Evaluating Vulnerabilities of Connected Vehicles Under Cyber Attacks by Attack-Defense Tree

TL;DR

This paper introduces an attack-tree based methodology to systematically evaluate cybersecurity vulnerabilities in connected and autonomous vehicles, considering threats and defenses to improve their resilience.

Contribution

It develops a novel attack-defense tree framework specifically tailored for assessing vulnerabilities in CAVs, incorporating vulnerability measures based on threats and countermeasures.

Findings

Systematic assessment of attack-leaf vulnerabilities

Quantitative vulnerability indices for CAV components

Enhanced understanding of cyber risks in connected vehicles

Abstract

Connected vehicles represent a key enabler of intelligent transportation systems, where vehicles are equipped with advanced communication, sensing, and computing technologies to interact not only with one another but also with surrounding infrastructures and the environment. Through continuous data exchange, such vehicles are capable of enhancing road safety, improving traffic efficiency, and ensuring more reliable mobility services. Further, when these capabilities are integrated with advanced automation technologies, the concept essentially evolves into connected and autonomous vehicles (CAVs). While connected vehicles primarily focus on seamless information sharing, autonomous vehicles are mainly dependent on advanced perception, decision-making, and control mechanisms to operate with minimal or without human intervention. However, as a result of connectivity, an adversary with malicious intentions might be able to compromise successfully by breaching the system components of CAVs. In this paper, we present an attack-tree based methodology for evaluating cyber security vulnerabilities in CAVs. In particular, we utilize the attack-defense tree formulation to systematically assess attack-leaf vulnerabilities, and before analyzing the vulnerability indices, we also define a measure of vulnerabilities, which is based on existing cyber security threats and corresponding defensive countermeasures.