# V-SOC4 AS: A Vehicle-SOC for Improving Automotive Security
## 2 Related Work  
In the literature, several research works aim to improve the security of the CAN Bus. Most of these approaches use intrusion detection systems (IDSs) or intrusion prevention systems (IPSs). An IDS is a software that automates the process of detecting an intrusion into a network. Unlike an IDS, an IPS is a software that provides the functionality of an intrusion detection system, with the added feature of attempting to block an intrusion [21]. [PERSON] et al. proposed a supervised Kohonen Self-Organizing Map (SOM) network to identify attack messages sent on a CAN [22]. [PERSON] et al. [19] proposed an approach to analyzing the offset ratio and time interval between request and response messages in the CAN network. [PERSON] et al. [23] proposed a generative adversarial network (GAN)-based intrusion detection system using a deep-learning model. This model uses a generative model (G) and a discriminative model (D). The model encoded the CAN message into a one-hot-vector and then transformed it into a CAN image. To detect if the real-time CAN message is an attack or not, the authors also used a threshold. IDSs may be limited to detecting specific attacks; if exposed, an attacker could even use this information to avoid detection. The authors stated that this GIDS model could solve these problems related to IDSs. [PERSON] et al. [24] presented an anomaly based IDS that measures and then exploits the interval of periodic in-vehicle messages for fingerprinting ECUs. [PERSON] et al. [25] have suggested an idea to deploy IDS on an in-vehicle network component called gateway. Moreover, in this case, the risk of an attacker compromising the CAN network and gateway is greater than compromising the ECU. [PERSON] et al. [26] reported that other IDS techniques exploited the timing when a message is sent on the CAN bus. [PERSON] and [PERSON] [3] also introduced how the rate of the message can be analyzed for the in-vehicle network. [PERSON] et al. [15] proposed an intrusion prevention system with challenge-based mechanisms. EARNEST, the name of the system proposed by the authors, can address replay and fuzzing attacks. When an ECU sends a message on the CAN bus, EARNEST requires the ECU to solve a challenge. If the ECU answers correctly, the message is forwarded to the bus, otherwise it is discarded. [PERSON] et al. [27] discussed the applicability of intrusion and prevention systems. The researchers said that with the anomaly detection technique, we get false positives and false negatives. In a safety-critical automotive system, it is important to evaluate the effects of these undesirable cases. The authors also discussed the importance of the post-detection phase. These schemes use warnings and log events and facilitate forensic examinations that are important for vehicle safety. Therefore, the solution of using an IDS on an ECU involves various issues: the ECUs have limited computational resources, memory, and power so, using a machine learning or deep learning approach may not be feasible for the above problems [12]. Moreover, IDS and IPS became less and less adequate regarding the new threats [28]. [PERSON] et al. [29] outline that these systems can be bypassed by zero-day or sophisticated attacks. As a consequence, to address the challenges posed by IDS and IPS, there is an increasing demand for SOC [28] because the SOC provides real-time monitoring events that help to understand if the event sent to the SOC is an attack or not from a security perspective [29] and to interpret the logs that with the IDS and/or IPS it is not easy because of their size. So, this can be useful for SOC analysis to identify anomalies or sophisticated attacks in the network by viewing the aggregated logs. In the literature, several research works use a SOC to detect attacks in a private or enterprise network such as distributed denial of service (DDoS), phishing, and SQL injection [30; 31; 32]. In contrast, the state-of-the-art in vehicle security operation center is scarce. [PERSON] et al.