# V-SOC4 AS: A Vehicle-SOC for Improving Automotive Security
###### Abstract  
Integrating embedded systems into next-generation vehicles is proliferating as they increase safety, efficiency, and driving comfort. These functionalities are provided by hundreds of electronic control units (ECUs) that communicate with each other using various protocols that, if not properly designed, may be vulnerable to local or remote attacks. The paper presents a vehicle-security operation center for improving automotive security (V-SOC4 AS) to enhance the detection, response, and prevention of cyber-attacks in the automotive context. The goal is to monitor in real-time each subsystem of intra-vehicle communication, that is controller area network (CAN), local interconnect network (LIN), FlexRay, media oriented systems transport (MOST), and Ethernet. Therefore, to achieve this goal, security information and event management (SIEM) was used to monitor and detect malicious attacks in intra-vehicle and inter-vehicle communications: messages transmitted between vehicle ECUs; infotainment and telematics systems, which provide passengers with entertainment capabilities and information about the vehicle system; and vehicular ports, which allow vehicles to connect to diagnostic devices, upload content of various types. As a result, this allows the automation and improvement of threat detection and incident response processes. Furthermore, the V-SOC4 AS allows the classification of the received message as malicious and non-malicious and acquisition of additional information about the type of attack. Thus, this reduces the detection time and provides more support for response activities. Experimental evaluation was conducted on two state-of-the-art attacks: denial of service (DoS) and fuzzing. An open-source dataset was used to simulate the vehicles. V-SOC4 AS exploits security information and event management to analyze the packets sent by a vehicle using a rule-based mechanism. If the payload contains a CAN frame attack, it is notified to the SOC analysts. automotive security; CAN Protocol; Security Operation Center; V-SOC  
161202330  
to Alfa Romeo Giuletta's OBD-II port, have created a malfunction in the parking sensor by fabricating messages and causing a denial of service (DoS) attack. The researchers of Keen Security Lab [5] found the SSID and password of the Infotainment System in a Mercedes-Benz model by exploiting the CAN bus using a sniffing attack since the CAN protocol does not implement any encryption techniques [6]. Consequently, different types of techniques have been proposed in the literature to remedy the security problems of the CAN protocol. Usually, these techniques involve authentication and encryption mechanisms or machine learning/deep learning techniques to develop an intrusion detection system (IDS) model. However, some hardware techniques require modification of the ECUs to encrypt the CAN payload [7; 8]. [PERSON] et al. [9] provided an analysis of cryptographical protocol for in-vehicle networks considering the vehicle life-cycle. The authors have shown that many of the analyzed approaches may appear advantageous if deployed on a single vehicle but are disadvantageous if deployed at scale. Some works adopt techniques that consist of identifying malicious CAN payload without modifying the CAN protocol [10; 11]. In the case of the IDSs, [PERSON] et al. [12] defined some challenges regarding the machine learning techniques which are how to deploy the model in an in-vehicle system with limited computational power and how to obtain the data to train the algorithm. Moreover, these methods do not provide information about the attack, for example, where it manifested or which payload contains it. This represents only a part of the information and vulnerabilities found inside a vehicle. [PERSON] et al. [13] presented a taxonomy to analyze and classify automotive attacks. In particular, the authors proposed a classification of 162 existing attacks based on this taxonomy that can be considered for the automotive security development process.