## 1 Introduction
Therefore, cybersecurity stakeholders could enrich the sharing of IOCs with machine learning models to achieve collaborative threat detection [7]. Such research works use varying CTI platforms and repositories to store information related to threats, IOCs, and machine learning models, such as MISP, GOSINT, YETI, and CIF [8]. Even though there is much information, it is scattered throughout several sources, such as publicly accessible knowledge bases (e.g., MITRE ATT&CK) and private CTI repositories within an organization. Cybersecurity stakeholders, with an emphasis on cybersecurity experts, should be able to rapidly identify common patterns and characteristics in CTI reports (e.g., common adversary tactics, similar analysis and mitigation techniques), given that the detected malicious activities (e.g., cyber-attacks) may be connected to one another. Therefore, there is a need to assist cybersecurity stakeholders in this direction, as this would have a direct impact on the forensic investigation process (e.g., speed up the attack attribution process and perform a more accurate post-incident investigation). Motivated by that need, we can extend existing cybersecurity frameworks for IoV, such as nIoVe [9], by reinforcing them with tools that employ artificial intelligence techniques to address such challenges. In particular, we can adopt machine-learning approaches (e.g., clustering techniques) to build tools that identify similarities and differences between the attributes of the stored CTI reports and the characteristics of a new malicious activity. Cybersecurity experts could use such tools to swiftly correlate a malicious activity with previously reported ones, access existing knowledge about it, and apply comparable approaches to analyze its impact. This would result in a more accurate and quicker attack attribution and post-incident forensics investigation. Therefore, the research question that this work aims to answer is:  
_\"Can we expand existing IoV cybersecurity frameworks and provide the cybersecurity stakeholders (with an emphasis on cybersecurity experts) with an approach implementing an automatic process that analyzes and correlates CTI reports with newly detected malicious activities (e.g., cyber-attacks) on CAVs in an IoV environment?\"_  
To answer our research question, we developed CAVeCTIR, which expands the nIoVe framework [9]. CAVeCTIR uses advanced machine learning techniques and provides a quick, automated, and effective solution for clustering similar malicious activities. We performed an evaluation study applying CAVeCTIR in various CAV environments (simulation, real-world, and hybrid) and investigated its performance for almost 3000 malicious activities of diverse types (GNSS signal spoofing, GNSS signals jamming, CAN DoS attack, alteration of CAN messages, alteration of camera stream, false sensor reading, and malware/ransomware attack). The results indicated that the DBSCAN algorithm worked well and identified non-overlapping core clusters of high density. Therefore, cybersecurity stakeholders could take advantage of CAVeCTIR by adopting the same or similar methods to analyze newly detected malicious activity, speed up the attack attribution process, and perform a more accurate forensics investigation. The remainder of the paper is organized as follows: we discuss related works, we present the nIoVe framework, which is a multi-layered interoperable cybersecurity solution for IoV [9], we present our approach for matching CTI reports using machine learning techniques, we present the setup and the results of an evaluation study with multiple attack scenarios, we interpret and discuss the findings of our study, we present the future directions of this work, and we conclude the paper.