## 6 Trust Model--Enhanced Fusion in Secure Computing Platform
Additionally, the evaluation of the impacts of weather and component wear has not been possible because suitable equipment to enable such tasks has not been available. Figure 18 shows a screen capture of the visualisation provided by the trust model. The left half displays a bar chart containing the instantaneous trust in the active sensors. The right-hand graph displays a history of the most recent trust evaluations over the past second (note the vertical scale). Additionally, Table 3 contains the results of the implementation's benchmark test. The average runtime column shows the runtime of the major methods used during the trust model's operation. The evaluate method is the one responsible for trust evaluation and is called from handle_phase1 if the received data are suitable for evaluation, i.e., are not vehicle CAN data containing environmental information. The frequency column corresponds to the respective frequencies, rounded down to the nearest hundred Hertz, representing the maximum evaluation rate. _Controller Area Network_ (CAN bus) is a widely adopted technology for in-vehicle communication with desirable properties such as robustness, flexibility, speed, and relatively low cost. As there are no inbuilt security mechanisms for vehicular CAN buses, we developed and tested an _Intrusion Detection System_ (IDS) for a CAN bus. Without a security mechanism, such as an IDS, no claims can be made on the confidentiality, integrity, authenticity, and freshness of messages in the presence of a malicious attacker. There is often the need to find a balance between the sensitivity and specificity of an IDS, and total elimination of false positives is not possible. In the case of an IDS protecting the vehicular CAN bus, simply discarding suspicious traffic may compromise the normal operation of the vehicle and its safety. There are no security specialists on-site, and possibly no time for human action either. As a result, it is necessary to come up with different strategies for handling security breaches in vehicles, in particular for the vehicular CAN bus. Pulling off  
Figure 18: Screen capture of the trust model implementation during execution. \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Method** & **Avg. Runtime [ms]** & **Avg. Call Frequency [Hz]** & **Calls** \\ \hline evaluate & 0.272 & 3600 & 75,000 \\ handle\_phase1 & 0.205 & 4800 & 75,000 \\ handle\_heartbeat & 0.049 & 20,500 & 75,000 \\ do\_cycle & 0.293 & 3400 & 75,000 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Trust model implementation performance test results. the network cable is not an option. Fail-safe and fail-operational capabilities may be crucial for effective and safe actions in response to alerts raised by the IDS. The developed CAN bus IDS is integrated into the overall system as shown in Figure 16, and its outputs are to be used in the middleware for the system-health check, which will then be displayed to the driver. In the future, the possibility for more effective actions could be investigated, such as a safe-stop (during an ongoing cyber-attack). The practical value of a vehicular CAN bus IDS can be judged by its specificity, sensitivity, hardware requirements, and latency. There are several different approaches to building a CAN bus IDS. It is a real challenge to come up with a single approach that has all the desired properties, as different approaches have different strengths. Combining several complementing approaches is one way to obtain a more complete solution, but of course, hardware requirements and latencies add up. With this understanding, we focused our efforts on a partial solution that is suitable for combining with other solutions due to its lightweight nature. The developed CAN bus IDS operates by detecting anomalies in \(k\)-sequences. We define the term \(k\)-sequence as a length \(k\) sequence of CAN bus identifiers, and it is treated as a hyperparameter. The IDS can be described in two operational phases: training and testing phases.