# A Survey of Vehicle to Everything (V2X) Testing
## 5 V2X Testing Methods
### Penetration Testing  
Penetration testing is a method of simulating a malicious attacker's methods and testing the security of the target system. It is a critical step in the development of the V2X. The penetration testing needs specific tools by which vulnerabilities of the V2X can be scanned [86]. The effectiveness of penetration testing relies on the skills and experience of testers [87], and it involves many disciplines, such as software, electronics, radio frequency (RF), and cryptography [26]. Therefore, penetration testing can be performed by personnel on an independent internal Cybersecurity test team or by outside third party engagement [88]. The penetration testing can be divided into three categories: white box testing, black box testing, and gray box testing [26; 89]. In black box testing, the tests have no information regarding the tested system in advance, and they need to look for vulnerabilities from the perspective of the attacker. Its advantage is that the testing process is more realistic [90], but the disadvantage is also obvious--more testing time is needed. In white-box testing, testers can obtain information such as the design specifications of the system under test and code implementation in advance, making it easier to identify problems. However, the V2X is a complex system, and many design details should not be provided to testers, thus greatly reduces the advantages of white-box testing. Gray box testing is a mix of white box testing and black box testing which can obtain some information of the system under test and mainly adopts the white box test method. For the parts which testers cannot obtain information, the methods for black box testing are used. There are three types of specialized penetration testing: interface testing, transportation testing, and system testing [91]. Interface testing targets interfaces among the vehicles, mobile terminals, roadside units,  
Figure 7: Vehicle Gateway Testing Architecture. Transportation testing focuses on misuse issues and design flaws in communication protocols and weak cryptographic schemes. System testing examines the implementation flaws, insecure system settings and other known vulnerabilities of the vehicle gateways, vehicle systems, cloud systems, mobile terminal OSs, etc. And special penetration testing tools and techniques are needed to cover the above testing requirements. The penetration testing process includes creating a threat model, designing a test plan, executing test cases, and generating test reports [92]. Creating a threat model can be based on the V2X security threats described in Section 3.2. Designing a test plan must guarantee availability of personnel or devices, meeting timelines and deliveries, comprehensive test cases, and adequate test tools. The process of executing test cases mainly focuses on system dependencies, user interfaces, system design, and system implementation. The test report is generated from the perspective of vulnerability reappearance, vulnerability severity assessment, and scenarios where malicious attackers exploit vulnerabilities. Penetration testing generally adopts an iterative process. When a system vulnerability is discovered through testing, it is likely to expose additional problems. Therefore, testers can perform iterative testing based on the discovery of vulnerabilities. In addition, penetration testing can be combined with several other automated testing tools, using static analysis and dynamic analysis methods, reducing time and costs [93; 94]. The test frameworks discussed in Sections 5.1-5.3 can also be used for penetration testing, for example, using test simulation devices for Sybil attacks, Replay attacks, etc., using channel jammers to simulate channel congestion scenarios. In addition to the test frameworks, those simulators mentioned above can be seen as the system under test. Then, testers can perform penetration testing to the simulators.