[Paper Review] Vehicle Security: Risk Assessment in Transportation

Kaveh Bakhsh Kelarestaghi, Foruhandeh, Mahsa+2 more|arXiv (Cornell University)|Apr 19, 2018

Vehicular Ad Hoc Networks (VANETs)Engineering29 references17 citations

TL;DR

This paper presents a risk-based vulnerability assessment framework for in-vehicle networks in intelligent transportation systems (ITS), identifying cyber threats that compromise safety, privacy, and system integrity. By aggregating individual risks and using an impact-likelihood matrix, the study quantifies system-level risks and provides actionable insights for policymakers and engineers.

ABSTRACT

Intelligent Transportation Systems (ITS) are critical infrastructure that are not immune to both physical and cyber threats. Vehicles are cyber/physical systems which are a core component of ITS, can be either a target or a launching point for an attack on the ITS network. Unknown vehicle security vulnerabilities trigger a race among adversaries to exploit the weaknesses and security experts to mitigate the vulnerability. In this study, we identified opportunities for adversaries to take control of the in-vehicle network, which can compromise the safety, privacy, reliability, efficiency, and security of the transportation system. This study contributes in three ways to the literature of ITS security and resiliency. First, we aggregate individual risks that are associated with hacking the in-vehicle network to determine system-level risk. Second, we employ a risk-based model to conduct a qualitative vulnerability-oriented risk assessment. Third, we identify the consequences of hacking the in-vehicle network through a risk-based approach, using an impact-likelihood matrix. The qualitative assessment communicates risk outcomes for policy analysis. The outcome of this study would be of interest and usefulness to policymakers and engineers concerned with the potential vulnerabilities of the critical infrastructures.

Motivation & Objective

• To identify and assess cyber threats targeting in-vehicle networks that can compromise transportation system safety and reliability.
• To develop a system-level risk model by aggregating individual vulnerabilities in in-vehicle networks.
• To apply a qualitative, risk-based approach to evaluate the likelihood and impact of in-vehicle network compromises.
• To support policy and engineering decisions by communicating risk outcomes through a structured impact-likelihood matrix.

Proposed method

• Aggregated individual cyber risks from in-vehicle network vulnerabilities into a system-level risk assessment.
• Employed a qualitative risk-based model to evaluate threats based on their likelihood and potential impact.
• Used an impact-likelihood matrix to categorize and visualize risk levels for different attack scenarios.
• Focused on vulnerabilities in cyber/physical systems within intelligent transportation systems (ITS).
• Conducted a vulnerability-oriented risk assessment to identify attack vectors and consequences.
• Integrated findings into a policy-relevant risk communication framework for stakeholders.

Experimental results

Research questions

• RQ1 What are the primary cyber threats that can compromise in-vehicle networks in intelligent transportation systems?
• RQ2 How can individual in-vehicle network risks be aggregated to assess overall system-level risk?
• RQ3 What is the impact and likelihood of in-vehicle network compromises on transportation system safety and reliability?
• RQ4 How can a risk-based approach effectively communicate threat consequences to policymakers and engineers?
• RQ5 What are the key vulnerabilities that could allow adversaries to take control of vehicle networks?

Key findings

• In-vehicle networks are vulnerable to cyberattacks that can compromise safety, privacy, reliability, and system efficiency.
• The study identifies that unknown security vulnerabilities create a race between adversaries and security experts to exploit or mitigate risks.
• System-level risk is effectively quantified through aggregation of individual risk factors using a risk-based model.
• The impact-likelihood matrix provides a clear, qualitative visualization of risk outcomes for policy and engineering decision-making.
• The framework enables stakeholders to prioritize vulnerabilities based on their potential impact and likelihood of exploitation.
• The results are directly applicable to improving the resilience of intelligent transportation systems through proactive risk management.