# On the Modeling of Automotive Security: A Survey of Methods and Perspectives
## 2 Taxonomy of Security Models
### Quantitative Security Methods  
While qualitative models identify the threats in a descriptive language, quantitative methods are used to derive numerically description for security properties. Rather than assessing the executed security policies at the management level [53], the quantitative models referred to in this paper concern the operational aspects of security. It aims to measure the level of threats of implemented systems during operation. [PERSON] in [33] surveyed numbers of different quantitative methods to evaluate if security can be represented quantitatively. The quantitative methods are reviewed with a taxonomy including the parameters such as perspectives, targets, assumptions, and validation. The conclusion pointed out that quantified security is a weak hypothesis and can be hardly validated for most cases. However, quantification modeling is still a fundamental topic since it is worthwhile for risk assessment and management. Thus, there are numerous research efforts to explore quantitative methods on threat modeling. The Common Vulnerability Scoring System (CVSS) is a numerical method that provides a scoring system to evaluate vulnerabilities and their severity [54]. It is composed of three metric groups: Base, Temporal, and Environmental, with a set of elements, which reflect threats in each [55]. A CVSS score is computed with a provided formula combining all possible metrics, which can be obtained from a vulnerability look-up table. There is an online calculator available for the computation of the score. The CVSS was developed for software vulnerabilities and now it has been adapted for cyber-physical platforms. Attack trees are graphical representations to show possible attacks with a tree structure. The root of the tree is the attackers' goal. The means to achieve the goal are denoted by the leaf nodes of the tree and they are connected by logical gates \"AND\" and \"OR\" [56]. Attack trees describe the different routes to exploit the vulnerabilities of the system to reach a desired state [57]. They provide a quantitative basis to calculate the attack potential [58]. Furthermore, attack trees can be used for the designers to decide which actions should be prevented. Thus, there are some exploratory extensions like attack-defense trees or the integration of countermeasures in the attack tree [34]. A quantitative model of attack tree is presented in [59] to present the intrusion process. The quantitative analysis of attacker behavior was performed by identifying the probability of different attack phases according to the empirical data collected from intrusion experiments. In addition, there are some stochastic methods to quantify security. In [60], a method is proposed to build the security model with existing tools for reliability. It suggests viewing the threat of a system as a system failure. A Markov model is used to quantify the vulnerabilities with the probability of potential attacks. The dynamic state transition is considered with the specified detecting probabilities to estimate the security such as availability of an embedded system. An automotive system, namely a cooperative adaptive cruise control system, is used to illustrate the analysis. The security attributes of an intrusion tolerant system are assessed quantitatively in [61]. The general probability distribution functions are identified to describe the attacker behavior and the system's response. The probability of security failure is computed to demonstrate the violation impacts of different security attributes. When the systems become more complex, the interdependences among their components are denser. Thus, the methods of the threat modeling are needed to be evolved. A hybrid method made of three types of threat modeling methods is proposed in [62]. The attack trees are built according to the threat categories of STRIDE. Then the attack likelihood of the tree components are calculated with CVSS method. The method is validated with a case study of railway communications network.