## 1 Introduction  
With the emergence of connected cars that provide users with safety and convenience, vehicles that had been closed began connecting to the outside. Vehicles contain a variety of interfaces and, simultaneously, the attack surfaces at which attackers can find access have increased, as shown in Figure 1.  
Inevitably, there is the growing importance of cybersecurity for connected cars. This is because there may be a direct threat to social safety, including the lives of passengers, if a security threat occurs in vehicle to everything (V2X) communication, a service for the safety of connected cars. WP29, the World Forum for Harmonization of Vehicle Regulations under the United Nations Economic Commission for Europe (UNECE), has adopted two regulations related to vehicle cybersecurity, UNR155 (UN Regulation No. 155) and UNR156 (UN Regulation No. 156), in June 2020 [1, 2]. UNR155 is a regulation for the cybersecurity management system (CSMS) of vehicles, and it is concerned with constructing CSMS for the responses of manufacturers and partner companies to vehicle cybersecurity threats. ISO/SAE 21434 is the reference standard for UNR155 [3]. It mentions prohibiting companies from selling vehicles or parts in Europe if cybersecurity measures are not met, thus making companies act against growing cybersecurity threats to connected cars. According to Trend Micro, the critical threat level to the cybersecurity defined in UNR155 is 22% for existing vehicles. It is expected to rise to 43% with the spread of connected cars in the future, as shown in Figure 2. It is forecast that low-level threats among the attack surfaces will disappear altogether, with only threats of a medium level and above remaining [4]. As such, the importance of connected-car cybersecurity is growing worldwide, and the development and verification of technologies for connected-car security requires using real vehicle-based test facilities or real-road driving tests. However, it is difficult for security solution developers to build and use real vehicle-based test facilities. It is difficult to conduct tests and verifications on real roads because they affect other vehicles. V2X simulations can be performed using commercial programs, such as Vector CANoe. However, since vehicles implemented by simulations or road infrastructures, such as Road Side Unit (RSU), are simple virtual nodes implemented by software, they cannot be accessed from the outside, thus limiting their use in developing security technologies. Therefore, this study has implemented V2X communication simulations of actual road driving environments in South Korea and built a virtual machine environment for interoperation, with external interfaces to overcome the limitations of a conventional simulation equipment. Virtual environment tests can be performed for each V2X driving scenario in the implemented environment. An interface allows communication with the outside by linking the virtual machine with simulation nodes. That is, a test environment close to the real-world environment is built. This allows sufficient verification in a simulation environment before applying the connected-car security technology in the real-world environment. The contributions of this paper can be summarized as follows:  
1. We analyze existing simulation and testing methods from the perspective of security evaluation. 2. We propose requirements for V2X security evaluation. 3. We propose misbehavior-based application level V2X security evaluation scenarios. 4. We implement V2X security evaluation scenarios using CANoe Option.Car2X simulation. Figure 1: Connected car internal/external interfaces. Figure 2: Current and future risks to the attack vector of connected cars. In the future, most attack vectors will shift to medium–high risk threats. This paper is organized as follows. Section 2 introduces the background on V2X standards and simulations and security testing related work.