This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
1
A Survey on Cyber-Security of Connected and
Autonomous Vehicles (CAVs)
Xiaoqiang Sun, F. Richard Yu , Fellow, IEEE, and Peng Zhang
Abstract— As the general development trend of the automotive
industry, connected and autonomous vehicles (CAVs) can be
used to increase transportation safety, promote mobility choices,
reduce user costs, and create new job opportunities. However,
with the increasing level of connectivity and automation, malicious users are able to easily implement different kinds of attacks,
which threaten the security of CAVs. Hence, this paper provides a
comprehensive survey on the cyber-security in the environment
of CAVs with the aim of highlighting security problems and
challenges. Firstly, based on the types of communication networks
and attack objects, it classifies various cyber-security risks
and vulnerabilities in the environment of CAVs into in-vehicle
network attacks, vehicle to everything network attacks, and other
attacks. Next, it regards cyber-risk as another type of attacks
in the environment of CAVs. Then, it describes and analyzes
up-to-date corresponding defense strategies for securing CAVs.
In addition, it concludes several available cyber-security and
safety standards of CAVs, which is helpful for the practical application of CAVs. Finally, several challenges and open problems
are discussed for the future research.
Index Terms— Connected and autonomous vehicles, cybersecurity, attacks, defense strategies, standards.
I. I NTRODUCTION
B
ASED on incorporating many different technologies,
connected and autonomous vehicles (CAVs) [1] have
been envisioned to enhance transportation efficiency, reduce
accidents, improve safety, offer great mobility service options,
and alleviate environmental damage [2]. The CAVs paradigm
will continue to unfold steadily and progressively throughout
Manuscript received June 16, 2020; revised December 27, 2020; accepted
February 12, 2021. This work was supported in part by the National
Natural Science Foundation of China under Grant 61802118, in part
by the Science and Technology Innovation Projects of Shenzhen under
Grant JCYJ20190809152003992, in part by the China Postdoctoral Science
Foundation under Grant 2019M653042, in part by the Government of
Canada’s National Crime Prevention Strategy, and in part by the Natural
Sciences and Engineering Research Council of Canada (NSERC) Collaborative Research and Training Experience (CREATE) Program for Building
Trust in Connected and Autonomous Vehicles (TrustCAV). The Associate
Editor for this article was H. L. Vu. (Corresponding author: F. Richard Yu.)
Xiaoqiang Sun is with the Guangdong Key Laboratory of Intelligent
Information Processing, College of Electronics and Information Engineering, Shenzhen University, Shenzhen 518060, China, and also with the Key
Laboratory of Optoelectronic Devices and Systems, Ministry of Education
and Guangdong Province, College of Physics and Optoelectronic Engineering,
Shenzhen University, Shenzhen 518060, China (e-mail: xqsun@szu.edu.cn).
F. Richard Yu is with the School of Information Technology, Carleton
University, Ottawa, ON K1S 5B6, Canada (e-mail: richard.yu@carleton.ca).
Peng Zhang is with the Guangdong Key Laboratory of Intelligent Information Processing, College of Electronics and Information Engineering,
Shenzhen University, Shenzhen 518060, China (e-mail: zhangp@szu.edu.cn).
Digital Object Identifier 10.1109/TITS.2021.3085297
the 2020s and 2030s with the improvements of infrastructure
and communication technologies. The global CAVs market is
becoming one of biggest markets in the world. It is expected to
reach $7 trillion by 2050. Furthermore, many big automotive
manufacturers and high-tech giants are racing against the
clock to bring practical CAVs to the market. Considering
broad market prospects of CAVs, several ambitious research
programs have been established around the globe. In the near
future, CAVs may be used widely by the public.
Although CAVs have potential benefits, there are various
security and privacy challenges [3]. In particular, the security
risk is escalating with the increasing level of connectivity
and automation. There exists a risk that an adversary can
control a vehicle or its surrounding devices. For example,
based on a vulnerability in the vehicle’s entertainment system,
Charlie Miller and Chris Valasek demonstrated that they had
hacked into a Jeep Cherokee successfully using a laptop via
the Internet in 2015 [4]. Then, they can remotely control
steering wheel, accelerator, air-conditioning, radio, windshield
wipers, and even brakes, which may put the driver’s human
life in the risk. Hence, Chrysler had to recall for 1.4 million
vehicles to manually install the patch for this leak. This
attack is a watershed for the automotive industry. Before this
attack, many automotive manufacturers argued that it was
impossible to implement remote attacks on the vehicles. In
addition, the driver often listens to the downloaded music on
the car stereo. However, the downloaded music may include
the malware codes, for example buffer overflow codes, which
can get into the vehicle’s entertainment system and make its
way into other systems, including those that control the engine
or brakes.
For the widespread deployment of CAVs in intelligent
transportation systems, the potential cyber-security risks and
vulnerabilities need to be addressed. Hence, there is a need
to research how to defend and mitigate these security issues.
In this paper, we endeavor to survey the cyber-security in the
environment of CAVs. Eventually, we make following four
contributions.
• In the environment of CAVs, based on the types of
communication networks and attack objects, we classify
the existing cyber-security risks and vulnerabilities
into in-vehicle network attacks, vehicle to everything network attacks, and other attacks. Because the
research of cyber-risk is helpful for ranking potential
risks and forecasting future vulnerabilities, we regard
cyber-risk as another type of attacks in the environment
1558-0016 © 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
2
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
Fig. 2. The status of the papers related to the cyber-security in CAVs based
on the countries.
Fig. 1. The status of the papers related to the cyber-security in CAVs based
on the research directions.
of CAVs, which is different from the previous
work.
• In order to resist and mitigate potential cyber-security
risks and vulnerabilities, we analyze the corresponding
defense solutions, which are helpful for securing CAVs.
• Most of the research of CAVs remains at the theoretical
level. In order to realize the leap from theory to application, we conclude existing cyber-security and safety
standards in the environment of CAVs.
• We present several challenges and open problems that can
be considered as future research directions.
The remainder of this paper is organized as follows.
In Section II, we provide a status of the papers related to
the cyber-security in the environment of CAVs. In Section III,
we present an overview of CAVs. Existing cyber-security risks
and vulnerabilities are surveyed and classified in Section IV.
In addition, the cyber-risk assessment in the environment
of CAVs is summarized. Then, up-to-date corresponding
defense strategies are presented in Section V. Section VI
describes several related security and safety standards for
CAVs. In Section VII, we present challenges and open problems. Finally, we conclude this paper in Section VIII.
II. R ELATED W ORK
Scholars over the world have carried out the research on
the cyber-security in the environment of CAVs. By using
the statistics related to the cyber-security in the environment
of CAVs from January 1, 2013 to November 30, 2020 on
Web of Science,1 we have drawn Figs. 1, 2, and 3 based
on the research directions, countries, and publication years
respectively. As can be seen from Fig. 1, most of papers
focused on the aspects of computer science, engineering,
telecommunications, and transportation for the cyber-security
in the environment of CAVs. From Fig. 2, it can be observed
that USA, UK, and China are the top three countries that
contribute to the papers related to the cyber-security in the
environment of CAVs. We can observe from Fig. 3 that there
is an increasing number of papers related to the cyber-security
in the environment of CAVs since 2013.
1 https://apps.webofknowledge.com/UA_GeneralSearch_input.do?product=
UA&search_mode=GeneralSearch&SID=7AXLTD1C7ABZjZg6YU3&
preferencesSaved=
Fig. 3. The status of the papers related to the cyber-security in CAVs based
on the publication years.
There are several surveys [5]–[13] related to the
cyber-security of CAVs. But, most of them focused on the partial cyber-security risks and vulnerabilities in the environment
of CAVs. As shown in Table I, the attacks in the environment
of CAVs were classified in [5]–[11], [13]. Defense strategies
for potential attacks were pointed in [5]–[9], [11]–[13]. However, the impacts of the potential attacks were only discussed in
[7]–[9], [12]–[14]. The features of potential attacks were only
discussed in [8], [9]. Unfortunately, other attacks, which are
important cyber-security attacks in the environment of CAVs,
are not mentioned in the above surveys. In addition, the above
surveys do not summarize the cyber-risk, which is vital for
CAVs. Furthermore, cyber-security and safety standards can
subsequently be used to motivate a roadmap for addressing the
potential cyber-risks and vulnerabilities in the environment of
CAVs. They should be discussed in the above surveys. There is
an absence of a survey, which can utilise available literature to
identify other important attacks, cyber-risk, and cyber-security
and safety standards in the environment of CAVs.
III. A N OVERVIEW OF C ONNECTED AND
AUTONOMOUS V EHICLES
In this section, we describe wireless access technologies,
framework of CAVs, and vehicles automation, which are
shown as follows.
A. Wireless Access Technologies
Nowadays, there exist lots of usable wireless access
technologies, which can be used for vehicle-to-vehicle and
vehicle-to-infrastructure communications. In the environment
of CAVs, common wireless access technologies include dedicated short range communications, cellular networks, WLAN,
worldwide interoperability for microwave access (WiMAX),
Bluetooth, and satellite communication, which are described
as follows.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
3
TABLE I
C OMPARISON OF E XISTING S URVEY A RTICLES
•
Fig. 4.
The 75 MHz spectrum of dedicated short range communications.
Fig. 5.
The protocol stack of dedicated short range communications.
1) Dedicated Short Range Communications: Most vehicular
communications are based on dedicated short range communications (DSRC) [15]. It is particularly designed for achieving
low latency and high reliability in vehicle-to-vehicle (V2V)
and vehicle-to-infrastructure (V2I) communications.
In different countries and regions, spectrums and standards
are different. In this paper, we only focus on those that
are adopted in North America. DSRC is initially allocated
75 megahertz (MHz) of spectrum at 5.9 gigahertz (GHz)
band by United States Federal Communication Commission
in 1999. As shown in Fig. 4, the spectrum is divided into
one control channel and six service channels. The volume of
every channel is 10 MHz. The channel number begins from
172 to 184. The control channel is the channel 178, which
can be used specially for secure communications. In addition,
channels of 172 and 184 are retained for some secure applications. Other service channels can be used for secure and
non-secure applications. The range of DSRC is at most one
kilometre (km). The data rate of DSRC is up to 27 megabits
per second (Mbps) for the 10 MHz channel. For the 20 MHz
combined channel, its maximum data rate is 54 Mbps.
As shown in Fig. 5, DSRC protocol stack mainly consists
of the IEEE 802.11p family, which is called wireless access
in vehicular environments (WAVE) and IEEE 1609 family.
Detailed protocols are listed and described as follows.
•
IEEE 802.11p physical layer protocol: In this protocol,
each channel is 10 MHz. It is based on orthogonal
frequency division multiplexing. The alternate frequency
between control channel and service channel is 10 Hz.
IEEE 802.11p media access control layer protocol:
According to the type of traffic, this protocol adopts the
enhanced distributed channel access with the quality of
service management.
• IEEE 1609.0 protocol: This protocol defines the structure
of IEEE 1609 standards family.
• IEEE 1609.1 protocol: This protocol specifies data flows,
data resources, fundamental components, device types
which are supported by on board unit (OBU), command
messages, and storage formats.
• IEEE 1609.2 protocol: This protocol depicts the security
and privacy of the vehicle.
• IEEE 1609.3 protocol: This protocol describes routing
service, addressing service, WAVE short messages, and
management information base.
• IEEE 1609.4 protocol [16]: This protocol defines wireless
multi-channel radio operations, which are relied on the
IEEE 802.11p protocol.
• IEEE 1609.11 protocol: This protocol is utilized to support electronic payment formats.
2) 4G/5G Cellular Networks: In 4G cellular networks [17],
they can provide service of mobile ultra-broadband internet
access. Users have the access to various networks without
changing one network to another network manually. In order
to realize the fast transmission in some specified regions,
there exist some available technologies, which include long
term evolution-advanced mobile communication systems and
microcell base stations. As supported by internet protocol
version 6, its data transmission speed can be one gigabit
per second in the communication with low mobility. In addition, the transmission cost per bit of multimedia service is
low. Due to users’ various requirements, the service should be
more differentiated. Users can enjoy the benefits of different
kinds of services simultaneously.
In 2018, the organization of third generation partnership
project defined 5G cellular networks [18], which are the extensions of 4G cellular networks. In 5G cellular networks, a large
amount of multi-input multi-output antennas are integrated
into base stations. For wireless transmission, the technique of
millimeter wave communication is used to offer the bandwidth,
which frequency is hundreds of MHz. There are several
advantages in 5G cellular networks. The main advantage
is that its data transmission rate can be up to 10 gigabits
per second, which is 100 times faster than that of 4G cellular
networks. Another advantage is that its network latency is less
than one millisecond, which is less than that of 4G cellular
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
4
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
networks. Above 4G/5G cellular networks are helpful for the
construction of CAVs.
3) WLAN: WLAN [19] is a wireless communication technology, which can provide a link to the wider internet by
access points with high flexibility. In WLAN, the coverage of
each access point is about 100 meters. The range of a WLAN
can easily be extended by adding one or more repeaters.
WLAN is not limited by the number of physical ports on the
router. Therefore, it can support dozens or even hundreds of
devices. The data transmission rate of WLAN is tens of million
bits per second. However, WLAN is naturally not secure. Any
wireless device can attempt to connect to a WLAN, so it is
important to authenticate its access to the network by using
the WiFi protected access or other techniques.
4) WiMAX: WiMAX [20] is a wireless broadband communication technology, which is designed based on the IEEE
802.16 standard. In WiMAX, the coverage range of wireless
broadband access is at most 50 km for fixed stations. For
mobile stations, the coverage range of wireless broadband
access is between 5 km and 15 km. The frequency of WiMAX
is between 2 GHz and 66 GHz. It can offer the wireless
broadband access for two fixed mobile networks.
5) Bluetooth: Bluetooth is a widely used standard for short
range communications. It was first invented by Ericsson for
replacing RS-232 cable connections. Bluetooth works conventionally between 2402 MHz and 2480 MHz. The proper
operating range for Bluetooth is 10 meters. It can extend up to
100 meters at the price of higher complexity or lower quality
of service. However, there are some security challenges in
Bluetooth. For example, the pairing pin can be eavesdropped
in Bluetooth.
6) Satellite Communication: Satellite communication [21]
can transmit and magnify telecommunication signals. It can
establish communication channels between signal senders and
receivers, which are distributed at different places on earth.
In satellite communication, the data rate of downlink is at
most 1000 gigabits per second. And the maximum data rate
of uplink is 1000 mbps. Its coverage range is between 100 km
and 6000 km. In the environment of CAVs, satellite communication is usually connected with 4G/5G cellular network,
WLAN, etc. It may result in some major security issues. For
example, the broadcast nature of satellite communication is
a security threat. In addition, satellite messages are prone
to burst errors. Hence, the security patch needs to be robust
enough for coping with burst errors.
B. Framework
As shown in the framework of CAVs (Fig. 6), existing
entities include OBU, application unit, road side unit (RSU),
and sensors. They are described as follows.
1) On-Board Unit: Based on the IEEE 802.11p radio protocol [22], OBU is used to exchange messages with road
side units or other OBUs. It is often equipped in a vehicle.
In an OBU, there exists a resource command processor, a user
interface, a special interface that can be used to communicate
with other OBUs, and a network facility that can be used for
short distance wireless communication and resources, which
Fig. 6.
The framework of connected and autonomous vehicles.
include a random access memory for storing and retrieving
data. OBU can provide services, including wireless radio
access, ad hoc and geographic routing, regulation of network
congestion, dependable message transmission, data safety, and
internet protocol mobility.
2) Application Unit: Application unit is usually embedded
in a vehicle. It can be a special device, which is used for
some secure applications. It can also be a general device, for
example, personal digital assistant. Application unit can communicate with the network only by the road side unit, which
is in charge of the whole mobility and network functions. The
communication between the application unit and road side unit
is based on a wired or wireless channel. It may co-exist with
the road side unit in a physical cell.
3) Road Side Unit: As a wave device, the road side unit is
often equipped along two sides of the road or in some special
places, such as road junctions and neighbouring parking lots.
On the one hand, it can be used to expand the communication
scope of CAVs by redistributing messages to other on-board
units and transmitting messages to other road side units. On the
other hand, it can be used in some secure applications, for
example, early warning of traffic accidents or low bridges.
Furthermore, it also can be used to connect the internet.
4) Sensor: Common sensors include ultrasonic sensor,
radar, and lidar, which are described as follows.
The ultrasonic sensor uses high-frequency sound waves to
measure the vehicle distance. The sensor head first releases
sound waves, which frequencies are usually 50 kHz. Then,
it listens for reflected sound waves from the target vehicle.
If it receives the reflected sound waves, the distance can
be computed by using the transmission time between the
ultrasonic sensor and target vehicle.
Radar is a sensor, which consists of a transmitter, a transmitting antenna, a receiving antenna, a receiver, and a processor.
The radar is usually set around the vehicle. In the process
of detecting the target vehicle, the transmitter first generates
electromagnetic waves in the domain of radio or microwaves.
Next, they are emitted and spread in all directions. Then, they
reflect off the target vehicle and return to the receiver. Finally,
according to the received electromagnetic waves, the processor
analyzes the range, angle, position, and velocity of the target
vehicle.
In the lidar, in order to compute the distance of the target
vehicle, its brightness is measured by the pulsed laser light.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
Fig. 7.
5
The potential attack surfaces in connected and autonomous vehicles.
In addition, the reflected pulses are measured for the creation
of the 3D area map. Lidar is helpful for the detection of the
boundaries of roads and identification of lane markings by
using active pulses of light around the vehicle.
C. Vehicles Automation
The concept of autonomous vehicle is visualized and
innovated by science fiction writers firstly. Then, Houdina
Radio Control Company created the first autonomous vehicle
American Wonder in 1925. Since then, vehicle manufactures, high-tech companies, and researchers began to study
autonomous vehicle. Up to now, autonomous vehicle has
arrived at Level 4, which means that the vehicle can perform
all the driving functions under some certain conditions, even
sometimes the driver does not reply to a request.
In vehicles automation [23], necessary components include
sensors, global positioning system (GPS), and camera, which
are described as follows.
GPS can provide an accurate location-based service which
ranges from centimeter to meter. The navigation and localization of vehicles can be achieved by GPS and predefined road
maps. There exist some factors, which may affect the quality
of the received GPS signal. For example, the wideband radio
frequency interference can reduce the effective GPS signal to
noise ratio. Namely, the received GPS signal is attenuated.
There are various approaches, including the advanced antenna
design and signal processing techniques, such as beam steering, null forming, and adjusting radio frequency front-end
gains, which can be used for GPS receivers to enhance the
ability of tracking weak, attenuated, or corrupted GPS signals.
The images, which are collected by the camera, include a
large array of the values of individual pixels. The collected
images are used to detect real-time obstacle, check lane departure, and track roadway information. In addition, in order to
understand low-level images, they are converted into high-level
images by using computer vision algorithms, which consist of
segmentation, classification, and 3D reconstruction.
IV. C YBER -ATTACKS IN C ONNECTED AND
AUTONOMOUS V EHICLES
In the environment of CAVs, we classify existing
cyber-attacks into in-vehicle network attacks, vehicle to everything network (V2X) attacks, and other attacks. In addition,
we summarize the cyber-security risks and vulnerabilities in
the environment of CAVs. As shown in Fig 7, we first identify
the attack surfaces of the vehicle for the implementation of
these cyber-attacks. Attack surfaces of a system are the sum
of different attack points, where the adversary can try to inject
or extract data from the system for compromising the vehicle
security. For example, remote sensor attacks can be implemented by using the compromised radar, which is considered
as an attack surface. Then, these attacks are summarized
in Table II, which is described as follows.
A. In-Vehicle Network Attacks
Existing in-vehicle network attacks include remote sensor
attacks, GPS spoofing attacks, location trailing attacks, close
proximity vulnerabilities, controller area network (CAN) and
society of automotive engineers (SAE) J1939 buses vulnerabilities, electronic control units (ECUs) software flashing attacks,
and integrated business services attacks, which are described
as follows.
1) Remote Sensor Attacks: In the environment of CAVs,
one of the central challenges is that various electrical components, which include ultrasonic radar, lidar, camera, and
other sensors, are connected by an in-vehicle network. Each
type of sensor has its own strength and weakness in terms
of range, detection capabilities, and reliability. Furthermore,
external entities can establish the connection with sensors by
existed wireless access technologies. Hence, compared with
the environment of autonomous vehicles, the adversary in
CAVs is easier to gain access to a vulnerable and peripheral
sensor. Then, the adversary will be able to take control of the
sensor and implement remote sensor attacks.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
6
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
TABLE II
S UMMARY OF VARIOUS ATTACKS IN CAVs
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
Fig. 8.
The model of GPS spoofing attacks.
2) GPS Spoofing Attacks: CAVs rely heavily on GPS, which
provides location and time information. It is the basis of
many key processes, such as pseudonym certificates, basic
safety messages, and timestamps in messages. Truthfulness
and accuracy are critical for CAVs. In GPS spoofing attacks
[24], the adversary manipulates the received GPS signal arbitrarily in the attacked area. It provides fake information to
receivers. In addition, the adversary broadcasts the fake GPS
signal, which signal strength is higher than the true GPS
signal. Hence, GPS receivers ignore the true GPS signal. These
attacks usually happen in the physical layer.
As shown in the model of GPS spoofing attacks (Fig. 8), the
adversary is easy to interfere or replace the low-powered GPS
signal by its stronger fake signal. Thereby, the adversary can
provide any fake time or location to the vehicle in the attacked
range. Then, the vehicle drifts out the desired trajectory.
3) Location Trailing Attacks: In location trailing attacks,
the adversary can obtain drivers’ private information through
locating and tracking their vehicles. With the help of location information, the adversary can discover behaviors and
activities of vehicles, even obtain the profile of the driver and
match to personal privacy in the real world. These attacks may
damage to the transportation-based cyber-physical systems, for
example, the increasing number of congested roads.
In order to protect the privacy, messages are anonymously
transmitted. In addition, pseudonyms are changed frequently.
However, it has been proved that a single pseudonym is not
sufficient to resist location trailing attacks [25]. Specifically,
pseudonymous position samples can be collected and combined into pseudonymous location profiles. Then, an adversary
can easily relate them to specific vehicles. For example,
profiles, which include the same starting/ending location on
weekday mornings, may reveal home and work addresses.
4) Close Proximity Vulnerabilities: Close proximity vulnerabilities are exposed by the short-range communication mechanisms. These vulnerabilities may happen by coincidence.
They can be executed by Bluetooth, tire pressure monitoring
system (TPMS), or keyless entry and ignition systems.
Bluetooth: It has been proved that the Bluetooth control
code contains a potential memory exploit, which allows the
execution of code from any paired Bluetooth device. A compromised device, which has been paired with a vehicle, may
7
attack the vehicle’s engine control units. However, the driver
does not aware of the attack. In addition, many secure
Bluetooth protocols have been designed by cryptographic
algorithms. However, due to the inefficiency of these secure
protocols, most of commercial solutions are not implemented
by them. Furthermore, these secure protocols cannot prevent
the implementation of malicious code by memory exploitation.
Fortunately, they can be used to prevent the implementation
of open source tools, which are used for the analyzation of
packets in the public domain.
a) Tire Pressure Monitoring System: TPMS communications are usually relied on standard modulation schemes
and simple protocols. Because these protocols do not rely on
cryptographic mechanisms, TPMS communications may be
reverse-engineered. In addition, spoofing attacks and battery
drain attacks [26] may cause TPMS to malfunction. TPMS
messages can be received correctly up to 10 meters from the
vehicle with a cheap antenna and up to 40 meters by a basic
low noise amplifier. This means the adversary can overhear
or spoof transmissions from a nearby vehicle. Every in-tire
sensor module includes a 32-bit fixed identifier [27] in each
message. The length of the identifier field renders the identities
of the tire sensor module sufficiently unique to track vehicles
in a low-cost way.
b) Key Fob and Keyless Entry: In order to entry the
vehicle, there are two ways, namely key fob entry and keyless
car entry. The adversary may block the signals of the key fob
when the driver attempts to lock his vehicle by using a number
of different devices, including garage door openers and house
light controllers/dimmers. Once these devices are hidden in
bushes and activated for long periods of time, the signals of
the key fob will be blocked in the whole areas of car parks or
streets.
The adversary cannot block the signal for a vehicle with
the keyless entry. However, this unchanging signal can be
captured and replicated to gain access to a vehicle. And the
alarm and immobilizer can be disabled for allowing thieves to
start and steal vehicles. For example, it has been reported that
the adversary can build an inexpensive and small electronic
device, which can be concealed on or near a locked vehicle.
This device can capture a single keyless entry code for
unlocking the vehicle at a later time. It transmits a jamming
signal to block the vehicle’s reception of rolling code signals
from the owner’s fob, while recording these signals from both
of his two attempts which are needed to unlock the vehicle.
In addition, some alarms and immobilizers are relied on very
weak secret keys. They can be cracked in just a few minutes
by using a laptop.
5) CAN and SAE J1939 Buses Vulnerabilities: Automotive
buses include CAN and SAE J1939 buses, which have following vulnerabilities.
The main problem of CAN bus is the lack of authentication
and encryption [28]. The lack of authentication means that
any unauthorized nodes can join the network and participate
in the communication. The unauthorized nodes can listen to
any messages in the CAN bus. Because these messages are not
encrypted, the adversary can sniff the CAN bus and illegally
collect the driver’s personal information, including mobile
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
8
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
phone, location, and address book. In addition, the adversary
can insert the unauthorized CAN frame to the network.
CAN bus is also vulnerable to the DoS attacks [29]. In CAN
bus, the arbitration mechanism allows the node with the
higher priority to speak first. If a malicious node that has
the highest priority is active all the time, the other nodes
cannot communicate with each other. In addition, DoS attacks
will misuse the error confinement mechanism. If the adversary
generates an error during the communication, it will increase
the error counters and eventually cause the elimination of the
node.
Because SAE J1939 bus is designed based on the CAN
bus, it inherits all the specific vulnerabilities of CAN bus.
One important vulnerability is a consequence of the arbitration
mechanism [30] that allows to implement DoS attacks by
continuously transmitting the frames with the identifier field
set to the value that is as low as possible. In addition, in SAE
J1939 bus, when a message is sent to a specific destination in
the connection mode, the connection can be broken by both
the sender and the receiver. The adversary can interrupt the
connection by sending an abort message, which is directed to
either the sender or the receiver.
6) ECUs Software Flashing Attacks: ECUs are the embedded systems, which can control gear shift, servosteering,
ignition system, electronic window lift, climate controls, etc.
In addition, ECUs are reprogrammable, which is helpful for
correcting bugs and integrating new functionalities without
replacing ECUs. ECU software flashing includes the development, delivery, and installation of software. However, possible
attacks on ECU software flashing [31] include reverse engineering, code modification, fuzzing attacks [32], and phlashing
attacks [33]. Reverse engineering may disclose information.
Code modification may corrupt information and degrade hardware performance. Fuzzing attacks can find vulnerabilities
in the embedded systems. Phlashing attacks can trick a
remote device into allowing you to flash its firmware. Hence,
the machine can never be rebooted. It must be pulled out and
replaced. Phlashing attacks may use unpatched vulnerabilities
in the embedded systems to gain access.
7) Integrated Business Services Attacks: In many vehicles,
the embedded systems can be connected with the back-end
network of the manufacturers. Then, the driver can use
the services that are provided by the manufacturers, such
as remote telediagnosis, entertainment, and remote software
update. However, there exist several attacks in the integrated
business services, namely gaining the client-level access to the
business platform in the vehicle, gaining access to the vehicle
system, and gaining access to the user data.
The adversary can gain the client-level access to the business platform by launching phish attacks [34] or using malicious codes. In addition, the adversary can use the client-level
access to implement another attack, which can obtain the
system-level access to the business platform. If the adversary
can run the arbitrary software on the business platform in
the vehicle, he will control the embedded system and may
gain access to the other vehicle systems. The user may have
personal data risk [35], which is related to a third-party
application, for example online banking.
B. Vehicle to Everything Network Attacks
Vehicle to everything network enables data exchange among
a connected vehicle, other vehicles and the infrastructure of
CAVs. The adversary exploits this type of communication
to expose network access points. Communicating channels
between a vehicle and external devices, for example smartphones, are established through WiFi, Bluetooth, and global
system for mobile communication protocols. Once the vehicles
are connected by the communicating channels, they are vulnerable to the network attacks, which are described as follows.
1) DoS Attacks: DoS attacks [36] happen when the adversary blocks the whole communication channel with interference signals. The adversary inserts useless messages or
creates some issues on the network nodes. Hence, authentic
users cannot access network services. Correct messages cannot
reach their destinations. DoS attacks can cause delay and
interfere the receiver’s response. In the environment of CAVs,
some delay may affect the driving security of the vehicle.
Even one second can cause or avoid an accident. In addition,
the request for response time is comparatively high [37]. DoS
attacks are dangerous and fatal for CAVs.
2) Impersonation Attacks: Every vehicle has an unique
identification, which can help to recognize the vehicle and
the messages. Impersonation attacks [38] are implemented
by using another identity or a fake identity. There are two
kinds of impersonation attacks, namely node impersonation
attacks and sybil attacks. In the node impersonation attacks,
a single identity is spoofed at a time. Different identities
are spoofed simultaneously in the sybil attacks. In addition,
the sybil adversary can carry out several malicious operations,
such as sending fake messages, spreading modified received
messages, and dropping critical messages.
3) Replay Attacks: In replay attacks [39], the adversary
basically records and retransmits early valid packets at a later
time. It often occurs in the network or transport layer. It may
confuse the authorities, mislead the entire traffic, or even
damage the transportation safety. In order to impersonate a
legitimate vehicle or RSU, replay attacks usually happen in
some authorization and key agreement protocols.
4) Routing Attacks: Routing attacks exploit the drawback and vulnerability of routing protocols. In these attacks,
the adversary can disturb the normal routing process or drop
passing packets. Routing attacks include black hole attacks
[40], grey hole attacks [41], and wormhole attacks [42]. Black
hole attacks can be launched by a single compromised node or
some cooperative nodes. In the grey hole attacks, the adversary
drops packets in a selective manner. In addition, it can switch
from correct behaviors to the behaviors that are performed as
if by a black hole. Due to its occasional correct behaviors,
grey hole attacks are difficult to be detected. In the wormhole
attacks, there are at least two cooperative nodes, which can
form a private high speed tunnel. The adversary captures
packets at a location. Then, they are tunneled to another
location.
5) Data Falsification Attacks: For guaranteeing road safety
and avoiding accidents, one essential requirement of vehicular
communication is truthfulness. The fake information will
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
mislead receivers’ reaction and result in fatalities. In the data
falsification attacks [43], the adversary can send or broadcast false information and safety alerts. Message tampering,
suppression, fabrication, and alteration may produce the fake
message. For example, Jie et al. [44] pointed that data falsification attacks can effectively disrupt route guidance mechanisms,
cause significant traffic congestion, increase traveling time,
and result in the imbalanced usage of transportation resources
in transportation-based cyber-physical systems.
6) Eavesdropping Attacks: Eavesdropping attacks [45] are
implemented by overhearing the wireless medium. These
attacks are also known as stealth attacks. In these attacks,
the adversary monitors the traffic of network and the particular victim’s current positions and activities silently. Then,
the adversary can gather private information of CAVs. The
difficulty of detecting these attacks is that the victim is not
conscious of it. There is no direct impact in the network.
7) Password and Key Attacks: Password and key attacks are
quite complicated to be performed. They usually need some
special hardwares and softwares. These attacks are possible to
be executed for some financial reasons. In password and key
attacks [7], the mechanism is tested by different values until
it can be compromised. Finally, the password or key may be
cracked. These attacks can be classified into three categories,
namely dictionary attacks, rainbow table attacks, and brute
force attacks. In the dictionary attacks, the adversary uses
a list of words to crack the password repeatedly. Other two
kinds of attacks are similar with dictionary attacks. However,
in the rainbow table attacks, the adversary uses a list of
precomputed hashes, which are computed from all the possible
passwords and the given algorithm. The brute force attacks
can identify non-dictionary words by working through all the
alpha-numeric combinations.
C. Other Attacks
Other attacks include infrastructure attacks, slight attacks,
and attacks on machine learning systems, which are described
as follows.
1) Infrastructure Attacks: CAVs are likely to require the
development of new transportation infrastructure. In addition,
vehicle manufacturers should cope with the resulting compatibility issues between the infrastructure and autonomous
vehicles. In the infrastructure of CAVs, existed entities include
road side unit, on board unit, cloud server, intelligent traffic
light and signal, traffic camera, traffic management center, etc.
It is worthy to consider the interactions among these entities
for studying the attack surface of autonomous vehicles. In [46],
it has been pointed that there exist multiple connections among
autonomous vehicles and the infrastructure in the environment
of CAVs. Then, there are many entry points, which can be
exploited for the adversary. These connections can increase
the risk of intrusion. Because an issue in a vehicle can involve
accidents with other vehicles that are communicating with
this vehicle, it will also increase the risk that a coding bug
can cause widespread damage. Based on the compromised
traffic lights and on board units, Liu et al. [47] simulated
several attacks on the vehicle traffic in the smart transportation
9
system. The authors argued that many vehicles were locked
in a specific area for a long time. The advanced density-based
attacks can achieve better performance with fewer compromised vehicles to disrupt the whole network.
In the environment of CAVs, the vehicle is connected to
the infrastructure, it can send a signal phase and timing
message to the vehicle for knowing the status of the light and
when it is going to change. If the adversary takes control of
the infrastructure, false messages will be sent to the vehicle
for threatening its security. Furthermore, CAVs applications
require interactions with the cloud server. Cloud service will
introduce cyber-security concerns, including data theft, cyber
attacks, compliance with data protection, and privacy regulations. For example, cloud service will add some vulnerabilities
to the infrastructure of CAVs [48]. The adversary can use the
vulnerability, which is related to message transfer, to cut off
the communication in the infrastructure of CAVs.
Hence, more detailed reference architectures and threat
models should be used to analyze cloud in depth. Juliadotter
and Choo [49] pointed that the top level of the cloud attack taxonomy is comprised of five dimensions. Alhebaishi et al. [50]
conducted comprehensive threat modeling exercises based
on two representative cloud infrastructures by using several
popular threat modeling methods, including attack surfaces,
attack trees, attack graphs, security metrics based on attack
trees, and attack graphs, respectively.
2) Slight Attacks: Ye et al. [51] first proposed the concept
of slight attacks for CAVs. In these attacks, the communicated
data are randomly deviated from the actual ones. In addition,
deviations do not exceed the threshold. If the error between
expected and measured behaviors exceeds a predetermined
threshold, a security scheme will be activated. In this case,
the predetermined security mechanism may be useless. Even
slight attacks may cause hazardous conditions and result in
serious safety problems for all the vehicles in a CAVs fleet.
The authors pointed that when CAVs are under slight attacks,
it is more dangerous if communicated positions are attacked
than speeds. It is possible that a situation with more vehicles
under attack at a low severity may be more dangerous than
that with fewer vehicles but under attack at a high severity.
3) Attacks on Machine Learning Systems: In the environment of CAVs, machine learning systems can be used for some
security-sensitive tasks, including security monitoring and
vulnerability detection. However, machine learning systems
have limitations [52], and may be attacked in the phases of data
collection, training, and prediction. There are some attacks on
the machine learning systems, including data poisoning attacks
[53], attacks on the learning algorithm and its libs [54], escape
attacks [55], model steal attacks [56], and model inference
attacks [57].
In data poisoning attacks, the adversary can modify the
original training data or insert some malicious data, which will
affect the decision of the machine learning algorithm. In the
attacks on the learning algorithm and its libs, the adversary
can modify the training algorithm and leak the user’s private
information without affecting the accuracy and generalization
of the machine learning model. The main idea of escape
attacks is to craft inputs that will be misclassified by a machine
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
10
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
learning model. In the model steal attacks, the adversary can
obtain the internal parameters of the machine learning model,
some pre-knowledge of training data, or a machine learning
model that is very close to the targeted model. Based on the
combination of the output result and black-box access, model
inference attacks can extract some private information about
the training data.
D. Cyber-Risk
Cyber-risk is defined as the risk of financial loss, disruption
or damage to the reputation of an organization from some sort
of failure of its information technology systems [58]. Due
to persistent digital innovations, intensifying global connectivity, and increasing sophistication of hackers, cyber-risk is
actually dynamic. Because of the fast pace of technological
innovations, potential risk exposure, and the lack of historical
claims data, cyber-risk becomes a complex phenomenon for
CAVs. Hence, a comprehensive cyber-risk analysis and assessment method should be designed to discover, understand, and
address any vulnerability in each component [59]. In addition,
Sheehan et al. [60] pointed that traditional risk assessment
techniques are not effective. Maple et al. [61] found that
existing approaches are either too simple for sufficiently
detailed modelling or require too many details to be specified
for analyzing the attack surface of CAVs.
V. D EFENSE S TRATEGIES
In this section, in order to resist above cyber-security risks
and vulnerabilities in the environment of CAVs, we analyze
corresponding defense strategies. These strategies are summarized in Table III, which is described as follows.
A. Against In-Vehicle Network Attacks
In order to defend in-vehicle network attacks, based on the
types of these attacks, there are following strategies.
1) Against Remote Sensor Attacks: In order to defend
remote sensor attacks, there are several efficient solutions,
including authentication [62], [63], consistency check [62],
sensor fusion [64], [65], and spatio-temporal challengeresponse [66].
In order to improve the security of ultrasonic sensors,
Xu et al. [62] proposed two defense strategies, namely single
sensor-based physical shift authentication which is used for
verifying signals on the physical level, and multiple sensor consistency check that multiple sensors are employed
to verify signals on the system level. In order to defend
sensor spoofing attacks, Matsumura et al. [63] proposed a
solution that authentication fingerprint is superimposed onto
light wave itself. In order to counter sensor interference [116],
sensor fusion and backup cameras [64] are used to verify
the legality and precision of ultrasonic sensor measurements.
Kapoor et al. [66] used the technique of spatio-temporal
challenge-response to detect and stop sensor spoofing attacks
by verifying physical signals in the analog domain. In 2019,
Miura et al. [117] used random-chirp modulation to defend a
low-cost distance-spoofing attack on a mmWave Frequency
Modulated Continuous Wave radar. In [65], the sensor fusion
technique, which intelligently combines data from various
sensors to improve performance, is used to defend lidar
spoofing attacks. The influence of remote sensor attacks can
be reduced by modifying the internal sensing structure of the
lidar.
2) Against GPS Spoofing Attacks: In order to defend GPS
spoofing attacks, there exist several strategies, including bias
estimation range check [67], velocities consistency check
[68], statistical test [69], least absolute shrinkage and selection operator [70], and global navigation satellite system
augmentation [71].
In [67], bias estimation range check and the backtracking
mechanism are used for the detection and mitigation of GPS
spoofing attacks. Based on the consistency check of velocities,
Tao et al. [68] proposed an efficient GPS spoofing detection
mechanism, which does not need any other aids. In [69], a statistical test strategy is used to defend GPS spoofing attacks.
Based on the least absolute shrinkage and selection operator,
Schmidt et al. [70] proposed a detection and classification
mechanism for single antenna receivers. Based on the global
navigation satellite system augmentation, Jeong et al. [71]
proposed a GPS spoofing detection method, which has the
advantage that it can be used for a receiver directly.
3) Against Location Trailing Attacks: In order to defend
location trailing attacks, there are several methods, including
k-anonymity [72], mix-zone [73], software defined networks
[74], location perturbation [75], and perturbation-hidden [76].
In [72], the k-anonymity technique is used to obfuscate
the user’s physical locations, which can enhance the user’s
location privacy and can also enjoy the accurate location
services. Zhou and Zhang [73] proposed a mix-zone framework for protecting the actual locations of mobile users.
Boualouache et al. [74] proposed a cost-efficient vehicular
location privacy zones placement method, which is based
on the concept of software defined networks. In order to
protect the location privacy of location-based services in
vehicular networks, Luo et al. [75] designed an improved
location perturbation mechanism. A new privacy definition,
namely perturbation-hidden, is proposed [76] to provide a
stricter privacy guarantee for location-based services than
geo-indistinguishability [118].
4) Against Close Proximity Vulnerabilities: In order to
defend close proximity vulnerabilities, there are several available strategies, including encryption and cryptographic checksum, which are described as follows.
a) Bluetooth: Several secure Bluetooth protocols have
been developed by cryptographic techniques. However, most
of commercial products do not adopt these secure protocols,
which have adverse effects on the usability. These secure
protocols use the cryptographic algorithm to establish trust.
They will defend the attack of using some open source tools,
for example, Bluesniff [119]. Unfortunately, they do not take
measures to prevent the execution of malicious nodes by
memory exploitation.
b) Tire Pressure Monitoring System: There are several
methods that can improve the dependability and security
of TPMS. Firstly, the software that runs on TPMS should
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
11
TABLE III
S UMMARY OF D EFENSE S TRATEGIES IN CAVs
obey basic reliable design principles [120]. Secondly, TPMS
packets should be encrypted by a light-weight cryptographic
algorithm. In addition, an extra sequence number field should
be added to the packet for insuring the freshness of the packet.
Furthermore, in order to prevent message forgery, an extra
cryptographic checksum should be added prior to the Cyclic
Redundancy Check checksum.
c) Key Fob and Keyless Entry: Once the key fob has been
activated, the driver needs to ensure the lights have flashed,
which indicates the vehicle has received the signal. Then,
the driver checks whether the vehicle is locked by lifting a
door handle. In premium Audi RS4 vehicles, if the adversary
gains the physical access to vehicles, it is able to add a new
key into the system [121]. Although this is a premeditated
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
12
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
sophisticated attack, Audi has dismissed any liability. Scholars
from University of Birmingham [122] developed techniques
of cracking mechanisms, which can be used for keyless entry.
However, they were prevented from publishing their research
result by united kingdom government.
5) Against Can and SAE J1939 Buses Vulnerabilities:
In order to defend the vulnerabilities in the CAN and SAE
J1939 buses, there are some solutions, including network
segmentation, encryption [77], and authentication [78], [79].
The network segmentation is an easy way to provide security for the CAN bus. Then, critical and non-critical ECUs are
separated. The adversary cannot access critical ECUs easily.
The connection between networks is based on a gateway
ECU. However, the gateway ECU may be manipulated. If the
gateway ECU is programmed to transmit related identities
to the subnetwork, it can be fooled by passing a malicious
CAN frame with an identity of a node that belongs to the
subnetwork. Besides, the network segmentation may increase
the difficulty of maintenance.
There are various software-based encryption mechanisms,
for example, Trillium [77]. However, some mechanisms are
not secure. Because ECUs do not have the strong computational capability, software-based encryption mechanism may
cause latency. It will not be acceptable for the safety-critical
vehicle. In addition, it may be restricted by the limited bandwidth. Software-based encryption mechanism may be suitable
for a limited CAN traffic.
Some scholars have studied on authentication mechanisms.
Based on an ordered Cypher-based Message Authentication
Code buffer, Groza et al. [78] authenticated the identifiers of
CAN frames and checked whether the sender is a legal node
while remaining unchanged arbitration on the bus. In order to
mitigate the weaknesses in the existing frame-level authentication mechanism, Palaniswamy et al. [79] proposed a new
protocol suite, which provides the security of session key.
In order to defend the shortcomings in the SAE J1939 bus,
Murvay and Groza [30] proposed an authentication scheme
and evaluated its effects by using the CAN with flexible
data-rate frames to transmit the additional authentication data.
There are some available intrusion detection methods.
Desta et al. [123] proposed an intrusion detection system for
CAN bus by analyzing arbitration identity sequences. Based on
the usage of a trained Long Short Term Memory, this system
can predict an arbitration identity, which will appear in the
future by reviewing the last twenty packet arbitration identities.
Olufowobi et al. [124] proposed a specification-based intrusion
detection system by the usage of anomaly-based supervised
learning with the input of the real-time model.
6) Against ECUs Software Flashing Attacks: In order
to defend ECUs software flashing attacks, there are some
strategies, including encryption [80], authentication [81], and
integrity check.
Reverse engineering may destroy the confidentiality of ECU
data, ECU data should be encrypted [80]. Therefore, the adversary cannot read them. Authentication [81] can identify the
origin of the software correctly. Integrity [125] is important
for preventing software modification by unauthorized users.
Hence, every ECU should check the integrity. Nonrepudiation
is helpful for tracking the software version that has been
installed, installation time, and who installed the software.
Then, the adversary is difficult to implement malicious software flashing.
7) Against Integrated Business Services Attacks: In order to
defend integrated business services attacks, there exist several
strategies, including content filtering [82], data separation and
trusted path, and software or hardware virtualization [83].
Based on the usage of a program, content filtering can block
the access to some items, which may be harmful if they are
opened or accessed. It can be used to defend malicious codes
and phish attacks. Data separation provides a boundary among
applications. Then, the implementation of malicious codes is
limited to a single domain. Data separation involves either high
reliability software development or machine virtualization. The
security level is based on the quality of data separation. The
trusted path should be implemented in a manner, which is
outside of the applications control. Software or hardware virtualization is an useful tool for maintaining secure separation.
Software virtualization’s reliability level is less than that of
hardware virtualization. However, software virtualization may
be subjected to safety risks and performance degradation. One
benefit of software virtualization is that it does not need a
special hardware.
B. Against Vehicle to Everything Network Attacks
In order to defend vehicle to everything network attacks,
based on the types of these attacks, there are following
strategies.
1) Against DoS Attacks: DoS attacks are difficult to be
corrected even though they can be detected. Early detection
will be helpful to thwart the attacks or alert the driver to take
some efficient measures. To resist DoS attacks, there are some
strategies, including sliding mode and adaptive estimation
[84], bandwidth and entropy [85], and similarity of sliding
windows [86].
A real-time mechanism [84], which includes a set of
observers that are designed by the usage of sliding mode
and adaptive estimation theory, can be used to detect the
occurrence of DoS attacks, and estimate the effect of these
attacks on the connected vehicle system. Inspired by the
port-hopping mechanism, Jie et al. [126] designed a simple but
effective defense mechanism, which has the advantage that the
detection and filtering out of malicious packets can be implemented without any change in the existing protocol. Based on
the usage of bandwidth and entropy, Kumar and Mann [85]
proposed an algorithm for the detection of DoS attacks in
vehicular networks. Then, the authors proposed a packet detection algorithm that can be used for preventing DoS attacks.
Based on the similarity of sliding windows, an improved DoS
attacks detection strategy [86] is designed to detect each type
of DoS attacks.
2) Against Impersonation Attacks: In order to defend impersonation attacks, there are some available strategies, including secure transmission [87], [88], integrity verification [89],
authentication [90], [91], and secure key agreement [92].
Limbasiya and Das [87] designed a secure geo-data transmission mechanism for vehicular ad-hoc network, in which
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
vehicles can transmit data with the higher probability. This
mechanism is protected against impersonation attacks. In [89],
the proposed hash-based integrity verification mechanism can
defend impersonation attacks effectively in vehicular cloud
computing. Li et al. [90] proposed a certificate-less conditional privacy-preserving authentication protocol, which supports both privacy and security requirements in the internet
of vehicles system. It has been proved that this protocol is
secure against impersonation attacks. Park et al. [92] designed
a dynamic secure and lightweight key agreement protocol
for vehicle-to-grid in social Internet of Things. Limbasiya’s
secure V2V data transfer protocol [88] uses a one-way hash
function to transmit valuable data at the receiver side quickly.
Sutrala et al. [91] designed a novel conditional secure authentication mechanism by using Elliptic Curve Cryptography in
the internet of vehicles.
3) Against Replay Attacks: In order to thwart replay attacks,
available strategies include noisy control signal method and
cross correlator [93], reset controller [94], and techniques of
timestamping and XOR encoding [95].
Based on the usage of noisy control signal method and
cross correlator, Merco et al. [93] used a decentralized diagnosis algorithm to detect the replay attacks for a cooperative
adaptive cruise control connected vehicles system. In order
to defend replay attacks in the unmanned aerial vehicles,
Sànchez’s [127] frequency-based detection mechanism utilizes
a sine wave with the time-varying frequency as the authentication signal. In order to preserve the oscillation damping ability
and improve the speed tracking ability of a connected car
under a replay attack, combined with a robust reset controller,
Xu et al. [94] proposed a dynamic output-feedback robust controller. In Oza’s alternative threshold-based detection method
[128], the detector observes the occupancy sensor data over
time. Greene et al. [95] proposed an improved remote keyless
entry system by using timestamping and XOR encoding. This
system can countermeasure the replay attacks.
4) Against Routing Attacks: In order to defend the routing
attacks, there are some strategies, including ant colony optimization [96], swarm algorithms of artificial intelligence [97],
variable control chart [98], and trust calculation [99].
Based on the ant colony optimization method, Panda and
Kumar Pattanayak [96] proposed a multi-path intelligent
routing protocol, which can find an optimal path from the
sender to the receiver along with the increasing lifetime of
the network. Based on the usage of swarm algorithms of
artificial intelligence, Krundyshev’s new method [97] is used
for providing security for vehicular ad hoc networks and other
kinds of networks that are related to transportation. In order
to defend the routing attacks in CAVs, Hassan et al. [129]
proposed an intelligent detection scheme. Based on a variable control chart, a new detection mechanism [98] is
designed for vehicular ad hoc networks. Bhawsar et al. [99]
proposed a mechanism by using the ad hoc on-demand
distance vector routing protocol that is relied on trust
calculation.
5) Against Data Falsification Attacks: For the detection of
data falsification attacks, there are various strategies, including
location detection [100], dynamic time window [43], forged
13
data filtering [44], reputation threshold [101], and information
sharing [102].
Boeira et al. [100] studied that how a location detection
mechanism can be used to alleviate the location falsification
attacks before it can result in a crash among an array of
coordinating vehicles. Based on the usage of dynamic time
window, Shukla and Sengupta [43] proposed an anomaly
detection strategy. In [44], the forged data filtering mechanism,
in which the falsified traffic state data can be removed during
data transmission in vehicular networks, is used to mitigate
the data falsification attacks. Based on the obtained reputation
threshold, a novel cooperative spectrum sensing mechanism
[101] is designed to be robust against the data falsification
attacks under the imperfect common control channel. In
order to improve the reliability and support the detection
of anomalous behaviors, Alotibi and Abdelhakim [102]
applied the information sharing technique in the cooperative
adaptive cruise control model, which allows vehicles and fixed
infrastructure to obtain and share information about platoon
leaders.
6) Against Eavesdropping Attacks: In order to prevent the eavesdropping attacks, there are some strategies, including anonymization [103], resource management
[104], trust-based recommendation [105], and scheduling
mechanism.
In order to defend the eavesdropping attacks on the vehicles’
queries, a fog server with the fog anonymizer [103] is used to
anonymize the messages from the fog node. In order to defend
the eavesdropping attacks on vehicular users’ computation
offloading over radio frequency channels, based on the
measurement of the physical layer security, Wu et al. [104]
researched the resource management that has secrecy provisioning. Li et al. [130] designed a Nash equilibrium method of
the game under the imperfect channel estimation for maximizing the efficiency of the transmitter and suppressing the eavesdropping attacks from the unmanned aerial vehicle. To ensure
real-time data transmission and security in a vehicular cyber
physical systems network, a new trust-based recommendation
mechanism [105] is proposed to defend the eavesdropping
attacks.
7) Against Password and Key Attacks: In order to defend
password and key attacks, there are some available solutions,
including secure cryptographic mechanisms and multifactor
authentication [106].
One solution is relied on the secure cryptographic mechanisms, such as keys with large sizes, secure algorithms,
and secure passwords. Although some cryptographic algorithms are secure now, they may be cracked easily by the
powerful computational ability in the future. Instead of relying on the secure cryptographic mechanisms, another solution is the multifactor authentication, which puts different
layers of identity security on every account. Multifactor
authentication monitors diverse factors, including time of
access request and geolocation. In addition, it can incorporate biometric authentication and hard tokens. Multifactor
authentication can mitigate the effectiveness of password
and key attacks. It may not prevent all password and key
attacks.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
14
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
C. Against Other Attacks
In order to defend other attacks, based on the types of these
attacks, there are following strategies.
1) Against Infrastructure Attacks: In order to defend
the infrastructure attacks, there are several efficient strategies, including cyber-security architecture [107], secure
aggregation [108], software defined security [109], and
authentication [110].
In [48], the cloud-based method is used to detect
and mitigate cyber-attacks in the infrastructure of CAVs.
Islam et al. [107] designed a new vehicle-to-infrastructure
cyber-security architecture, which can detect and prevent
cyber-attacks on the vehicle-to-infrastructure applications.
However, there are some key challenges of designing this
architectures, such as scalability, resiliency, and future usability. In [108], a light-weight and secure aggregation protocol is
designed for the fog computing-based vehicle-to-infrastructure
communication. By using the proposed protocol, the road side
unit can securely obtain the data that are collected by the
vehicles. In order to provide sufficient levels of protection for
the infrastructure of CAVs, software defined security [109] can
be used by abstracting security mechanisms from the hardware
layer to a software layer. Based on the bilinear map, Ali and
Li [110] designed an efficient and secure identity-based conditional authentication signature mechanism for the vehicleto-infrastructure communication.
2) Against Slight Attacks: In order to resist slight attacks,
Li et al. [51] focused on the influence of slight attacks
on the longitudinal safety of CAVs. More specifically, the
authors considered the communicated position and speed data
from preceding CAVs. An empirical model is first utilized
to describe dynamics of CAVs. Then, a rear-end collision
risk index is introduced to establish the relation between
longitudinal safety and vehicles’ dynamic data. Parameters
are also investigated via sensitivity analysis. Furthermore, the
authors pointed that slight attacks on communicated position
have more serious effects on longitudinal safety than on speed.
The defenses may focus on how to detect the imprecise
position data. Although vehicle equipped sensors can also
detect preceding vehicles’ position, the time delay of current
sensors is much larger than that of wireless communication.
The defense scheme should be considered over the whole
CAV fleet instead of on individuals. A coordinated defending
method, which regards all vehicles, is more robust than isolated defenses. The defending scheme should not be the same
in the whole driving period. It is evident that the deceleration
period has more risks. Hence, more rigorous schemes should
be utilized in this period. A multi-period defending method is
more suitable in that case.
3) Against Attacks on Machine Learning Systems: In order
to defend attacks on machine learning systems, there are
several efficient solutions, including data sanitization [111],
algorithm robustness improvement, homomorphic encryption
[112], and differential privacy [113].
Data poisoning attacks can be resisted by using the data
sanitization technique [111] or improving the robustness of the
machine learning algorithm against malicious training data.
Hunt et al. [131] used a system, which is called Chiron,
to conceal the training data from the service operator. The
passive defense or active defense strategy can be used to
defend the escape attacks. The passive defense strategy is
to detect the adversarial example after the construction of
the machine learning system. The active defense strategy is
to construct a robust machine learning system before the
generation of the adversarial example. In order to defend the
model steal attacks, one method is to restrict the model user
that only has the black-box access. The user who provides the
training data can inquiry the model and obtain the prediction
result. In order to defend the model inference attacks, available
techniques include homomorphic encryption [112] and differential privacy [113]. Homomorphic encryption can guarantee
that data are encrypted in the training phase. Based on the
usage of differential privacy, the machine learning algorithm
carefully adds noise to protect the security of data.
D. Cyber-Risk Assessment
In order to assess cyber-risk in the environment of CAVs,
there are several efficient solutions, including vulnerabilities assessment [114], dynamic risk management [115], and
cyber-attacks classification [60].
An available mechanism, which can be used for assessing
the vulnerabilities in the environment of CAVs, is called
common vulnerability scoring system (CVSS) [114]. In 2011,
CVSS version 2.0 is regarded as an international standard
for assessing vulnerabilities by International Telecommunications Union. The U.S. National Institute of Standards and
Technology provided National Vulnerability Database (NVD),
which includes a large repository of known vulnerabilities.
In [115], a profile-driven approach is proposed to manage
internet of things data in the context of CAVs by a dynamic
risk management framework. Unlike the current inflexible
risk assessment strategies, this framework encourages more
flexible investigation of risks by different risk profiles. Based
on a Bayesian network model, Sheehan et al. [60] designed
a proactive cyber-attacks classification method for CAVs by
incorporating existed software vulnerabilities, which are contained within NVD, into model building and testing phases.
Maple et al. [61] proposed a reference architecture by using
a hybrid functional-communication viewpoint for cyber-risk
surface analysis of CAVs.
VI. C YBER -S ECURITY AND S AFETY
S TANDARDS OF CAV S
Except for the above defense strategies, several
cyber-security and safety standards have been designed
for CAVs, including International Organization for
Standardization (ISO) 26262 [132]–[134], SAE J3061
[135], and British Standards Institute’s standard [136], which
are described as follows.
A. ISO 26262
ISO 26262 is derived from International Electrotechnical
Commission 61508, which is used for electrical safety-related
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
systems. This standard provides a safety lifecycle in the phases
of management, development, production, operation, service,
and decommissioning. In addition, it supports tailoring necessary activities in these phases. It includes ten parts, including
vocabulary, management of functional safety, product development, supporting processes, automotive safety integrity level
(ASIL), etc. ASIL is determined by severity classification,
exposure classification, and controllability classification. It can
quantify the severity of an injury, probability of occurrence,
and controllability of the situation. To assess ASIL, available
techniques contain hazard analysis, risk assessment, fault tree
analysis, failure mode, and effects analysis.
In 2018, ISO 26262 was revised by adding rules for
trucks, buses, trailers, semitrailers, and motorcycles [137].
In addition, the revised standard includes the guidance on
model-based development, software safety analysis, dependent
failure analysis, semiconductors, fault tolerance, safety-related
special features, and software tools. Furthermore, the revised
standard also contains extended vocabulary, detailed objectives, objective-orientated confirmation measures, information
on managing safety anomalies, references to cyber-security,
updated values for hardware architecture metrics, and methods
of evaluating hardware elements.
B. SAE J3061
Based on ISO 26262, SAE J3061 identifies the growing
threat landscape. This standard establishes the terminology of
threat, vulnerability, and risk, which provides an overview and
distinction between system safety and system cyber-security.
In addition, it presents some general guiding cyber-security
principles, which are applicable to any organization within
a company. As with system safety, cyber-security must be
built into features. Hence, it requires an appropriate lifecycle
process from concept phase through production, operation,
service, and decommissioning. Furthermore, it provides information on some common existing tools and methods for
designing, verifying, and validating cyber-physical vehicle
systems. Then, the foundation is presented for further standards development activities in vehicle cyber-security. Last
but not the least, appendices provide additional information
which may be helpful for improving cyber-security of feature
designs.
In SAE J3061, for maintaining consistency between safety
and cyber-security, there are some suggestions, which include
building appropriate checkpoints into the product lifecycle of
both processes, using a risk analysis method to address threats,
and identifying various paths between safety and cybersecurity. In addition, it points out that a cyber-security-critical
system may be not safety-critical.
C. British Standards Institute’s Standard
In 2018, British Standards Institute published a new cyber
security standard [136]. In this standard, principles of system
security include three aspects, which are shown as follows.
Firstly, personal accountability is held at the board level
for product and system security. In addition, it is delegated
15
appropriately and clearly throughout the organization. Awareness and training is embedded into a “culture of security” for
ensuring individuals’ understanding of their role and responsibility in security of CAVs. All aspects of security (physical,
personnel, and cyber) should be integrated into the product and
service development process. Secondly, security risk assessment and management procedures should be in place within
the organization. Appropriate processes for identification, categorization, prioritization, and treatment of security risks,
including those from cyber, should be developed. Thirdly,
incident response plans are in place. Organizations plan for
how to respond to potential compromise of safety critical
assets, non-safety critical assets, and system malfunctions.
It also should be considered that how to return affected systems
to a safe and secure state. An active program should be able
to identify critical vulnerabilities. Appropriate systems can
mitigate them in a proportionate manner. Organizations should
ensure their systems are able to support data forensics and the
recovery of forensically robust and uniquely identifiable data.
In this standard, principles of secure system design include
five aspects, which are shown as follows.
• The organizations, which include sub-contractor, suppliers, and potential third parties, should work together to
enhance the security of the system. They must be able
to provide assurance, such as independent validation or
certification, of their security processes and products.
In addition, they jointly plan for how systems will safely
and securely interact with external devices, connections
(including the ecosystem), services (including maintenance), operations, or control centers. This may include
agreeing standards and data requirements.
• The security of the system does not rely on single
points of failure. The security architecture uses defencein-depth and segmented techniques to mitigate risks
with complementary controls, such as monitoring, alerting, segregation, reducing attack surfaces (such as open
internet ports), trust layers, and other security protocols. In addition, remote and back-end systems (for
example, cloud server), which might provide access
to a system, have appropriate levels of protection and
monitoring mechanism for preventing the unauthorized
access.
• The security of all software should be managed throughout its lifetime. Organizations should adopt secure coding
practices to manage risks from known and unknown
vulnerabilities in the software proportionately. It must be
possible to ascertain the status of all software, firmware,
and their configuration, including the version, revision,
and configuration data of all software components. The
software should be updated safely and securely. If the
software becomes corrupt, it should be returned to a
known good state. In addition, the software should adopt
open design practices.
• Data must be sufficiently secure and can be controlled in
storage and transmission. Only the intended recipient or
system functions can receive and access them. Incoming
communications are considered unsecure before validation. Users are able to delete sensitive data, for example
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
16
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
personal identifiable data. Furthermore, personally identifiable data must be managed appropriately.
• The system should be able to resist receiving corrupt,
invalid or malicious data and commands by its external and internal interfaces, while remaining available
for primary use. If safety-critical functions are compromised or ceased to work, systems are still resilient and
fail-safe. The mechanism is proportionate to the risk.
If non-safety critical functions fail, the system should
respond appropriately.
VII. C HALLENGES AND O PEN P ROBLEMS
In this section, we describe some important and challenging
problems. In addition, we outline several possible research
directions.
A. Dynamic Risks
under development, related security attacks may start after
a couple of years. The good news is that being-developed
5G security features are well defined and heavily rely on
authentication and encryption. Nonetheless, its effectiveness
needs to be tested thoroughly before and after CAVs are
deployed in the field. In addition, security protocols may need
to be updated later.
E. Testing Standard
For the cyber-security of vehicle systems, they are tested
strictly before they are used by consumers. However, there
is no unified standard for testing. In addition, manufacturers
usually choose their own testers. Although there exist some
guidelines for testing, they need to be revised for various
complicated situations. Furthermore, testing can only find
some easy vulnerabilities in vehicle systems. An adversary
may intrude vehicle systems by trying all the possible methods.
As a moving system, the environment of CAVs is changing
frequently. As shown in Section V-D, extensive research has
been carried out on cyber-risk assessment of CAVs. However,
there is little study which can efficiently tackle dynamic risks
that CAVs are facing with. Besides, given that cyber-risk
assessment has the advantage of updating and viewing the
risks from different angles, it is interesting to explore that
whether it can be used to predict the unknown threats in the
future.
F. Data Collection and Storage
B. Lightweight Security Model
In order to hide trade contents and transaction relationships,
it is interesting to use zero-knowledge proof for the verification
of vehicle data. However, zero-knowledge proof confronts with
the issue of inefficient performance. For example, the execution time of the prover algorithm is excessively long. Hence,
some efforts are needed for exploring efficient implementation
of zero-knowledge proof in the environment of CAVs.
Because the road entities in the V2X communication
have various capabilities and resources, the security model
should always consider the efficient use of devices’ resources.
An example is the power consumption, because they were
implemented on vehicles which have a long life battery, all current security models did not consider the power consumption
as a challenge. However, in V2X communication, some road
entities, such as mobile phones, have a limited battery. Therefore, it is an essential task to achieve the trade-off between
devices’ resources and security level in the environment of
CAVs. As a result, a lightweight security model is necessary
for V2X communication.
C. Trust Levels
In the environment of CAVs, if any single trusted component exists, single point of failure will manipulate the
whole security of the system. Defenders should put redundant
security resources in different components to cross-check each
other. However, when attackers manipulate more than one
component, they may also be able to compromise the crosscheck. Therefore, it is necessary to design proper trust levels
in each component. When there are inconsistencies between
them, designed trust-levels will decide which components are
in favour for making security decisions.
D. 5G Cellular Based V2X Security
The security of 5G cellular based V2X (C-V2X) is another
important research area. Since 5G C-V2X products are still
Based on collected data from vehicles, judicial agencies and
law enforcers can investigate evidences and guilty parties for
some traffic accidents. For the effectiveness of investigation,
data should be collected in a pattern, which can form the intact
evidence-chain. Then, data should be stored in a format, which
can be accessed securely and independently.
G. Zero-Knowledge Proof
H. Blockchain
As a research hotspot, blockchain can guarantee that transaction data are impossible to be tampered, forged, or discarded
by the adversary. Hence, in the environment of CAVs, the privacy of vehicle data can be protected by using the blockchain
technique. However, most blockchains cannot support a large
amount of users. In addition, there is no available standard
for the seamless communication among various blockchains.
Furthermore, the consensus mechanism requires tremendous
computation power, which will affect the operating efficiency
of the system.
I. Spectrum Sharing
US Department of Transportation used the spectrum sharing
method [138] in the 5.9 GHz DSRC band. In this method,
before operating the equipment in that spectrum, an operator
does not need a license, which can avoid the expensive and
time consuming licensing process. Available spectrum sharing
mechanisms include the detect & vacate mechanism and detect
& mitigate mechanism [139], which are proposed by the WiFi
industry in the European Telecommunications Standards Institute. However, these mechanisms are both vulnerable to the
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
delayed detection problem. That is to say, a WiFi device can
usually detect the existence of DSRC transmissions only if it
itself is not transmitting, which may affect the communications
among vehicles. Although the detection performance can be
improved by adding extra idle periods, due to the unilateral
hidden terminal problem, the detect & mitigate mechanism can
cause up to 30% additional packet loss to DSRC transmissions
after detecting the existence of DSRC devices, which can
further decrease the effectiveness of safety applications that
are relied on V2V communications.
VIII. C ONCLUSION
CAVs are helpful to reduce traffic accidents, enhance
quality-of-life, and promote the efficiency of transportation
systems. However, there are various security and privacy
challenges in the environment of CAVs. Hence, this paper has
investigated related up-to-date literatures. Based on the types
of communication networks and attack objects, this paper has
firstly classified various cyber-security risks and vulnerabilities
in the environment of CAVs into in-vehicle network attacks,
vehicle to everything network attacks, and other attacks. Next,
it has regarded cyber-risk as another type of attacks in the
environment of CAVs. Then, it has described corresponding
defending strategies to secure CAVs. Finally, several related
cyber-security and safety standards have been summarized
for improving the practical application of CAVs. In addition,
several challenges and open problems have been presented.
Classified potential cyber-security attacks and summarized
corresponding countermeasures are helpful for the healthy
development of CAVs and speeding up its practical
deployment for intelligent transportation systems. Specifically,
based on the lessons from the study of these cyber-security
attacks, it may be useful for policymakers, engineers and
researchers to cope with unknown security threats of CAVs
in the future. In addition, they can obey the important design
principles in the cyber-security and safety standards of CAVs.
Besides, the policymakers and system operators can analyze
the attacks and vulnerabilities in the environment of CAVs
by using a comprehensive cyber-risk assessment strategy,
which is helpful for understanding and prioritizing strategies
to mitigate the security risk. In summary, the research on the
cyber-security of CAVs is quite broad and many challenges
lay ahead. Nevertheless, it is in favor of the community to
swiftly address these challenges and go forward. We hope
that our discussion and exploration here may open a new
avenue for the cyber-security of CAVs.
R EFERENCES
[1] Y. Fu, F. R. Yu, C. Li, T. H. Luan, and Y. Zhang, “Vehicular blockchainbased collective learning for connected and autonomous vehicles,”
IEEE Wireless Commun., vol. 27, no. 2, pp. 197–203, Apr. 2020.
[2] X. Jiang, F. R. Yu, T. Song, and V. C. M. Leung, “Intelligent
resource allocation for video analytics in blockchain-enabled Internet
of autonomous vehicles with edge computing,” IEEE Internet Things
J., early access, Sep. 24, 2020, doi: 10.1109/JIOT.2020.3026354.
[3] A. Nanda, D. Puthal, J. J. P. C. Rodrigues, and S. A. Kozlov, “Internet
of autonomous vehicles communications security: Overview, issues,
and directions,” IEEE Wireless Commun., vol. 26, no. 4, pp. 60–65,
Aug. 2019.
17
[4] A. Greenberg, “Hackers remotely kill a jeep on the highway,” Wired,
2015.
[5] S. Boumiza and R. Braham, “Intrusion threats and security solutions
for autonomous vehicle networks,” in Proc. IEEE/ACS 14th Int. Conf.
Comput. Syst. Appl. (AICCSA), Oct. 2017, pp. 120–127.
[6] K. Mawonde, B. Isong, F. Lugayizi, and A. M. Abu-Mahfouz, “A survey on vehicle security systems: Approaches and technologies,” in
Proc. 44th Annu. Conf. IEEE Ind. Electron. Soc. (IECON), Oct. 2018,
pp. 4633–4638.
[7] S. Parkinson, P. Ward, K. Wilson, and J. Miller, “Cyber threats facing
autonomous and connected vehicles: Future challenges,” IEEE Trans.
Intell. Transp. Syst., vol. 18, no. 11, pp. 2898–2915, Nov. 2017.
[8] K. B. Kelarestaghi, M. Foruhandeh, K. Heaslip, and R. Gerdes,
“Survey on vehicular ad hoc networks and its access technologies
security vulnerabilities and countermeasures,” 2019, arXiv:1903.01541.
[Online]. Available: http://arxiv.org/abs/1903.01541
[9] M. S. Sheikh and J. Liang, “A comprehensive survey on VANET
security services in traffic management system,” Wireless Commun.
Mobile Comput., vol. 2019, pp. 1–23, Sep. 2019.
[10] F. Sommer, J. Dürrwang, and R. Kriesten, “Survey and classification
of automotive security attacks,” Information, vol. 10, no. 4, p. 148,
Apr. 2019.
[11] S. Jadhav and D. Kshirsagar, “A survey on security in automotive
networks,” in Proc. 4th Int. Conf. Comput. Commun. Control Automat.
(ICCUBEA), Aug. 2018, pp. 1–6.
[12] T. Yoshizawa and B. Preneel, “Survey of security aspect of V2X
standards and related issues,” in Proc. IEEE Conf. Standards Commun.
Netw. (CSCN), Oct. 2019, pp. 1–6.
[13] A. Masood, D. S. Lakew, and S. Cho, “Security and privacy challenges
in connected vehicular cloud computing,” IEEE Commun. Surveys
Tuts., vol. 22, no. 4, pp. 2725–2764, Jul. 2020.
[14] Y. An, F. R. Yu, J. Li, J. Chen, and V. C. M. Leung, “Edge intelligence
(EI)-enabled HTTP anomaly detection framework for the Internet of
Things (IoT),” IEEE Internet Things J., vol. 8, no. 5, pp. 3554–3566,
Mar. 2021.
[15] X. Zhao, S. Jing, F. Hui, R. Liu, and A. J. Khattak, “DSRC-based rearend collision warning system—An error-component safety distance
model and field test,” Transp. Res. C, Emerg. Technol., vol. 107,
pp. 92–104, Oct. 2019.
[16] M. Alaa, M. A. Abdala, and A. Al-Sherbaz, “Evaluation study of IEEE
1609.4 performance for safety and non-safety messages dissemination,”
Int. J. Enhanced Res. Sci. Technol. Eng., vol. 3, no. 11, pp. 29–36,
2014.
[17] R. S. Campos, “Evolution of positioning techniques in cellular networks, from 2G to 4G,” Wireless Commun. Mobile Comput., vol. 2017,
pp. 1–17, Jan. 2017.
[18] R. Li et al., “Intelligent 5G: When cellular networks meet artificial
intelligence,” IEEE Wireless Commun., vol. 24, no. 5, pp. 175–183,
Oct. 2017.
[19] J. Deng, J. Li, L. Zhao, and L. Guo, “A dual-band inverted-F MIMO
antenna with enhanced isolation for WLAN applications,” IEEE Antennas Wireless Propag. Lett., vol. 16, pp. 2270–2273, 2017.
[20] N. Rajan and R. Shah, “QoS analysis over WiMAX network with
varying modulation schemes and efficiency modes,” Int. J. Comput.
Appl., vol. 162, no. 8, pp. 9–16, Mar. 2017.
[21] Z. Luo, Z. Pei, and B. Zou, “Directional polarization modulation for secure dual-polarized satellite communication,” in Proc.
Int. Conf. Commun., Inf. Syst. Comput. Eng. (CISCE), Jul. 2019,
pp. 270–275.
[22] J. Heinovski, F. Klingler, F. Dressler, and C. Sommer, “A simulative
analysis of the performance of IEEE 802.11p and ARIB STD-T109,”
Comput. Commun., vol. 122, pp. 84–92, Jun. 2018.
[23] C. W. Axelrod, “Autonomous vehicles meet inhospitable roadways,” in
Proc. IEEE Long Island Syst., Appl. Technol. Conf. (LISAT), May 2019,
pp. 1–6.
[24] J. Nunez, V. Tran, and A. Katangur, “Protecting the unmanned aerial
vehicle from cyberattacks,” in Proc. Int. Conf. Secur. Manage., 2019,
pp. 154–157.
[25] Z. Li, Q. Pei, I. Markwood, Y. Liu, M. Pan, and H. Li, “Location
privacy violation via GPS-agnostic smart phone car tracking,” IEEE
Trans. Veh. Technol., vol. 67, no. 6, pp. 5042–5053, Jun. 2018.
[26] Q. Kang, X. Huang, Y. Li, Z. Xie, Y. Liu, and M. Zhou,
“Energy-efficient wireless transmissions for battery-less vehicle tire
pressure monitoring system,” IEEE Access, vol. 6, pp. 7687–7699,
2018.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
18
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
[27] K. T. Sterne, J. M. Ernst, D. K. Kilcoyne, A. J. Michaels, and
G. Moy, “Tire pressure monitoring system sensor radio frequency
measurements for privacy concerns,” Transp. Res. Rec., J. Transp. Res.
Board, vol. 2643, no. 1, pp. 34–44, Jan. 2017.
[28] M. Bozdal, M. Samie, and I. Jennions, “A survey on CAN bus protocol: Attacks, challenges, and potential solutions,” in Proc. Int. Conf.
Comput., Electron. Commun. Eng. (iCCECE), Aug. 2018, pp. 201–205.
[29] A. Palanca, E. Evenchick, F. Maggi, and S. Zanero, “A stealth,
selective, link-layer denial-of-service attack against automotive networks,” in Proc. Int. Conf. Detection Intrusions Malware, Vulnerability
Assessment, 2017, pp. 185–206.
[30] P.-S. Murvay and B. Groza, “Security shortcomings and countermeasures for the SAE J1939 commercial vehicle bus protocol,” IEEE Trans.
Veh. Technol., vol. 67, no. 5, pp. 4325–4339, May 2018.
[31] R. R. Brooks, S. Sander, J. Deng, and J. Taiber, “Automobile security concerns,” IEEE Veh. Technol. Mag., vol. 4, no. 2, pp. 52–64,
Jun. 2009.
[32] D. R. Jeong, K. Kim, B. Shivakumar, B. Lee, and I. Shin, “Razzer:
Finding kernel race bugs through fuzzing,” in Proc. IEEE Symp. Secur.
Privacy (SP), May 2019, pp. 754–768.
[33] K. J. Higgins. (2009). Permanent Denial-of-Service Attack
Sabotages Hardware. [Online]. Available: https://www.darkreading.
com/permanent-denial-of-service-attack-sabotages-hardware/d/did/1129499
[34] C. N. Gutierrez et al., “Learning from the ones that got away: Detecting
new forms of phishing attacks,” IEEE Trans. Dependable Secure
Comput., vol. 15, no. 6, pp. 988–1001, Nov. 2018.
[35] M. M. H. Onik, C.-S. Kim, and J. Yang, “Personal data privacy
challenges of the fourth industrial revolution,” in Proc. 21st Int. Conf.
Adv. Commun. Technol. (ICACT), Feb. 2019, pp. 635–638.
[36] S. Kumar and K. S. Mann, “Prevention of DoS attacks by detection of
multiple malicious nodes in VANETs,” in Proc. Int. Conf. Automat.,
Comput. Technol. Manage. (ICACTM), Apr. 2019, pp. 89–94.
[37] Q. He, X. Meng, and R. Qu, “Survey on cyber security of CAV,”
in Proc. Forum Cooperat. Positioning Service (CPGPS), May 2017,
pp. 351–354.
[38] A. Appathurai, G. Manogaran, and N. Chilamkurti, “Trusted FPGAbased transport traffic inject, impersonate (I2) attacks beaconing in the
Internet of vehicles,” IET Netw., vol. 8, no. 2, pp. 106–115, 2018.
[39] A. Mondal and M. Jana, “Detection of fabrication, replay and suppression attack in VANET—A database approach,” in Proc. Conf.
Advancement Comput., Commun. Electron. Paradigm, 2019, pp. 38–42.
[40] S. S. Albouq and E. M. Fredericks, “Lightweight detection and
isolation of black hole attacks in connected vehicles,” in Proc. IEEE
37th Int. Conf. Distrib. Comput. Syst. Workshops (ICDCSW), Jun. 2017,
pp. 97–104.
[41] K. C. Purohit, S. C. Dimri, and S. Jasola, “Mitigation and performance
analysis of routing protocols under black-hole attack in vehicular
ad-hoc network (VANET),” Wireless Pers. Commun., vol. 97, no. 4,
pp. 5099–5114, Dec. 2017.
[42] P. Kumar and S. Verma, “Detection of wormhole attack in VANET,”
Nat. J. Syst. Inf. Technol., vol. 10, no. 1, pp. 71–80, 2017.
[43] R. M. Shukla and S. Sengupta, “Analysis and detection of outliers due
to data falsification attacks in vehicular traffic prediction application,”
in Proc. 9th IEEE Annu. Ubiquitous Comput., Electron. Mobile Commun. Conf. (UEMCON), Nov. 2018, pp. 688–694.
[44] J. Lin, W. Yu, N. Zhang, X. Yang, and L. Ge, “Data integrity attacks
against dynamic route guidance in transportation-based cyber-physical
systems: Modeling, analysis, and defense,” IEEE Trans. Veh. Technol.,
vol. 67, no. 9, pp. 8738–8753, Sep. 2018.
[45] S. Balakrishnan, P. Wang, A. Bhuyan, and Z. Sun, “Modeling and
analysis of eavesdropping attack in 802.11ad mmWave wireless networks,” IEEE Access, vol. 7, pp. 70355–70370, 2019.
[46] (2018). Privacy Concerns and Self-Driving Cars: Are we Ready
for Autonomous Vehicles? [Online]. Available: https://blogs.
thomsonreuters.com/answerson/privacy-concerns-self-driving-carsready-autonomous-vehicles/
[47] X. Liu, C. Qian, W. G. Hatcher, H. Xu, W. Liao, and W. Yu, “Secure
Internet of Things (IoT)-based smart-world critical infrastructures:
Survey, case study and research opportunities,” IEEE Access, vol. 7,
pp. 79523–79544, 2019.
[48] M. Chowdhury, M. Islam, and Z. Khan, “Security of connected and
automated vehicles,” Fall Issue Bridge Cybersecur., vol. 49, no. 3,
pp. 46–56, 2019.
[49] N. V. Juliadotter and K.-K.-R. Choo, “Cloud attack and risk assessment
taxonomy,” IEEE Cloud Comput., vol. 2, no. 1, pp. 14–20, Jan. 2015.
[50] N. Alhebaishi, L. Wang, S. Jajodia, and A. Singhal, “Threat modeling
for cloud data center infrastructures,” in Proc. Int. Symp. Found. Pract.
Secur., 2017, pp. 302–319.
[51] Y. Li, Y. Tu, Q. Fan, C. Dong, and W. Wang, “Influence of cyberattacks on longitudinal safety of connected and automated vehicles,”
Accident Anal. Prevention, vol. 121, pp. 148–156, Dec. 2018.
[52] F. R. Yu, “From information networking to intelligence networking:
Motivations, scenarios, and challenges,” IEEE Netw., 2021.
[53] N. Baracaldo, B. Chen, H. Ludwig, A. Safavi, and R. Zhang, “Detecting
poisoning attacks on machine learning in IoT environments,” in Proc.
IEEE Int. Congr. Internet Things (ICIOT), Jul. 2018, pp. 57–64.
[54] N. Papernot, M. Abadi, L. Erlingsson, I. Goodfellow, and K. Talwar,
“Semi-supervised knowledge transfer for deep learning from private
training data,” in Proc. Int. Conf. Learn. Represent., 2017, pp. 1–16.
[55] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and
P. McDaniel, “Ensemble adversarial training: Attacks and defenses,”
in Proc. Int. Conf. Learn. Represent., 2018, pp. 1–22.
[56] M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “PRADA: Protecting
against DNN model stealing attacks,” in Proc. IEEE Eur. Symp. Secur.
Privacy (EuroS&P), Jun. 2019, pp. 512–527.
[57] S. Truex, L. Liu, M. E. Gursoy, L. Yu, and W. Wei, “Demystifying
membership inference attacks in machine learning as a service,”
IEEE Trans. Services Comput., early access, Feb. 25, 2019, doi:
10.1109/TSC.2019.2897554.
[58] (2018). Institute of Risk Management. [Online]. Available:
https://www.theirm.org/knowledge-and-resources/thoughtleadership/cyber-risk/
[59] T. M. Keller, V. Wright, J. Benjamin, and B. Gold, “Vulnerabilities under the surface: Tracking potential vulnerabilities by
voiding warranties,” in Proc. 5th Cybersecur. Symp., Apr. 2018,
pp. 1–3.
[60] B. Sheehan, F. Murphy, M. Mullins, and C. Ryan, “Connected and
autonomous vehicles: A cyber-risk classification framework,” Transp.
Res. A, Policy Pract., vol. 124, pp. 523–536, Jun. 2019.
[61] C. Maple, M. Bradbury, A. T. Le, and K. Ghirardello, “A connected and
autonomous vehicle reference architecture for attack surface analysis,”
Appl. Sci., vol. 9, no. 23, p. 5101, Nov. 2019.
[62] W. Xu, C. Yan, W. Jia, X. Ji, and J. Liu, “Analyzing and enhancing the
security of ultrasonic sensors for autonomous vehicles,” IEEE Internet
Things J., vol. 5, no. 6, pp. 5015–5029, Dec. 2018.
[63] R. Matsumura, T. Sugawara, and K. Sakiyama, “A secure
LiDAR with AES-based side-channel fingerprinting,” in Proc. 6th
Int. Symp. Comput. Netw. Workshops (CANDARW), Nov. 2018,
pp. 479–482.
[64] B. S. Lim, S. L. Keoh, and V. L. L. Thing, “Autonomous vehicle
ultrasonic sensor vulnerability and impact assessment,” in Proc. IEEE
4th World Forum Internet Things, Feb. 2018, pp. 231–236.
[65] Y. Cao et al., “Adversarial sensor attack on LiDAR-based perception
in autonomous driving,” in Proc. Comput. Commun. Secur., 2019,
pp. 2267–2281.
[66] P. Kapoor, A. Vora, and K.-D. Kang, “Detecting and mitigating
spoofing attack against an automotive radar,” in Proc. IEEE 88th Veh.
Technol. Conf. (VTC-Fall), Aug. 2018, pp. 1–6.
[67] Y. Liu, S. Li, Q. Fu, and Z. Liu, “Impact assessment of GNSS spoofing
attacks on INS/GNSS integrated navigation system,” Sensors, vol. 18,
no. 5, p. 1433, May 2018.
[68] H. Tao, H. Wu, H. Li, and M. Lu, “GNSS spoofing detection based
on consistency check of velocities,” Chin. J. Electron., vol. 28, no. 2,
pp. 437–444, Mar. 2019.
[69] A. Kalantari and E. G. Larsson, “Statistical test for GNSS spoofing
attack detection by using multiple receivers on a rigid body,” EURASIP
J. Adv. Signal Process., vol. 2020, no. 1, pp. 1–16, Dec. 2020.
[70] E. Schmidt, N. Gatsis, and D. Akopian, “A GPS spoofing detection and classification correlator-based technique using the LASSO,”
IEEE Trans. Aerosp. Electron. Syst., vol. 56, no. 6, pp. 4224–4237,
Dec. 2020.
[71] S. Jeong, M. Kim, and J. Lee, “CUSUM-based GNSS spoofing
detection method for users of GNSS augmentation system,” Int. J.
Aeronaut. Space Sci., vol. 21, no. 2, pp. 513–523, Jun. 2020.
[72] Y. Qiu, Y. Liu, X. Li, and J. Chen, “A novel location privacy-preserving
approach based on blockchain,” Sensors, vol. 20, no. 12, p. 3519,
Jun. 2020.
[73] Y. Zhou and D. Zhang, “Double mix-zone for location privacy in
VANET,” in Proc. 7th Int. Conf. Inf. Technol., IoT Smart City,
Dec. 2019, pp. 322–327.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
SUN et al.: SURVEY ON CYBER-SECURITY OF CAVs
[74] A. Boualouache, R. Soua, and T. Engel, “VPGA: An SDN-based
location privacy zones placement scheme for vehicular networks,” in
Proc. IEEE 38th Int. Perform. Comput. Commun. Conf. (IPCCC),
Oct. 2019, pp. 1–8.
[75] L. Luo, Z. Han, C. Xu, and G. Zhao, “A geo-indistinguishable location
privacy preservation scheme for location-based services in vehicular
networks,” in Proc. Int. Conf. Algorithms Archit. Parallel Process.,
2019, pp. 610–623.
[76] X. Li et al., “Perturbation-hidden: Enhancement of vehicular privacy for location-based services in Internet of vehicles,”
IEEE Trans. Netw. Sci. Eng., early access, Jul. 23, 2020, doi:
10.1109/TNSE.2020.3011607.
[77] (2018). Can Bus Can Be Encrypted, Says Trillium | EE Times.
[Online]. Available: https://www.eetimes.com/document.asp?doc_
id=1328081&page_num_ ber=2
[78] B. Groza, L. Popa, and P.-S. Murvay, “Highly efficient authentication
for CAN by identifier reallocation with ordered CMACs,” IEEE Trans.
Veh. Technol., vol. 69, no. 6, pp. 6129–6140, Jun. 2020.
[79] B. Palaniswamy, S. Camtepe, E. Foo, and J. Pieprzyk, “An efficient authentication scheme for intra-vehicular controller area network,” IEEE Trans. Inf. Forensics Security, vol. 15, pp. 3107–3122,
2020.
[80] M. S. U. Alam, S. Iqbal, M. Zulkernine, and C. Liem, “Securing
vehicle ECU communications and stored data,” in Proc. IEEE Int. Conf.
Commun. (ICC), May 2019, pp. 1–6.
[81] T. Lenard, R. Bolboac, B. Genge, and P. Haller, “MixCAN: Mixed and
backward-compatible data authentication scheme for controller area
networks,” in Proc. IFIP Netw. Conf., 2020, pp. 395–403.
[82] J. Chen and J. Sun, “Platoon separation strategy optimization method
based on deep cognition of a driver’s behavior at signalized intersections,” IEEE Access, vol. 8, pp. 17779–17791, 2020.
[83] Z. Zhang, Y. Cheng, Y. Gao, S. Nepal, D. Liu, and Y. Zou, “Detecting
hardware-assisted virtualization with inconspicuous features,” IEEE
Trans. Inf. Forensics Security, vol. 16, pp. 16–27, 2021.
[84] Z. A. Biron, S. Dey, and P. Pisu, “Real-time detection and estimation
of denial of service attack in connected vehicle systems,” IEEE Trans.
Intell. Transp. Syst., vol. 19, no. 12, pp. 3893–3902, Dec. 2018.
[85] S. Kumar and K. S. Mann, “Detection of multiple malicious nodes
using entropy for mitigating the effect of denial of service attack in
VANETs,” in Proc. 4th Int. Conf. Comput. Sci. (ICCS), Aug. 2018,
pp. 72–79.
[86] S. Ohira, A. K. Desta, I. Arai, H. Inoue, and K. Fujikawa, “Normal
and malicious sliding windows similarity analysis method for fast
and accurate IDS against DoS attacks on in-vehicle networks,” IEEE
Access, vol. 8, pp. 42422–42435, 2020.
[87] T. Limbasiya and D. Das, “Secure and effective geo-data transmission
scheme for vehicle-to-vehicle communication,” in Proc. IEEE SmartWorld, Ubiquitous Intell. Comput., Adv. Trusted Comput., Scalable
Comput. Commun., Cloud Big Data Comput., Internet People Smart
City Innov., Oct. 2018, pp. 389–396.
[88] T. Limbasiya and D. Das, “Lightweight secure message broadcasting
protocol for vehicle-to-vehicle communication,” IEEE Syst. J., vol. 14,
no. 1, pp. 520–529, Mar. 2020.
[89] N. Hegde and S. S. Manvi, “Hash based integrity verification for
vehicular cloud environment,” in Proc. IEEE Int. Conf. Cloud Comput.
Emerg. Markets (CCEM), Sep. 2019, pp. 75–79.
[90] J. Li, Y. Ji, K.-K.-R. Choo, and D. Hogrefe, “CL-CPPA: Certificate-less
conditional privacy-preserving authentication protocol for the Internet
of vehicles,” IEEE Internet Things J., vol. 6, no. 6, pp. 10332–10343,
Dec. 2019.
[91] A. K. Sutrala, P. Bagga, A. K. Das, N. Kumar, J. J. P. C. Rodrigues,
and P. Lorenz, “On the design of conditional privacy preserving
batch verification-based authentication scheme for Internet of vehicles
deployment,” IEEE Trans. Veh. Technol., vol. 69, no. 5, pp. 5535–5548,
May 2020.
[92] K. Park, Y. Park, A. K. Das, S. Yu, J. Lee, and Y. Park, “A dynamic
privacy-preserving key management protocol for V2G in social Internet
of Things,” IEEE Access, vol. 7, pp. 76812–76832, 2019.
[93] R. Merco, Z. A. Biron, and P. Pisu, “Replay attack detection in a
platoon of connected vehicles with cooperative adaptive cruise control,”
in Proc. Annu. Amer. Control Conf. (ACC), Jun. 2018, pp. 5582–5587.
[94] X. Xu, X. Li, P. Dong, Y. Liu, and H. Zhang, “Robust reset speed synchronization control for an integrated motor-transmission powertrain
system of a connected vehicle under a replay attack,” IEEE Trans. Veh.
Technol., early access, Sep. 1, 2020, doi: 10.1109/TVT.2020.3020845.
19
[95] K. Greene, D. Rodgers, H. Dykhuizen, Q. Niyaz, K. Al Shamaileh,
and V. Devabhaktuni, “A defense mechanism against replay attack in
remote keyless entry systems using timestamping and XOR logic,”
IEEE Consum. Electron. Mag., vol. 10, no. 1, pp. 101–108, Jan. 2021.
[96] N. Panda and B. K. Pattanayak, “Energy aware detection and prevention
of black hole attack in MANET,” Int. J. Eng. Technol., vol. 7, no. 2.6,
pp. 135–140, 2018.
[97] V. Krundyshev, M. Kalinin, and P. Zegzhda, “Artificial swarm algorithm
for VANET protection against routing attacks,” in Proc. IEEE Ind.
Cyber-Phys. Syst., May 2018, pp. 795–800.
[98] B. Cherkaoui, A. Beni-Hssane, and M. Erritali, “Variable control
chart for detecting black hole attack in vehicular ad-hoc networks,”
J. Ambient Intell. Humanized Comput., vol. 11, no. 11, pp. 5129–5138,
Nov. 2020.
[99] A. Bhawsar, Y. Pandey, and U. Singh, “Detection and prevention
of wormhole attack using the trust-based routing system,” in Proc.
Int. Conf. Electron. Sustain. Commun. Syst. (ICESC), Jul. 2020,
pp. 809–814.
[100] F. Boeira, M. Asplund, and M. P. Barcellos, “Mitigating position
falsification attacks in vehicular platooning,” in Proc. IEEE Veh. Netw.
Conf. (VNC), Dec. 2018, pp. 1–4.
[101] L. Ma, Y. Xiang, Q. Pei, Y. Xiang, and H. Zhu, “Robust reputationbased cooperative spectrum sensing via imperfect common control
channel,” IEEE Trans. Veh. Technol., vol. 67, no. 5, pp. 3950–3963,
May 2018.
[102] F. Alotibi and M. Abdelhakim, “Anomaly detection for cooperative
adaptive cruise control in autonomous vehicles using statistical learning
and kinematic model,” IEEE Trans. Intell. Transp. Syst., early access,
Apr. 8, 2020, doi:10.1109/TITS.2020.2983392.
[103] M. Arif, G. Wang, and V. E. Balas, “Secure VANETs: Trusted
communication scheme between vehicles and infrastructure based on
fog computing,” Stud. Informat. Control, vol. 27, no. 2, pp. 235–246,
Jan. 2019.
[104] Y. Wu et al., “Secrecy-driven resource management for vehicular computation offloading networks,” IEEE Netw., vol. 32, no. 3, pp. 84–91,
May 2018.
[105] W. Liang, J. Long, T.-H. Weng, X. Chen, K.-C. Li, and A. Y. Zomaya,
“TBRS: A trust based recommendation scheme for vehicular CPS network,” Future Gener. Comput. Syst., vol. 92, pp. 383–398, Mar. 2019.
[106] N. B. Khankari and G. V. Kale, “One time password generation for
multifactor authentication using graphical password,” Int. J. Eng. Res.
Gen. Sci., vol. 3, no. 5, pp. 489–494, 2020.
[107] M. Islam, M. Chowdhury, H. Li, and H. Hu, “Cybersecurity attacks
in vehicle-to-infrastructure applications and their prevention,” Transp.
Res. Rec., J. Transp. Res. Board, vol. 2672, no. 19, pp. 66–78,
Dec. 2018.
[108] Y. Chen, Z. Lu, H. Xiong, and W. Xu, “Privacy-preserving
data aggregation protocol for fog computing-assisted vehicle-toinfrastructure scenario,” Secur. Commun. Netw., vol. 2018, pp. 1–14,
Apr. 2018.
[109] Y. Kim, J. Nam, T. Park, S. Scott-Hayward, and S. Shin, “SODA:
A software-defined security framework for IoT environments,” Comput.
Netw., vol. 163, pp. 106889.1–106889.13, Nov. 2019.
[110] I. Ali and F. Li, “An efficient conditional privacy-preserving authentication scheme for vehicle-to-infrastructure communication in VANETs,”
Veh. Commun., vol. 22, pp. 100228.1–100228.15, Apr. 2020.
[111] P. P. K. Chan, Z.-M. He, H. Li, and C.-C. Hsu, “Data sanitization
against adversarial label contamination based on data complexity,” Int.
J. Mach. Learn. Cybern., vol. 9, no. 6, pp. 1039–1052, Jun. 2018.
[112] R. L. Rivest, L. Adleman, and M. L. Dertouzos, “On data banks
and privacy homomorphisms,” Found. Secure Comput., vol. 4, no. 11,
pp. 169–180, 1978.
[113] K. Mivule, C. Turner, and S.-Y. Ji, “Towards a differential privacy and
utility preserving machine learning classifier,” Procedia Comput. Sci.,
vol. 12, pp. 176–181, Jan. 2012.
[114] K. Scarfone and P. Mell, “An analysis of CVSS version 2 vulnerability scoring,” in Proc. 3rd Int. Symp. Empirical Softw. Eng. Meas.,
Oct. 2009, pp. 516–525.
[115] A. Le, C. Maple, and T. Watson, “A profile-driven dynamic
risk assessment framework for connected and autonomous vehicles,” in Proc. Living Internet Things, Cybersecur. IoT, 2018,
pp. 1–9.
[116] Z. El-Rewini, K. Sadatsharan, N. Sugunaraj, D. F. Selvaraj,
S. J. Plathottam, and P. Ranganathan, “Cybersecurity attacks in vehicular sensors,” IEEE Sensors J., vol. 20, no. 22, pp. 13752–13767,
Nov. 2020.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
20
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS
[117] N. Miura, T. Machida, K. Matsuda, M. Nagata, and D. Suzuki, “A lowcost replica-based distance-spoofing attack on mmWave FMCW radar,”
in Proc. 3rd ACM Workshop Attacks Solutions Hardw. Secur. Workshop,
2019, pp. 95–100.
[118] M. E. Andrs, N. E. Bordenabe, K. Chatzikokolakis, and C. Palamidessi,
“Geo-indistinguishability: Differential privacy for location-based systems,” in Proc. ACM Conf. Comput. Commun. Secur., 2013,
pp. 901–914.
[119] D. Spill and A. Bittau, “BlueSniff: Eve meets Alice and Bluetooth,” in
Proc. 1st USENIX Workshop Offensive Technol., 2007, pp. 1–10.
[120] F. Shao and Y. Wu, “The TPMS module in the vehicle positioning and
safety warning system,” in Proc. Int. Conf. Appl. Techn. Cyber Secur.
Intell., 2018, pp. 1307–1314.
[121] D. Dolgov, S. Thrun, M. Montemerlo, and J. Diebel, “Path planning
for autonomous vehicles in unknown semi-structured environments,”
Int. J. Robot. Res., vol. 29, no. 5, pp. 485–501, Apr. 2010.
[122] R. Verdult, F. D. Garcia, and B. Ege, “Dismantling megamos crypto:
Wirelessly lockpicking a vehicle immobilizer,” in Proc. USENIX Secur.
Symp., 2013, pp. 687–702.
[123] A. K. Desta, S. Ohira, I. Arai, and K. Fujikawa, “ID sequence
analysis for intrusion detection in the CAN bus using long short term
memory networks,” in Proc. IEEE Int. Conf. Pervas. Comput. Commun.
Workshops (PerCom Workshops), Mar. 2020, pp. 1–6.
[124] H. Olufowobi, C. Young, J. Zambreno, and G. Bloom, “SAIDuCANT:
Specification-based automotive intrusion detection using controller area
network (CAN) timing,” IEEE Trans. Veh. Technol., vol. 69, no. 2,
pp. 1484–1494, Feb. 2020.
[125] F. Kohnhauser, D. Pullen, and S. Katzenbeisser, “Ensuring the safe and
secure operation of electronic control units in road vehicles,” in Proc.
IEEE Secur. Privacy Workshops, May 2019, pp. 126–131.
[126] Y. Jie, M. Li, C. Guo, and L. Chen, “Dynamic defense strategy against
DoS attacks over vehicular ad hoc networks based on port hopping,”
IEEE Access, vol. 6, pp. 51374–51383, 2018.
[127] H. S. Sanchez, D. Rotondo, M. L. Vidal, and J. Quevedo, “Frequencybased detection of replay attacks: Application to a quadrotor UAV,” in
Proc. 8th Int. Conf. Syst. Control (ICSC), Oct. 2019, pp. 289–294.
[128] P. Oza, M. Foruhandeh, R. Gerdes, and T. Chantem, “Secure traffic
lights: Replay attack detection for model-based smart traffic controllers,” in Proc. 2nd ACM Workshop Automot. Aerial Vehicle Secur.,
Mar. 2020, pp. 5–10.
[129] Z. Hassan, A. Mehmood, C. Maple, M. A. Khan, and A. Aldegheishem,
“Intelligent detection of black hole attacks for secure communication in autonomous and connected vehicles,” IEEE Access, vol. 8,
pp. 199618–199628, 2020.
[130] C. Li, Y. Xu, J. Xia, and J. Zhao, “Protecting secure communication
under UAV smart attack with imperfect channel estimation,” IEEE
Access, vol. 6, pp. 76395–76401, 2018.
[131] E. Hesamifard, H. Takabi, M. Ghasemi, and R. N. Wright, “Privacypreserving machine learning as a service,” Proc. Privacy Enhancing
Technol., vol. 2018, no. 3, pp. 123–142, Jun. 2018.
[132] P. Sinha, “Architectural design and reliability analysis of a failoperational brake-by-wire system from ISO 26262 perspectives,” Rel.
Eng. Syst. Saf., vol. 96, no. 10, pp. 1349–1359, Oct. 2011.
[133] J. Birch et al., “Safety cases and their role in ISO 26262 functional
safety assessment,” in Proc. Int. Conf. Comput. Saf., Rel., Secur., 2013,
pp. 154–165.
[134] T. Dittel and H.-J. Aryus, “How to survive a safety case according
to ISO 26262,” in Proc. Int. Conf. Comput. Saf., Rel., Secur., 2010,
pp. 97–111.
[135] C. Schmittner, Z. Ma, C. Reyes, O. Dillinger, and P. Puschner, “Using
SAE J3061 for automotive security requirement engineering,” in Proc.
Int. Conf. Comput. Saf., Rel., Secur., 2016, pp. 157–170.
[136] (2018). Principles of Cyber Security for Connected and Automated
Vehicles. [Online]. Available:
https://www.gov.uk/government/
publications/principles-of-cyber-secu-rity-for-connected-andautomated-vehicles/the-key-principles-of-vehi-cle-cyber-security-forconnected-and-automated-vehicles
[137] Road Vehicles—Functional Safety—Part 1: Vocabulary, Standard
ISO 26262-1:2018, 2018. [Online]. Available: https://www.iso.org/
standard/68383.html
[138] Z. He, H. Shan, Y. Bi, Z. Xiang, Z. Su, and T. H. Luan, “Spectrum
sharing for vehicular communications in a multi-operator scenario,”
in Proc. 11th Int. Conf. Wireless Commun. Signal Process. (WCSP),
Oct. 2019, pp. 1–6.
[139] B. Cheng, H. Lu, A. Rostami, M. Gruteser, and J. B. Kenney, “Impact
of 5.9 GHz spectrum sharing on DSRC performance,” in Proc. IEEE
Veh. Netw. Conf. (VNC), Nov. 2017, pp. 215–222.
Xiaoqiang Sun was born in 1989, China.
He received the B.S. degree in mathematics and
applied mathematics from Fuyang Normal University in 2011 and the Ph.D. degree in information and communication engineering from Shenzhen
University in 2018. He was a Post-Doctoral Fellow
with the F. Richard Yu’s Group, Carleton University, Ottawa, from 2019 to 2020. He is currently
a Post-Doctoral Fellow with the Guangdong Key
Laboratory of Intelligent Information Processing,
College of Electronics and Information Engineering,
Shenzhen University. He has published more than ten academic journal
articles and conference papers. His research interests include cryptography,
information security, and fully homomorphic encryption.
F. Richard Yu (Fellow, IEEE) received the Ph.D.
degree in electrical engineering from the University
of British Columbia (UBC) in 2003.
He is a registered Professional Engineer in ON,
Canada, and a fellow of the Canadian Academy
of Engineering (CAE), the Engineering Institute of
Canada (EIC), and the Institution of Engineering and
Technology (IET). From 2002 to 2006, he was with
Ericsson, Lund, Sweden, and a start-up in California,
USA. He joined Carleton University in 2007, where
he is currently a Professor. His research interests
include connected/autonomous vehicles, security, artificial intelligence, distributed ledger technology, and wireless cyber-physical systems. He received
the IEEE TCGCC Best Journal Paper Award in 2019, the Distinguished
Service Awards in 2019 and 2016, the Outstanding Leadership Award
in 2013, the Carleton Research Achievement Awards in 2012 and 2020,
the Ontario Early Researcher Award (formerly Premiers Research Excellence
Award) in 2011, the Excellent Contribution Award at IEEE/IFIP TrustCom
2010, the Leadership Opportunity Fund Award from Canada Foundation
of Innovation in 2009, and the Best Paper Awards at IEEE ICNC 2018,
VTC 2017 Spring, ICC 2014, Globecom 2012, IEEE/IFIP TrustCom 2009,
and Int’l Conference on Networking 2005. He has served as the Technical
Program Committee (TPC) Co-Chair for numerous conferences. He has been
named in the Clarivate Analytics list of Highly Cited Researchers in 2019 and
2020. He is an IEEE Distinguished Lecturer of the Vehicular Technology
Society (VTS) and the Communication Society. He is an Elected Member
of the Board of Governors of the IEEE VTS and Editor-in-Chief for IEEE
VTS Mobile World newsletter. He serves on the editorial boards of several
journals, including the Co-Editor-in-Chief for Ad Hoc and Sensor Wireless
Networks, the Lead Series Editor for IEEE T RANSACTIONS ON V EHICULAR
T ECHNOLOGY, IEEE C OMMUNICATIONS S URVEYS AND T UTORIALS , and
IEEE T RANSACTIONS ON G REEN C OMMUNICATIONS AND N ETWORKING.
Peng Zhang received the M.S. and Ph.D. degrees
in signal and information processing from Shenzhen
University in 2008 and 2011, respectively. She is
currently an Associate Professor with the College of
Electronics and Information Engineering, Shenzhen
University. She has published more than 30 academic journal articles and conference papers. Her current research interests include cryptography technology and security in the blockchain, cloud computing,
and the IoT.
Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on July 01,2021 at 04:29:53 UTC from IEEE Xplore. Restrictions apply.