Unmanned ground vehicles (UGVs), including autonomous vehicles (AVs), are increasingly deployed across civilian, industrial, and defence environments. Their growing complexity across sensors, controllers, communication modules, and critical functional software also increases their exposure to cyber threats. Although current research on UGV cybersecurity provides valuable insights, it remains fragmented and often focuses on isolated attacks or individual defences without offering a consolidated security perspective. Existing resources, such as MITRE ATT&CK, AUTO-ISAC’s Automotive Threat Matrix, and NIST 800-160, provide useful guidance; however, they are designed for other domains and do not fully capture the operational characteristics and requirements of UGVs. This paper addresses this gap by developing a unified offensive and defensive framework specifically for UGVs. It organises existing literature into UGV-specific tactics, techniques, and asset dependencies, and pairs them with a UGV-focused mitigation database mapped to relevant security controls. Unlike prior efforts, this work integrates these components into a single coherent model, forming the first consolidated cyber offence–defence matrix tailored to UGV operations. To demonstrate the applicability of the framework, we analyse the 2014 Jeep Cherokee remote compromise and map its attack chain into the UGV threat structure. We also evaluate how mitigation strategies align with attack techniques by implementing three representative defences using the CARLASec simulation platform. Finally, we identify remaining gaps in current defences and point to areas requiring further development to improve UGV resilience.

The Internet of Things (IoT) comprises interconnected physical devices, ranging from smartphones to household appliances, that communicate wirelessly over the internet. As IoT networks grow in complexity, new cybersecurity risks continue to emerge, with cybercriminals exploiting unprotected vulnerabilities. While various security solutions have been developed, traditional network intrusion detection systems (NIDS) often struggle to detect novel cyberattacks, limiting their adaptability to evolving cyberattacks. This paper addresses these limitations by proposing a decision framework that integrates three models to classify IoT traffic as benign, a known attack and type, or a novel attack. The framework consists of: 1) a binary neural network that distinguishes benign traffic from any attack, 2) a multi-class neural network that classifies traffic as benign or one of known attack types, and 3) a k -Nearest Neighbors (KNN) model that assesses packet similarity to known attack patterns. By combining these models through ensemble voting and leveraging distance metrics, the proposed framework effectively identifies known and novel attacks. Using two benchmark datasets, the framework demonstrated considerable detection rates for novel attacks, which conventional supervised baseline models failed to achieve, while retaining strong performance in known attack detection and categorization. These findings offer valuable insights for both academia and industry, contributing to the development of more adaptive IoT security solutions.

The growing reliance on digital technologies onboard vessels has significantly increased their attack surface. As a result, both IT and OT systems are now vulnerable to a range of cyberattacks. However, existing methods used to assess vulnerability and threats often rely on outdated threat or vulnerability information, limiting their effectiveness. Consequently, a more proactive approach to assessing the security of vessel systems is needed. Threat hunting offers a proactive way of gathering the latest threat and vulnerability data from operational maritime vessels, which can be used for comprehensive security assessments. However, there is a lack of systems specifically designed to perform both threat-hunting and security assessment operations. In this paper, we propose a threat-hunting and security assessment framework that collects and processes real-time data from vessels and conducts security analysis using a graphical security model designed for vessel systems. Our approach demonstrates how the collected information can be used to evaluate a ship’s security posture by simulating potential attack scenarios and understanding how an adversary might attempt to compromise the vessel’s network. It also provides a foundation for more informed, data-driven cybersecurity strategies for the unique systems found onboard maritime vessels.

The robustness of YOLOv5-based camera perception for autonomous driving was systematically evaluated under diverse visual perturbations and spectral configurations using the CARLA simulation environment. An agent-camera framework decoupled perception from vehicle control, enabling consistent testing across 20 configurations and 200 trials (104,231 frames) covering four color modes (RGB, red, green, blue) and five perturbation types (salt-and-pepper noise, Gaussian noise, blur, contrast enhancement, baseline). Results revealed counterintuitive robustness patterns: contrast enhancement and green-channel filtering each improved detection by 37%, while salt-and-pepper noise caused an 83% degradation. The optimal combination-red filtering with contrast enhancement-yielded a 42% gain, demonstrating synergistic effects between spectral and photometric factors. However, confidence scores remained nearly constant (0.55-0.65 range) despite large accuracy fluctuations, indicating that confidence-based monitoring fails to reflect true perception reliability. These findings highlight that lightweight spectral filtering and contrast optimization can enhance perception robustness, while safe deployment requires complementary reliability modeling and sensor redundancy to ensure dependable autonomous vision.

An in-vehicle infotainment (IVI) system is connected to heterogeneous networks such as Controller Area Network bus, Bluetooth, Wi-Fi, cellular, and other vehicle-to-everything communications. An IVI system has control of a connected vehicle and deals with privacy-sensitive information like current geolocation and destination, phonebook, SMS, and driver's voice. Several offensive studies have been conducted on IVI systems of commercialized vehicles to show the feasibility of car hacking. However, to date, there has been no comprehensive analysis of the impact and implications of IVI system exploitations. To understand security and privacy concerns, we provide our experience hosting an IVI system hacking competition, Cyber Security Challenge 2021 (CSC2021). We use a feature-flavored infotainment operating system, Automotive Grade Linux (AGL). The participants gathered and submitted 33 reproducible and verified proofs-of-concept exploit codes targeting 11 components of the AGL-based IVI testbed. The participants exploited four vulnerabilities to steal various data, manipulate the IVI system, and cause a denial of service. The data leakage includes privacy, personally identifiable information, and cabin voice. The participants proved lateral movement to electronic control units and smartphones. We conclude with lessons learned with three mitigation strategies to enhance the security of the IVI system.