# A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
## 4 Methodology
### Synthesis of Attack Surface  
Once the system has been instantiated for a use case, attack surface analysis is used to identify a comprehensive set of feasible methods for adversaries to achieve their goals. Attackers can use or combine different attack paths to reach their desired goals. Where mitigations should be implemented can be identified by focusing on reducing the ability for an adversary to exploit critical attack surfaces. Attack goals can be obtained by systematically performing a threat modelling on the critical components or functionality of a system. There are a number of approaches to perform threat modelling [6], of which Microsoft's STRIDE is commonly used in the automotive security domain. A reference architecture is useful in conjunction with threat modelling, as it provides a methodology to identify the attack routes to achieve a goal that may not have been previously considered in the threat modelling. However, performing a threat modelling is out-of-scope for this work to ensure generalisation to arbitrary threat modelling techniques. One effective method to describe attack surfaces are _attack trees_, which were first introduced in Reference [15] to manage the large number of threats derived from comprehensive threat modelling in general security. Attack press have since been employed in automotive security in a number of scenarios [70; 71; 72]. To create attack trees potential threat agents and their goals in compromising the system first need to be identified. For each attack goal, the relevant attack surfaces need to be specified that define possible paths to reach this goal. These paths can then be represented as an attack tree. At the end of this procedure, a list of attack trees which cover known goals, sub-goals and attack methods of potential threat agents are produced. In this paper, we also employ attack trees to synthesise, manage and control the attack surface. The process to perform the attack tree analysis is illustrated in Figure 4 and described below:  
1. The goal(s) of the threat actor needs to be specified. 2. Using these goals, identify the component in the reference architecture that ultimately needs to be compromised for these goals to be achieved. 3. Identify the possible entry points to the system the threat actor could exploit. 4. Using the entry point(s) calculate the path(s) that an threat actor could take to reach the target component from an external interaction. 5. Considering a threat actor's capabilities, resources and presence, prune paths that the threat actor cannot exploit. Figure 4: The process of analysing an attack goal when performing an attack surface analysis. Evaluation of threat agents appear at both ends of an attack tree. At the beginning, goals are derived from threat agents' motivations. It is assumed that threat agents will only consider goals that follow from their motivations. For example, a thief has a motivation to increase their wealth, so a goal is to steal physical assets rather than cause damage. Each threat will require a specific capability to be carried out, such as: technique, skills, knowledge, equipment, presence and others. Therefore, at the end of the procedure, the capability of threat agents also needs to be evaluated to check if achieving the goal is feasible. If achieving the goal is not feasible, then the attack tree needs to be pruned from the set of attack trees generated. Existing work has been performed on identifying threat actors and their capabilities, goals, resources and motivations which should be used as input to this attack surface analysis. For example, a comprehensive library of threat agents for general information systems was provided by Intel [73] in their Threat Agent Risk Analysis (TARA) model. This library contains information of 22 threat agents and their 9 common attributes. However, many of the agents are inapplicable in to CAV security.