# V-SOC4 AS: A Vehicle-SOC for Improving Automotive Security
## 5 Experimental Results and Discussion
### DoS Attack  
Since CAN does not have inherent authentication mechanisms, an attacker can send high-priority messages (for example, \"000\") to manipulate the bus. To detect this attack, a rule was created in QRadar that checks if the CAN ID of a specific event contains all zeros. \begin{table}
\begin{tabular}{c c} \hline \hline
**CAN ID** & **Data Field** \\ \hline \(111\) & FFFFFFFFFFFFF \\ \hline \(111\) & FFFFFFFFFFFFF \\ \hline \(111\) & FFFFFFFFFFFFF \\ \hline \(222\) & FFFFFFFFFFFFFFFFF \\ \hline \(222\) & FFFFFFFFFFFFF \\ \hline \(222\) & FFFFFFFFFFFFFFFFF \\ \hline \(333\) & FFFFFFFFFFFFFFFFF \\ \hline \(333\) & FFFFFFFFFFFFFFFFF \\ \hline \(333\) & FFFFFFFFFFFFFFFFF \\ \hline \(444\) & FFFFFFFFFFFFFFFFF \\ \hline \end{tabular}
\end{table} 
Table 1: Fuzzing messages injected by the authors [41]. When true, the rule raises an offense. Figure 10 shows the DoS rule. The first row is used to filter out the other events not related to DoS. For example, messages with QIDs belonging to ECU data transfer (see Figure 4) are filtered for further analysis using this rule. The second row indicates a regular expression (Regex), a string of text that allows searching a pattern in the text. If the CAN ID has all zeros, an offense is generated. To test the DoS rule, the dataset \"dosattack.log\" contained in the OpelAstra dataset was used. The messages were transformed into JSON format with additional fields: UUID_ECU and vehicleModel. Figure 11 shows some of the messages that were sent to IBM QRadar. To generate an offense, IBM QRadar uses a component called _Rule Wizard_. Figure 12 shows the actions chosen to raise the offense regarding the DoS attack. \"Dispatch New Event\" defines the field used to generate the offense such as the Event Name and Event Description. The SIEM offers the possibility of sending an e-mail when an attack occurs or adding the event in a Reference to save the results, and execute custom actions. These actions could be used for the response phase, for example, to send an email to alert the driver if an attack occurs. By choosing the action \"Add to a Reference Set\" and \"Add to a Reference Data\", the values regarding the attack will be saved to understand where the attack occurs and what payload has been sent by the attacker. The role of the \"Reference Set\" is to save the CAN ID(s) that are sent as an attack on the bus. Therefore, it is possible to resolve the problem by fixing the ECU source code. In IBM QRadar SIEM, the Reference Set is a collection of unique values. The role of the \"Reference Data\" is to save the vehicle model and the ECU ID. The reference data are important for two reasons. First, since V-SOC can analyze multiple vehicles, it is possible to determine based on the vehicle model, if the attacker is attacking multiple vehicles or if the attack has already been identified in other vehicles. If the attack has been identified in other vehicles, we have the knowledge about the attack and, hence know, how to thwart it. Second, with the ECU ID we know where the attack began and if other vehicles are mounted with the same ECU. With this information, the developers can fix the ECU source code and extend the fix not only to the attacked vehicle but also to others using the same ECU. In this way, it is possible to prevent an adversary from attacking other similar vehicles and ECUs. Figure 11: Example of JSON messages that correspond to DoS attack. Figure 10: DoS rule in QRadar. The SIEM allows the addition of information about the severity, credibility, and relevance of the attack. The severity responds to the question: \"How high is the potential damage to the destination?\"; the credibility responds to the question: \"How valid is the information from that source?\"; and the relevance responds to the question: \"How important is the destination?\". This information can be used to understand the threat level and required response time. For example, the fuzzing attack has a severity level higher than the DoS attack because it could activate anomalous behavior in the vehicle.