# V-SOC4 AS: A Vehicle-SOC for Improving Automotive Security
###### Abstract
Therefore, in such a scenario, it is necessary to focus not only on attack detection but to extend the analysis to a wide range of information, for example, the vehicle model, the ECU that sent the message, and the type of message sent. This information can determine malicious actions and new types of attacks based on vehicle models and ECUs and, more importantly, to provide possible response activities. To achieve this goal, SIEM (security information and event management) and especially a SOC (security operation center) can be considered responsible for ensuring the correct identification, analysis, defense, investigation, and reporting of potential security incidents [14]. Typically, the SOC monitors and analyzes activity on networks, servers, endpoints, databases, applications, websites, other systems looking for anomalous activities that could be indicative of a security incident or compromise. The SOC is responsible for ensuring that potential security incidents are correctly identified, analyzed, defended, investigated, and reported [14]. It consists of people, processes, technology and activities and responsibilities fall into three general categories namely (i) preparation, planning, and prevention; (ii) monitoring, detection, and response; (iii) recovery, refinement, and compliance. In this work, the vehicle is considered as a critical asset because it contains components (such as an OBD-II port, infotainment system, and USB) that can be exploited to conduct an attack. The idea is to use the SOC architecture to improve the security life cycle in the automotive context, focusing more on the response phase. Since it is not enough to work on improving the detection phase because we do not have the information about the attack (for example, the attacked component, the payload sent, and the ECU model), it is necessary to activate prevention and response actions. The prevention phase aims to block malicious activities in a component. On the other hand, the response actions can put the vehicle in emergency mode. In the literature, the proposed CAN protocol defense mechanisms take into account the detection (with intrusion detection system (IDS) and prevention phase (with cryptographic algorithms) [15] but not the response phase. Thus, the SOC architecture covers all these three phases: Detection implements the set of security controls and analysis of events that have occurred to detect possible offenses; Response defines both cyber and physical structured response plans to contain the damage from a cyber offense; Prevention implements security controls to prevent the possibility of cyber-attacks by using, among others, cognitive technologies, and threat intelligence tools. The prevention phase also allows updating the ECU to fix the vulnerability that causes a specific attack identified in the detection phase. This update can be done using over-the-air technology to update the ECU firmware [16; 17]. The paper presents a new method, vehicle-security operation center for improving automotive security (V-SOC4 AS), to detect attacks and attend to the abovementioned requirements. Two different attacks are considered to validate and confirm the research idea: DoS (denial of service), which consists in preventing legitimate access to services of a target machine by overwhelming its resources [18], and fuzzing which consists in sending a series of messages with minor randomized changes [19]. The main contributions of this paper are:  
* A novel approach, vehicle-security operation center for automotive security (V-SOC4 AS), to detect, respond, and prevent attacks that can occur in the automotive context. The V-SOC 4 AS was developed not to replace existing solutions such as IDS, but to integrate them to support the detection, response, and prevention [14]. The goal is to improve cybersecurity and define new cyber kill chain models. This is possible as the analysis and monitoring take place in real-time and not offline, thus reducing the detection time and providing further support for response activities.