# On the Modeling of Automotive Security: A Survey of Methods and Perspectives
## 4 Discussion  
Security analysis is a fundamental activity in the security engineering process. The purpose of security analysis is to identify threats and assess potential risks, and then to manage the risks with countermeasures. Security models are built up to expound the security characteristics of systems. There are various security models from different domains, other than surveys there are few taxonomies to categorize the existing models. According to different conditions and usages, some systems only \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Factors** & **Application** & **Security Attributes** & **Reference** & **Safety-Related Risk Impact** & **Inputs \& Outputs** \\ \hline \multirow{4}{*}{EVITA} & \multicolumn{3}{c}{Authenticity,} & \multirow{4}{*}{Attack tree} & \multirow{4}{*}{YES} & \multirow{4}{*}{Safety,} & Input: system use \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\ \hline \multirow{4}{*}{HEAVENS} & \multirow{4}{*}{Automotive electrical and/or electronic systems} & \multirow{4}{*}{Strible} & \multirow{4}{*}{YES} & \multirow{4}{*}{Safety,} & Input: system use \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\ \hline \multirow{4}{*}{SINA} & \multirow{4}{*}{Connected vehicle systems} & \multirow{4}{*}{Strible (with Integrity, Confidentiality, Authorization)} & \multirow{4}{*}{YES} & \multirow{4}{*}{Safety} & Input: system \\  & & & & & & \\  & & & & & & \\  & & & & & & \\ \hline \multirow{4}{*}{SAHARA} & Automotive embedded systems & Confidentiality, Availability, Integrity & \multirow{4}{*}{STRIDE} & \multirow{4}{*}{YES} & Input: the outcomes of safety analysis Output: threat level and security level \\  & & & & & & \\  & & & & & & \\ \hline \multirow{4}{*}{TVRA} & \multirow{4}{*}{Communications and services} & confidentiality, integrity, availability, authenticity, accountability & \multirow{4}{*}{TVRA for Telecommunications} & \multirow{4}{*}{NO} & Availability of the network, Customer & Input: ITS target of evaluation Output: risk determination and possible countermeasures \\ \cline{1-1} \cline{5-5}  & & & & & & Output: risk determination and possible countermeasures \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of the automotive security models. need to enumerate the threats, which may be encountered with given types of threats. Thus, descriptive models, for example STRIDE, are sufficient to discover and analyze the security threats. For other applications, vulnerabilities must be evaluated in a quantitative form to testify its security rating. Numerical or stochastic models such as CVSS are needed to present the security properties. To overcome the security problems in automotive system development, security models as essential methods are needed to be explored urgently. There are several security models designed or adapted for the automotive industry as introduced in the standard of SAE J3061. However, how to differentiate the existing automotive security models and apply them in a proper and efficient manner are unclear and confused. Hence, the common methods that have been used for vehicles have been reviewed and compared with six fundamental aspects, which are most interested in automotive electronic and electrical (EE) design. The security models are chosen depending on the different analysis objects. SINA is used for the V2X system of vehicles. The communication between the vehicle and the backend can be analyzed with TVRA method. The automotive electrical and/or electronic systems includes the IT system and the embedded systems. Thus, HEAVENS can be applied to a larger scope than EVITA and SAHARA. STRIDE is utilized by three of the mentioned methods to list the potential threats for the further analysis. The attack paths of dark scenarios are sorted out with attack trees in EVITA.