# V-SOC4 AS: A Vehicle-SOC for Improving Automotive Security
## 4 V-SOC4 AS: Vehicle-SOC for Improving Automotive Security  
In information technology (IT), a security operation center (SOC) is a centralized solution that an organization uses to continuously monitor critical assets to prevent, detect, respond to, and analyze cybersecurity attacks. Usually, a SOC is formed by people, processes, and technology in order to fulfill the previous goals [14]. The SOC architecture can be divided into different subsystems. For example, [PERSON] et al. [30] subdivided the architecture into four subsystems: _sensors_ to collect traffic data; _log management_ to normalize, classify, prioritize, and collect these data; _correlation engine_ to analyze these events; and _response system_ to react to security incidents. Sensors generate events from a critical asset, for example, these events can be a user typing an incorrect password, or a user log-in secure shell (SSH). When the events are generated by sensors, these will be aggregated and modified into a standard format to obtain homogeneous data and saved into a database to perform statistical and forensic analysis. Usually, these operations are done using security information and event management (SIEM) that identifies the attack and provides a response to reduce the impact of that compromise. Therefore, considering these components and how they communicate with each other, the V-SOC4 AS architecture can be represented in Figure 1. This architecture is suitable in several general contexts, such as military or civilian vehicles. In our work, the vehicle is simulated using an open-source tool (ICSim [[https://github.com/zombieCraig/ICSim](https://github.com/zombieCraig/ICSim)]([https://github.com/zombieCraig/ICSim](https://github.com/zombieCraig/ICSim)) (accessed on 7 February 2023)). The V-SOC4 AS architecture consists of two main components: SIEM and SOC console. * SIEM collects the raw events that will be aggregated, parsed, normalized, and analyzed to be displayed correctly. It can analyze data from different types of vehicles. Owing to this component, we can parse these data without adding further physical components to the car. After the events are parsed and normalized, the rule-based component allows control over whether the events sent to SIEM correspond to attacks through custom rules. For example, in the information technology (IT) field, rules could detect if we have multiple logins failed attempts on a login page and excessive firewall denies. * SOC Console: the parsed events will be shown on the SOC console component and monitored by a cybersecurity specialist. If a rule-based mechanism triggers an offense, it will appear on this component so that the analyst can analyze it and potentially move on to the response phase. An advantage of the SOC console is that if an attack is detected, the cybersecurity specialist can check if it is a false positive or a real attack. Furthermore, the SOC analyst (a person in the organization who has knowledge of the automotive domain and automotive attack), when monitoring the data flow from the vehicle, could identify anomalies or attacks that the SIEM has not identified and subsequently add or modify a rule. In the next subsection, we will show an example of an event displayed on the SOC console. Figure 1: V-SOC4 AS architecture. The following is an example of how a V-SOC4 AS works (Figure 1). When an ECU generates a CAN frame, it sends the CAN frame to the telematic control unit (TCU). The TCU converts the messages into JSON format and sends them to the SIEM. When the SIEM receives these events, it aggregates and displays them on the SOC console. Simultaneously, the SIEM, with a rule-based mechanism, checks whether these events can be considered as attacks or not. Events that are considered attacks will be displayed on the SOC console. Communication between the vehicle and the SIEM is simulated using an open-source tool called ICSim. This tool emulates an instrument cluster, creates the data, and sends them to a virtual channel using the SocketCAN interface.