A model-based approach for cybersecurity assessment of off-road and defense vehicles

The large amount of Electric/Electronic (E/E) systems in modern vehicles make them vulnerable to cyberattacks. New regulations and standards, such as UNECE R155 and ISO/SAE 21434, aim to tackle this issue by providing tools and workflows that vehicle designers can use to minimize cybersecurity threats. Plenty of research is being carried out in the automotive cybersecurity field, which is rich in assessment methodologies that comply with latest regulations. However, most efforts focus on Connected and Autonomous Vehicles (CAVs), often overlooking other families of vehicles such as Off-Road Vehicles (ORVs) and Defense Vehicles (DVs). These categories face not only many of the same cyber vulnerabilities as CAVs, but also unique cybersecurity challenges due to their special E/E systems. In this work we present a novel cybersecurity assessment methodology based on ADVISE Meta, an ontology-based modeling framework. ADVISE Meta models can be converted into lower-level stochastic models, which can be simulated to compute the probability that the adversaries reach their cybersecurity goals. Our methodology integrates well-established cybersecurity sources such as CAPEC, TAL, and UNECE R155, making it a suitable approach for industrial applications. Moreover, it is well integrated in the Threat Analysis and Risk Assessment (TARA) framework defined in ISO/SAE 21434.