# Threat Analysis and Risk Assessment of a Driver Monitoring System
## 5 Threat Analysis and Risk Assessment
### Threat Identification Process  
The approach combined multiple methodologies to ensure a comprehensive and credible threat assessment. This included the use of Ansys Medini Analysis for asset identification, the STRIDE framework for threat categorization, and the integration of expert judgment to validate the identified risks. The combination of software tools, structured methodologies, and domain expertise enabled a systematic and robust evaluation of potential vulnerabilities within the DMS architecture. The threats were initially identified using two industry-standard tools: Ansys Medini Analyze and Microsoft Threat Modeling Tool (MTMT). These tools enabled system-level modeling of assets and threat surfaces. The output was then organized into a structured spreadsheet (Microsoft Excel), which allowed for manual classification under STRIDE categories and mapping to specific components (e.g., sensors, ECUs, and ports). Each row in the spreadsheet included the threat description, potential attack vector, STRIDE category, and associated component. The Excel file provided in the Supplementary Materials includes the complete list of identified threats along with their classification and quantitative risk assessment according to the TARA methodology.  
Identifying threats in a DMS using TARA involves several steps, beginning with identifying critical assets in the system. These assets include hardware components (sensors, cameras, and actuators), software components (data processing units), and communication channels. Once these assets are identified, the next step is to evaluate how malicious actors could attack or exploit them.  
For example, sensors could be spoofed by sending false data to the system, and dataflows could be intercepted and manipulated. The attack vectors are then analyzed, considering potential entry points for an attacker, such as remote access or physical access to system components. Each identified threat is assigned an impact rating based on its potential effects on safety, privacy, and system functionality.  
The risk evaluation process used a structured methodology based on peer review among participants and historical data. Furthermore, several rounds of analysis were conducted to validate and enhance the robustness of the assessment. Each threat was analyzed by identifying its attack vector, assumptions, and potential attack paths. Severity levels were determined by evaluating the threat's safety, financial, operational, privacy, and legislative impacts using a standardized scale (negligible, moderate, major, and severe). These factors were combined to calculate a risk value based on feasibility and overall impact, following ISO/SAE 21434 recommendations. An automated tool was employed to ensure consistency and transparency in calculations, integrating expert inputs with predefined risk assessment formulas.  
The number of threats identified for a given system can be calculated using the following equation:  
\[N_{t}=\sum_{k=1}^{5}C_{k}\cdot T_{k} \tag{1}\]  
where \(C_{k}\) is the number of components of a particular type (e.g., processes, ports, etc.), and \(T_{k}\) is the number of possible attacks that could affect that component. This allows for a comprehensive analysis of the total number of threats present within the system.