An Automated And Attack Graph-Based Evaluation Of On-Board Networks

The talk starts from the rising cyber risk of connected vehicles, which carry well over a hundred computers and must receive security support for decades. Earlier attack graph methods, from fault trees to model checking, scale poorly to a network the size of a car. The speaker addresses two audiences: architects weighing the risk of new smart features, and penetration testers choosing which of many computers to test first.

The approach combines three inputs: the vehicle's network topology, the attack surface each component exposes, and an attacker model covering motivation, capabilities and target assets. Path probabilities come from estimating the chance of a vulnerability and whether the attacker's budget covers the exploit cost, approximated with a Gaussian distribution. Low-probability paths are dropped early, which the speaker said keeps computation fast while still covering most relevant risk. A demo ran a small Java and XML prototype that produced a risk-weighted attack graph in about ten seconds. Benchmarks on synthetic chain, bus and mesh networks compared it against a Bayesian network approach, which grew far faster in runtime and memory.

The main takeaway is that the method can guide budget toward the most exposed computers and entry points, and it can run on ordinary laptops or in the cloud. The speaker closed by noting that supplier-built software and dissolved development teams make long-term patching hard, so some premium makers now write their own software stacks.