DataSys 2023 Congress
June 26, 2023 to June 30, 2023 - Nice, Saint-Laurent-du-Var, France

  • AICT 2023, The Nineteenth Advanced International Conference on Telecommunications
  • ICIW 2023, The Eighteenth International Conference on Internet and Web Applications and Services
  • ICIMP 2023, The Eighteenth International Conference on Internet Monitoring and Protection
  • SMART 2023, The Twelfth International Conference on Smart Cities, Systems, Devices and Technologies
  • IMMM 2023, The Thirteenth International Conference on Advances in Information Mining and Management
  • INFOCOMP 2023, The Thirteenth International Conference on Advanced Communications and Computation
  • MOBILITY 2023, The Thirteenth International Conference on Mobile Services, Resources, and Users
  • SPWID 2023, The Ninth International Conference on Smart Portable, Wearable, Implantable and Disability-oriented Devices and Systems
  • ACCSE 2023, The Eighth International Conference on Advances in Computation, Communications and Services

ComputationWorld 2023 Congress
June 26, 2023 to June 30, 2023 - Nice, Saint-Laurent-du-Var, France

  • SERVICE COMPUTATION 2023, The Fifteenth International Conference on Advanced Service Computing
  • CLOUD COMPUTING 2023, The Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization
  • FUTURE COMPUTING 2023, The Fifteenth International Conference on Future Computational Technologies and Applications
  • COGNITIVE 2023, The Fifteenth International Conference on Advanced Cognitive Technologies and Applications
  • ADAPTIVE 2023, The Fifteenth International Conference on Adaptive and Self-Adaptive Systems and Applications
  • CONTENT 2023, The Fifteenth International Conference on Creative Content Technologies
  • PATTERNS 2023, The Fifteenth International Conference on Pervasive Patterns and Applications
  • COMPUTATION TOOLS 2023, The Fourteenth International Conference on Computational Logics, Algebras, Programming, Tools, and Benchmarking
  • BUSTECH 2023, The Thirteenth International Conference on Business Intelligence and Technology

NetWare 2023 Congress
September 25, 2023 to September 29, 2023 - Porto, Portugal

  • SENSORCOMM 2023, The Seventeenth International Conference on Sensor Technologies and Applications
  • SENSORDEVICES 2023, The Fourteenth International Conference on Sensor Device Technologies and Applications
  • SECURWARE 2023, The Seventeenth International Conference on Emerging Security Information, Systems and Technologies
  • AFIN 2023, The Fifteenth International Conference on Advances in Future Internet
  • CENICS 2023, The Sixteenth International Conference on Advances in Circuits, Electronics and Micro-electronics
  • ICQNM 2023, The Seventeenth International Conference on Quantum, Nano/Bio, and Micro Technologies
  • FASSI 2023, The Ninth International Conference on Fundamentals and Advances in Software Systems Integration
  • GREEN 2023, The Eighth International Conference on Green Communications, Computing and Technologies

NexTech 2023 Congress
September 25, 2023 to September 29, 2023 - Porto, Portugal

  • UBICOMM 2023, The Seventeenth International Conference on Mobile Ubiquitous Computing, Systems, Services and Technologies
  • ADVCOMP 2023, The Seventeenth International Conference on Advanced Engineering Computing and Applications in Sciences
  • SEMAPRO 2023, The Seventeenth International Conference on Advances in Semantic Processing
  • AMBIENT 2023, The Thirteenth International Conference on Ambient Computing, Applications, Services and Technologies
  • EMERGING 2023, The Fifteenth International Conference on Emerging Networks and Systems Intelligence
  • DATA ANALYTICS 2023, The Twelfth International Conference on Data Analytics
  • GLOBAL HEALTH 2023, The Twelfth International Conference on Global Health Challenges
  • CYBER 2023, The Eighth International Conference on Cyber-Technologies and Cyber-Systems

TrendNews 2023 Congress
September 25, 2023 to September 29, 2023 - Porto, Portugal

  • CORETA 2023, Advances on Core Technologies and Applications
  • DIGITAL 2023, Advances on Societal Digital Transformation

SocSys 2023 Congress
November 13, 2023 to November 17, 2023 - Valencia, Spain

SoftNet 2023 Congress
November 13, 2023 to November 17, 2023 - Valencia, Spain

  • ICSEA 2023, The Eighteenth International Conference on Software Engineering Advances
  • ICSNC 2023, The Eighteenth International Conference on Systems and Networks Communications
  • CENTRIC 2023, The Sixteenth International Conference on Advances in Human-oriented and Personalized Mechanisms, Technologies, and Services
  • VALID 2023, The Fifteenth International Conference on Advances in System Testing and Validation Lifecycle
  • SIMUL 2023, The Fifteenth International Conference on Advances in System Simulation
  • SOTICS 2023, The Thirteenth International Conference on Social Media Technologies, Communication, and Informatics
  • INNOV 2023, The Twelfth International Conference on Communications, Computation, Networks and Technologies
  • HEALTHINFO 2023, The Eighth International Conference on Informatics and Assistive Technologies for Health-Care, Medical Support and Wellbeing

IARIA Congress 2023, The 2023 IARIA Annual Congress on Frontiers in Science, Technology, Services, and Applications
November 13, 2023 to November 17, 2023 - Valencia, Spain

 

 

ThinkMind // CYBER 2022, The Seventh International Conference on Cyber-Technologies and Cyber-Systems // View article cyber_2022_1_60_80032

Attack Path Generation Based on Attack and Penetration Testing Knowledge

Authors:
Florian Sommer
Reiner Kriesten

Keywords: security testing; automation; tester experience.

Abstract:
To protect modern vehicles against security attacks, new standards, such as ISO/SAE 21434, and regulations, such as UN R155, require security testing activities during development. For this purpose, penetration testing is often used, which is a manually performed, experience-based, and explorative test method. Due to the high complexity of modern vehicles, manual penetration testing methods reach their limits. As a result, potential vulnerabilities could be overlooked and thus remain in the vehicle. In case of a security attack, this can endanger passengers and road traffic participants. So far, penetration testing has been considered as difficult to automate, since it is an experience-based method. This paper presents a model-based approach which aims close that gap. Our approach uses knowledge of existing security attacks on vehicles to automate the security testing process. We apply our attack database (361 attacks, consisting of 621 attack steps) to a formal security model to automatically derive attack paths for testing. We also present a proposal of how this method can be transferred to derive attack paths based on knowledge and experience of penetration testers.

Pages: 36 to 41

Copyright: Copyright (c) IARIA, 2022

Publication date: November 13, 2022

Published in: conference

ISSN: 2519-8599

ISBN: 978-1-61208-996-6

Location: Valencia, Spain

Dates: from November 13, 2022 to November 17, 2022

SERVICES CONTACT
2010 - 2022 © ThinkMind. All rights reserved.
Read Terms of Service and Privacy Policy.