International audience

The automotive industry’s shift to zonal Electrical/Electronic (E/E) architectures introduces new lateral movement pathways for multi-stage cyberattacks, posing significant end-user risks. Modeling these “automotive kill chains” is challenging due to the lack of a standardized framework for adversary tactics. This paper presents a methodology that integrates the Automotive Threat Matrix (ATM) with the ISO/SAE 21434 Threat Analysis and Risk Assessment (TARA) process to systematically construct and analyze attack paths. Based on this analysis, we propose the Automotive Kill Chain Correlation (AKCC), a dynamic threat response framework that correlates security alerts along modeled attack paths for high-confidence detection. Applying the methodology to a representative zonal architecture reveals systemic vulnerabilities and enables the design of targeted, stateful countermeasures. The practical utility of this approach is validated through a qualitative survey of industry experts, who confirmed it significantly simplifies and clarifies attack path analysis.

The development and testing of new applications in Cooperative Intelligent Transportation Systems (C-ITS) environments, which rely on Vehicle-to-Everything (V2X) communication, is frequently supported through simulations. Nevertheless, most of existing simulators are either outdated or do not consider the latest adopted standards. Especially, the security and privacy mechanisms of vehicles and V2X communications. Which leads to incorrect and biased assessments in numerous privacy-aware applications such as Intrusion detection. In this context, we introduce Platelet, which stands as the first V2X simulator compliant with security and privacy standards.Source code: https://gitlab.com/Matk3z/plateletVideo: https://www.youtube.com/watch?v=WuIl59mwxi0

The intrusion detection systems are vital for the sustainability of Cooperative Intelligent Transportation Systems (C-ITS) and the detection of sybil attacks are particularly challenging. In this work, we propose a novel approach for the detection of sybil attacks in C-ITS environments. We provide an evaluation of our approach using extensive simulations that rely on real traces, showing our detection approach's effectiveness.

International audience

In the context of current smart cities, Cooperative Intelligent Transportation Systems (C-ITS) represent one of the main use case scenarios that aim to improve peoples’ daily lives. Thus, during the last few years, numerous standards have been adopted to regulate such networks. Within a C-ITS, a large number of messages are exchanged continuously in order to ensure that the different applications operate efficiently. However, these networks can be the target of numerous attacks. The sybil attack is among the most dangerous ones. In a sybil attack, an attacker creates multiple identities and then disguises as several fake stations in order to interfere with the normal operations of the system or profit from provided services. We analyze recently proposed sybil detection approaches regarding their compliance with the current C-ITS standards as well as their evaluation methods. We provide several recommendations such as network and attack models as well as an urban and highway datasets that can be considered in future research in sybil attack detection.

Cloud computing has gained an important role in providing high quality and cost-effective IT services by outsourcing part of their operations to dedicated cloud providers. If intrinsic security issues of this architecture have been extensively studied, it has recently been considered as a ready-to-use platform able to perform malicious activities, thus offering new targets for indirect threats. However, its large scale, the heterogeneous and dynamic nature of the activities it executes, as well as multi-tenancy and privacy-related issues, make the security operation complex. Consequently, cloud providers can hardly detect and mitigate malicious activities they unknowingly host. Leveraging the autonomic paradigm represents a promising solution to face such a complexity, but it requires efficient grounded monitoring and analysis functions to efficiently detect malicious activities hidden within the large number of legitimate ones. In this effort, this paper presents a robust and cost-effective solution to detect malicious activities in a public virtualized environment. Its contribution is twofold: 1) a scalable and robust workload estimation of the virtual host activities in a cloud and 2) a detection algorithm able to discriminate infected hosts with low malicious activities hidden within their legitimate workload and potentially scattered across several tenants. For both of these contributions, we establish their theoretical performance, which demonstrates their optimality, and we evaluate their efficiency on a dataset made of real data collected on PlanetLab. Finally, we study the scalability on a large dataset that consists of simulated data resulting from the real dataset modeling. This demonstrates to what extent the proposal exhibits an excellent sharpness and a reasonable cost, even at a very large scale.

Cooperative Intelligent Transportation Systems are rapidly gaining momentum in the scenario of modern wireless communications. Within these environments, messages are exchanged continuously. The latter should be secure and ensure users' privacy. Public Key Infrastructures (PKIs) represent the major solution to meet security needs. On the other hand, communications between the PKI and the vehicle stations or the Road Side Unit stations should also be secure. Main current security standards do not address and define a complete detailed secure end-to-end mechanism to send requests to the PKI and receive the associated responses. In this paper, we propose a detailed security protocol, based on ETSI security standards, that ensures confidentiality, integrity and authentication. The evaluation of the latter shows its ability in meeting security needs.

Cooperative Intelligent Transportation Systems (C-ITS) are gaining ground and are almost part of our everyday life. Within these environments, huge amounts of messages are exchanged. Besides, these messages should be secure in order to ensure users' privacy. Public Key Infrastructures (PKI) represent the most common security solution. Due to the vehicles speed, the communication with the PKI should be fully optimized. The European Telecommunications Standards Institute (ETSI) proposes a PKI architecture for C-ITS environments. However, unlike most of security standards as IEEE 1609.2, there is no Abstract Syntax Notation One (ASN.1) specification for the used certificates. For this reason, in this paper, we propose an ASN.1 definition for the ETSI certificate to help developers in its implementation. In addition, we provide an extensive comparative study of the different encoding schemes, applied to this proposal.

Since the last years, cloud computing is playing an important role in providing high quality of IT services. However, beyond a legitimate usage, the numerous advantages it presents are now exploited by attackers, and botnets supporting DDoS attacks are among the greatest beneficiaries of this malicious use. In this paper, we present an original approach that enables a collaborative egress detection of DDoS attacks leveraged by a botcloud. We provide an early evaluation of our approach using simulations that rely on real workload traces, showing our detection system effectiveness and low overhead, as well as its support for incremental deployment in real cloud infrastructures.

Cloud computing is gaining ground and becoming one of the fast growing segments of the IT industry. However, if its numerous advantages are mainly used to support a legitimate activity, it is now exploited for a use it was not meant for: malicious users leverage its power and fast provisioning to turn it into an attack support. Botnets supporting DDoS attacks are among the greatest beneficiaries of this malicious use since they can be setup on demand and at very large scale without requiring a long dissemination phase nor an expensive deployment costs. For cloud service providers, preventing their infrastructure from being turned into an Attack as a Service delivery model is very challenging since it requires detecting threats at the source, in a highly dynamic and heterogeneous environment. In this paper, we present the result of an experiment campaign we performed in order to understand the operational behavior of a botcloud used for a DDoS attack. The originality of our work resides in the consideration of system metrics that, while never considered for state-of-the-art botnets detection, can be leveraged in the context of a cloud to enable a source based detection. Our study considers both attacks based on TCP-flood and UDP-storm and for each of them, we provide statistical results based on a principal component analysis, that highlight the recognizable behavior of a botcloud as compared to other legitimate workloads.