The information on vehicles, people, infrastructure and other elements projected onto maps, along with the advanced map data that constitutes automated driving system platforms, is expected to be primarily retrieved from external networks.
The information retrieved is then sent to units in the control and information systems of the vehicle for the purpose of controlling it. However, this situation is also a factor liable to trigger cybersecurity problems not found in traditional vehicles.
The agreement on UN R155/R156 reached at the UNECE WP.29 also makes addressing cyberattacks necessary from a regulatory perspective.
To solve such issues, our Surveys of New Cyberattack Techniques and Countermeasure Technologies project from the second phase of SIP-Automated Driving for Universal Services focused on intrusion detection systems (IDS) as a technology to combat new cyberattacks after shipment. We formulated IDS evaluation guidelines to serve as a baseline for testing and evaluation when installing an IDS.
At the same time, we assessed the technical requirements for collecting and storing information on connected vehicle threats and carried out collection tests using honeypots and other mechanisms in the context of building a system to provide first response support in the event of an actual incident.
With respect to the theme of formulating IDS evaluation guidelines, we investigated the new cyberattacks disclosed in 2020 and used questionnaires and interviews to examine the specifications of products offered by three vendors to feed that information back into evaluation items for IDS functions. We are also assessing IDS performance evaluation items in actual environments such as test beds and vehicle benches, primarily for the detection functionality of network IDS (NIDS).
With respect to the theme of surveys and research on connected car threat information and first response support, we theorized that sharing information on threats within the industry would contribute to first response support. We therefore analyzed threat intelligence activities and the threat information collection and storage methods from the IT industry, the pioneer in that area, and are planning to conduct threat information collection testing using a honeypot to simulate an after sales product (an external unit connected through OBD, for example), as well as monitoring tests.
View full abstract