System Engineering-Based Threat Modeling for Heavy-Duty Vehicles

With rapid advancements in connected vehicle technologies, modern vehicles have become increasingly vulnerable to cyber-attacks. While concerns about automotive cybersecurity are growing, research specifically addressing the cybersecurity of heavy-duty vehicles, such as freight trucks, remains limited. Given that disruptions in the operation of these vehicles can have significant impacts on the economy, supply chains, and transportation systems, it is urgent to explore the cybersecurity of such vehicles. This study addresses this gap by performing a cybersecurity threat analysis of a freight truck. As highlighted in ISO/SAE 21434, threat analysis and risk assessment are fundamental steps in implementing cybersecurity. This study focuses on the interfaces of heavy-duty vehicles, using the STRIDE framework. The process begins by identifying critical assets and analyzing potential attack vectors. Following a systems engineering approach, the truck's system is decomposed into subsystems to identify potential cybersecurity vulnerabilities. After constructing a data flow diagram based on the system engineering results, the STRIDE framework is then applied using the Microsoft Threat Modeling Tool to systematically identify and classify possible attack scenarios. The study also outlines the features of extracted threats related to heavy-duty vehicle interfaces. This work presents a structured approach to threat modeling, focusing on truck interfaces, and contributes to a deeper understanding of cybersecurity risks in connected heavyduty vehicles.