PIER: cyber-resilient risk assessment model for connected and autonomous vehicles

Abstract

As more vehicles are being connected to the Internet and equipped with autonomous driving features, more robust safety and security measures are required for connected and autonomous vehicles (CAVs). Therefore, threat analysis and risk assessment are essential to prepare against cybersecurity risks for CAVs. Although prior studies have measured the possibility of attack and damage from attack as risk assessment indices, they have not analyzed the expanding attack surface or risk assessment indices that rely upon real-time resilience. This study proposes the PIER method to evaluate the cybersecurity risks of CAVs. We implemented cyber resilience for CAVs by presenting new criteria, such as exposure and recovery, in addition to probability and impact, as indices for the threat analysis and risk assessment of vehicles. To verify its effectiveness, the PIER method was evaluated with respect to software update over-the-air and collision avoidance features. Furthermore, we found that implementing security requirements that mitigate serious risks successfully diminishes the risk indices. Using the risk assessment matrix, the PIER method can shorten the risk determination time through high-risk coverage and a simple process.

Internet of Medical Things Security Frameworks for Risk Assessment and Management: A Scoping Review

“…In addition, the framework 16 defines parameters for determining the impact value and the threat probability, as well as the weights for each of their levels. In this case, the PIER model proposed for connected and autonomous vehicles 68 could be an inspiration for risk-level assessment. The model works with a combination of probability (P) and impact (I) but complements the assessment with the categories exposure (E) and recovery (R).…”

An Integrated Approach of Threat Analysis for Autonomous Vehicles Perception System

“…In order to accurately determine the risk level, a comprehensive risk assessment must be conducted by taking into account the impact level of potential damage scenarios and the attack feasibility level of possible attack paths. This ensures that a precise evaluation can be made regarding the feasibility of each threat that may occur [74].…”

“…As the connection of vehicles keeps developing, the detrimental consequences of cyberattacks that transmit erroneous information over the network are becoming more severe. Furthermore, the frequency of these attacks is not decreasing, which is more evident that the risk level magnitude is high [74], [81]. As shown in Table 15, the minimum and maximum ranges for the impact rating are defined and divided into three groups for intuitive interpretation.…”

Machine learning and blockchain technologies for cybersecurity in connected vehicles

“…Additionally, secure over‐the‐air (OTA) update mechanisms can be employed (Park & Park, 2022; Nilsson & Larson, 2008; Zandberg et al, 2019), which encrypt the update packages and verify their integrity before installation. By implementing secure communication protocols and encryption techniques, the confidentiality and integrity of the update process can be maintained, safeguarding against potential attacks.…”