Cyber Situational Awareness in Vehicle Security Operations: Holistic Monitoring and a Data Model

Vehicles continue to evolve toward automation and connectivity. These software-defined vehicles comprise more potential vulnerabilities and a larger attack surface, including threats to safety. To ensure these cybersecurity risks are properly managed, it is imperative to implement monitoring, analysis and response capabilities to new threats and vulnerabilities. Analysis and response, to be carried out in a Vehicle Security Operations Center, require decision-making, for which awareness of current risks is required. To this end, this paper proposes two elements: First, a holistic monitoring concept that provides data from the vehicle fleet and background information available particularly in the automotive environment. Second, a formalized data model that connects the monitored information to a comprehensive situational understanding of the security posture. To define such a model, we analyzed cyber situation awareness and automotive data models. Being graph-based, our new model shall enable straightforward retrieval of relationships between risks, assets and existing knowledge and provide a flexible backbone for both immediate as well as strategic decisions.