Acceleration of threat assessment and remediation analysis (tara) using countermeasures in automotive security

Abstract

A threat assessment and remediation analysis (TARA) modeling process includes a threat intelligence database, a threat scenario builder and a countermeasure advisor. An item definition is either a vehicle or an electronic control unit (ECU). If a vehicle, its features are extracted and are converted into an input feature vector. If ECU, its parameters are extracted and converted into an input feature vector. The input feature vector is compared to a feature space of the threat intelligence database that includes any number of feature vectors representing potential attack paths of the vehicle or ECU. The feature vectors closest to the input feature vector are matched and these are output as potential threat scenarios. A countermeasure advisor selects an appropriate countermeasure for each matched feature vector using records in the threat intelligence database and outputs each appropriate countermeasure as a new asset. The countermeasures are downloaded to the vehicle during assembly.