# V-SOC4 AS: A Vehicle-SOC for Improving Automotive Security
## 6 Conclusions  
Automotive security is critical to ensure driver safety and comfort in an interconnected vehicle. However, as vehicle connectivity becomes commonplace, new security risks emerge because communication protocols, such as the CAN network, are still insecure and vulnerable to attacks.  
Therefore, in this work, a vehicle-SOC for improving automotive security (V-SOC4 AS) was proposed. The V-SOC4 AS aims to work alongside current systems of IDSs and IPSs to improve attack detection but, more importantly, to define a response phase in the automotive context.  
In this work, two types of attacks, DoS and fuzzing, were analyzed to validate the proposed approach and to detect these attacks, two rules were developed in IBM QRadar SIEM. An advantage of the V-SOC4 AS is that, with the UUID_ECU and vehicleModel parameters discussed in Section 5, it is possible to figure out which vehicles are attacked and the specific ECU that is vulnerable. In this way, it is possible to identify and fix the vulnerability that caused the attack and update vehicles of the same model, and those that mount the same ECU model. This can be helpful to prevent an attack that can occur on other vehicles. An additional advantage of the architecture presented in the paper is that through the vehicle IP on the SOC console, a proper response could be delivered according to the different strategies presented in Section 4.2.  
Finally, it is possible to generalize the presented approach not only to identify and detect attacks but also to analyze the entire vehicle and not just the CAN protocol, as the SIEM is customizable with different information to be compatible with other protocols.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** \\ \hline DoS & 100 & 100 & 100 & 100 \\ \hline Fuzzing & 100 & 100 & 100 & 100 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Evaluation results obtained with IBM QRadar SIEM using a rule-based method.  
**Author Contributions:** Conceptualization, V.S.B. and D.C.; methodology, V.S.B. and M.D.V.; validation, M.S., M.A.S.M., and D.C.; formal analysis, V.S.B. and M.D.V.; investigation, V.S.B. and M.D.V.; writing--original draft preparation, V.S.B. and M.D.V.; writing--review and editing, D.C., M.A.S.M., M.S., and A.R.; visualization, M.D.V.; supervision, V.S.B. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research was funded by the following projects: SSA (Secure Safe Apulia--Regional Security Center, Codice Progetto 6 ESURE5) and KEIRETSU (Codice Progetto V9 UFIL5) funded by \"Regolamento regionale della Puglia e per gli aiuti in esenzione n. 17 del 30 September 2014 (BURP n. 139 suppl. del 06 October 2014) TITOLO II CAPO 1 DEL REGOLAMENTO GENERALe \"Avviso per la presentazione dei progetti promossi da Grandi Imprese ai sensi dell'articolo 17 del Regolamento\".  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Not applicable.  
**Conflicts of Interest:** The authors declare no conflict of interest.