## 5 Discussion
### Limitations and Future Steps  
Our approach has three main limitations, which are related to the available data, the parameters of the machine-learning approaches, and the supported malicious activities. The effectiveness and efficiency of the machine-learning approaches (such as the ones used in CAVeCTIR) are associated with the size of the available data and the finetuning of the parameters of the algorithms. CAVeCTIR was based on a sample of almost 3000 malicious incidents covering seven different attack types. Although the size is quite big, the effectiveness of the adopted machine-learning approach and the tuning of its parameters would get better and optimized during the ongoing evolution of the system. Focusing on the machine learning model and its characteristics, CAVeCTIR was limited to the use of the DBSCAN algorithm, considering that our previous work indicated its suitability in such cases. Moreover, we focused on a specific set of features and parameters, which are dependent on the adopted IoV framework (i.e., nIoVe) and the application of the machine learning model. The extraction and selection of more features, along with the re-configuration of the parameters of the adopted machine learning models (DBSCAN and other algorithms), should be explored. Regarding the supported malicious activities, CAVeCTIR is limited to seven main types: GNSS signal spoofing, GNSS signals jamming, CAN DoS attack, alteration of CAN messages, alteration of camera stream, false sensor reading, and malware/ransomware attack. CAVeCTIR could consider more types in the future to support a wider area of malicious activities. These types include: V2X signals jamming and spoofing, jamming of mobile broadband communications signals, leakage of IoV credentials, alteration of remote commands, and alteration of embedded firmware.  
The presented work can be extended with our future goals falling into three major categories: (i) optimization of the clustering analysis, (ii) integration with other CTI systems, and (iii) thorough evaluation by security experts. Regarding the optimization of the clustering analysis, we plan to (i) analyze more IoV attacks focusing on CAVs (e.g., alteration of CAN bus messages, false maneuvers, traffic lights alterations, and V2X attacks) in other than simulation environments (e.g., hybrid and real-word environments), and (ii) explore combined clustering methods and diverse threat parameters/features, aiming to refine the models, improve their performance, and thus, provide enhanced assistance to the security experts. Regarding the integration with other CTI systems, we plan to extend the proposed approach to other CTI repositories of IoV environments (e.g., in nIoVe, there is a shared threat intelligence repository that records a complete list of incoming threats, including response and recovery actions). We also plan to extend the proposed approach to communicate with open-source and publicly accessible platforms, including knowledge bases and repositories (e.g., MITRE ATT&CK). This extension would help security experts to perform a more detailed forensics analysis, given that they would have access to more information related to the malicious incident they investigate. Finally, regarding the evaluation by security experts, we plan to perform thorough user evaluation studies in diverse environments (e.g., simulation, hybrid, and real-world), where experienced security stakeholders (e.g., security experts) will assess several dimensions of the proposed approach, such as its functionality, operability, and efficiency.