CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning
Connected and automated vehicles (CAVs) are getting a lot of attention these days as their technology becomes more mature and they benefit from the Internet-of-Vehicles (IoV) ecosystem. CAVs attract malicious activities that jeopardize security and safety dimensions. The cybersecurity systems of CAV...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-11-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/22/11631 |
| _version_ | 1827645040496738304 |
|---|---|
| author | George E. Raptis Christina Katsini Christos Alexakos Athanasios Kalogeras Dimitrios Serpanos |
| author_facet | George E. Raptis Christina Katsini Christos Alexakos Athanasios Kalogeras Dimitrios Serpanos |
| author_sort | George E. Raptis |
| collection | DOAJ |
| description | Connected and automated vehicles (CAVs) are getting a lot of attention these days as their technology becomes more mature and they benefit from the Internet-of-Vehicles (IoV) ecosystem. CAVs attract malicious activities that jeopardize security and safety dimensions. The cybersecurity systems of CAVs detect such activities, collect and analyze related information during and after the activity, and use cyber threat intelligence (CTI) to organize this information. Considering that CTI collected from various malicious activities may share common characteristics, it is critical to provide the cybersecurity stakeholders with quick and automatic ways of analysis and interrelation. This aims to help them perform more accurate and effective forensic investigations. To this end, we present CAVeCTIR, a novel approach that finds similarities between CTI reports that describe malicious activities detected on CAVs. CAVeCTIR uses advanced machine learning techniques and provides a quick, automated, and effective solution for clustering similar malicious activities. We applied CAVeCTIR in a series of experiments investigating almost 3000 malicious activities in simulation, real-world, and hybrid CAV environments, covering seven critical cyber-attack scenarios. The results showed that the DBSCAN algorithm identified seven no-overlapping core clusters characterized by high density. The results indicated that cybersecurity stakeholders could take advantage of CAVeCTIR by adopting the same or similar methods to analyze newly detected malicious activity, speed up the attack attribution process, and perform a more accurate forensics investigation. |
| first_indexed | 2024-03-09T18:28:57Z |
| format | Article |
| id | doaj.art-08170a022ea54e51aa24dc53e0e97217 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T18:28:57Z |
| publishDate | 2022-11-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-08170a022ea54e51aa24dc53e0e972172023-11-24T07:38:27ZengMDPI AGApplied Sciences2076-34172022-11-0112221163110.3390/app122211631CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine LearningGeorge E. Raptis0Christina Katsini1Christos Alexakos2Athanasios Kalogeras3Dimitrios Serpanos4 Industrial Systems Institute (ISI), Athena Research & Innovation Center (ATHENA), 26504 Patras, Greece Industrial Systems Institute (ISI), Athena Research & Innovation Center (ATHENA), 26504 Patras, Greece Industrial Systems Institute (ISI), Athena Research & Innovation Center (ATHENA), 26504 Patras, Greece Industrial Systems Institute (ISI), Athena Research & Innovation Center (ATHENA), 26504 Patras, GreeceElectrical & Computer Engineering, University of Patras, 26504 Patras, GreeceConnected and automated vehicles (CAVs) are getting a lot of attention these days as their technology becomes more mature and they benefit from the Internet-of-Vehicles (IoV) ecosystem. CAVs attract malicious activities that jeopardize security and safety dimensions. The cybersecurity systems of CAVs detect such activities, collect and analyze related information during and after the activity, and use cyber threat intelligence (CTI) to organize this information. Considering that CTI collected from various malicious activities may share common characteristics, it is critical to provide the cybersecurity stakeholders with quick and automatic ways of analysis and interrelation. This aims to help them perform more accurate and effective forensic investigations. To this end, we present CAVeCTIR, a novel approach that finds similarities between CTI reports that describe malicious activities detected on CAVs. CAVeCTIR uses advanced machine learning techniques and provides a quick, automated, and effective solution for clustering similar malicious activities. We applied CAVeCTIR in a series of experiments investigating almost 3000 malicious activities in simulation, real-world, and hybrid CAV environments, covering seven critical cyber-attack scenarios. The results showed that the DBSCAN algorithm identified seven no-overlapping core clusters characterized by high density. The results indicated that cybersecurity stakeholders could take advantage of CAVeCTIR by adopting the same or similar methods to analyze newly detected malicious activity, speed up the attack attribution process, and perform a more accurate forensics investigation.https://www.mdpi.com/2076-3417/12/22/11631connected and autonomous vehiclesinternet of vehiclescyber threat intelligence reportscybersecuritymachine learningcluster analysis |
| spellingShingle | George E. Raptis Christina Katsini Christos Alexakos Athanasios Kalogeras Dimitrios Serpanos CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning Applied Sciences connected and autonomous vehicles internet of vehicles cyber threat intelligence reports cybersecurity machine learning cluster analysis |
| title | CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning |
| title_full | CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning |
| title_fullStr | CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning |
| title_full_unstemmed | CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning |
| title_short | CAVeCTIR: Matching Cyber Threat Intelligence Reports on Connected and Autonomous Vehicles Using Machine Learning |
| title_sort | cavectir matching cyber threat intelligence reports on connected and autonomous vehicles using machine learning |
| topic | connected and autonomous vehicles internet of vehicles cyber threat intelligence reports cybersecurity machine learning cluster analysis |
| url | https://www.mdpi.com/2076-3417/12/22/11631 |
| work_keys_str_mv | AT georgeeraptis cavectirmatchingcyberthreatintelligencereportsonconnectedandautonomousvehiclesusingmachinelearning AT christinakatsini cavectirmatchingcyberthreatintelligencereportsonconnectedandautonomousvehiclesusingmachinelearning AT christosalexakos cavectirmatchingcyberthreatintelligencereportsonconnectedandautonomousvehiclesusingmachinelearning AT athanasioskalogeras cavectirmatchingcyberthreatintelligencereportsonconnectedandautonomousvehiclesusingmachinelearning AT dimitriosserpanos cavectirmatchingcyberthreatintelligencereportsonconnectedandautonomousvehiclesusingmachinelearning |