# On the Modeling of Automotive Security: A Survey of Methods and Perspectives
## 3 Automotive Security Models
### Comparisons of the Automotive Security Modeling Methods  
After reviewing the methods, the considerations and variables of these methods are analyzed and compared in order to utilize them appropriately. There are a number of aspects to differentiate the above methods for understanding. First, even though all these methods are designed for the automotive field, each method is studied in its specific application context. Second, the different security attributes are considered as the objectives in the different methods. Third, automotive security modeling methods are inspired by traditional IT security modeling methods so they use the quantitative and qualitative methods for references. Fourth, safety is the principle factor for vehicles and many automotive security modeling methods are designed to align with safety process. Finally, unlike the traditional security modeling methods, risk analysis is a significant part of the method, and the impact elements are considered for the different purposes. In order to clarify these aspects, a comparison is made with respect to the reviewed methods and the results are showed in Table 1.  
* Application context: The five modeling methods for automotive security reviewed in the last section are exploited for different usage scope. Some methods targeted on the systems on the vehicle and others took the V2X scenarios into account. For example, the method of the TVRA is designed to evaluate the communications and services of network infrastructure in the ITS.
* Security attributes: The security attributes are the protected targets of the valuable asset. Ordinarily, security is composed of the attributes of confidentiality, integrity and availability. The attributes and security objectives in the context of the automotive systems are extended by adding authenticity, accountability, authorization, privacy, non-repudiation, and freshness. The explanation of the  
Figure 6: The criteria to derive security level in SHARA method.  
attributes can be referred to in [83, 92]. Each method specifies different security attributes as objectives.
* Reference methods: Since automotive security is developed based on the traditional IT security modeling methods, the approaches to build a threat model used either the quantitative or the qualitative methods. Most of the methods have been reviewed in Section 2.
* Safety related: The safety has always been regarded as a critical engineering concern for the automotive industry. Unlike IT security, the safety process is essential for automotive design.
* Risk impacts: Risk assessment is employed to rank the threat with impact level parameters. It aids to analyze the potential impacts of threats on the stakeholders like user, dealer or manufacturer of the vehicles. The impact factors can be considered such as the safety of the car occupants and road users, the direct and indirect financial cost for the stakeholders, the operational incidents, and the violation of privacy and regulations. These factors assist to derive the security objectives.
* Inputs and outputs: These factors can be used to better understand the models especially from the engineering point of view. The perspectives of analysis are different from the methods, and thus, the required and start point are different. Since the objectives of each method are various, the outcomes are diverse accordingly.