PIER: cyber-resilient risk assessment model for connected and autonomous vehicles

Abstract

AbstractAs more vehicles are being connected to the Internet and equipped with autonomous driving features, more robust safety and security measures are required for connected and autonomous vehicles (CAVs). Therefore, threat analysis and risk assessment are essential to prepare against cybersecurity risks for CAVs. Although prior studies have measured the possibility of attack and damage from attack as risk assessment indices, they have not analyzed the expanding attack surface or risk assessment indices that rely upon real-time resilience. This study proposes the PIER method to evaluate the cybersecurity risks of CAVs. We implemented cyber resilience for CAVs by presenting new criteria, such as exposure and recovery, in addition to probability and impact, as indices for the threat analysis and risk assessment of vehicles. To verify its effectiveness, the PIER method was evaluated with respect to software update over-the-air and collision avoidance features. Furthermore, we found that implementing security requirements that mitigate serious risks successfully diminishes the risk indices. Using the risk assessment matrix, the PIER method can shorten the risk determination time through high-risk coverage and a simple process.