## 5 Discussion  
### Summary of Findings  
CAVeCTIR is a novel approach that expands the functionality of the nIoVe framework by allowing the automated matching and clustering of new malicious activities with a set of existing CTI reports recorded in an IoV ecosystem. The proposed approach is based on machine-learning techniques and models that enable cybersecurity experts to perform deeper and more accurate post-incident analyses. We also reported an evaluation study in which the proposed approach was activated after a series of different attacks (GNSS signal spoofing, GNSS signals jamming, CAN DoS, alteration of CAN messages, altered camera stream, false sensor reading, and malware attack) targeting the CAVs of an IoV ecosystem. The results provided evidence of the functionality and performance of the proposed approach. Hence, the results lead to active consideration of matching and clustering techniques to automatically find similar CTI reports in IoV environments. Approaches such as CAVeCTIR equip the cybersecurity stakeholders (e.g., organizations, and security experts) with automated tools that find and interrelate similar malicious activities detected in IoV environments quickly with minimum--or even with no--human intervention. As a result, the proposed approach could speed up the post-incident investigation of digital forensics and lead to a more accurate, more efficient, and faster attack attribution. Attack attribution is a time-consuming, resource-demanding, and challenging task for cybersecurity stakeholders (e.g., organizations, and experts), considering that there are no automated processes for defining and assessing the responsibility for malicious activities, both regarding technical aspects and threat actor profiling. A high volume of information related to such malicious activities, such as IOCs, is available for existing (e.g., previously reported) threat incidents. Cybersecurity stakeholders (e.g., cybersecurity experts and analysts) could benefit from the proposed approach, as they could quickly and accurately interrelate a new malicious activity (e.g., newly detected cyber-attack) with one or more that have already been reported in the CTI repository resulting in a successful attack attribution. We should stress that CAVeCTIR takes into consideration the dynamic, ongoing, and multi-stage nature of the attack attribution process, which often includes malicious activities and incidents of different types and characteristics. During a typical attack attribution scenario, the cybersecurity experts and analysts of an organization would compare information about a new threat to existing knowledge of previous threats recorded in CTI reports. They would evaluate tools, tactics, techniques, and methods of known malicious actors, would assess the collected and analyzed forensics evidence to define a confidence level for their evaluation reports and judgments and would adopt alternative hypotheses and scenarios to trace malicious activities back to their sources, and thus, complete the attack attribution process. In such scenarios, the CAVeCTIR would be a valuable asset for cybersecurity stakeholders to perform an accurate and quick attack attribution. To provide a clearer picture, let us present an example by making the following hypothesis: an attacker performs a DoS attack on a specific IoV sensor (e.g., GNSS receiver) of a moving CAV. The system detects the anomalies while analyzing the GNSS signals and clusters them into an attack. After the detection of the cyber-attack, the cybersecurity experts of the organization perform a series of post-incident analyses, aiming to attribute the attack (e.g., assign a threat actor profile), among others. The results of the analyses,performed both by the cybersecurity experts and the IoV system (including both manual and automatic processing ways), constitute the digital forensic evidence, which is part of the recorded CTI report. Forensic evidence includes information such as attack sources, analysis methods, collection tools, tactics, etc.