based on Attack Chains

Modelling cybersecurity regulations for automated vehicles

A novel and efficient framework for in-vehicle security enforcement

A Survey on Cyber-Security of Connected and Autonomous Vehicles (CAVs)

An Overview of Attacks and Defences on Intelligent Connected Vehicles

Automotive Cybersecurity: A Survey on Frameworks, Standards, and Testing and Monitoring Technologies

Complying with ISO 26262 and ISO/SAE 21434: A Safety and Security Co-Analysis Method for Intelligent Connected Vehicle

Self-Aware Cybersecurity Architecture for Autonomous Vehicles: Security through System-Level Accountability

SOTIF Risk Mitigation Based on Unified ODD Monitoring for Autonomous Vehicles

Cybersecurity Threat Analysis, Risk Assessment and Design Patterns for Automotive Networked Embedded Systems: A Case Study

Non-Intrusive Security Assessment Methods for Future Autonomous Transportation IoV

Combining Cyber Security Intelligence to Refine Automotive Cyber Threats