Mohd. Hasan

M Sabbir Salek, Mashrur Chowdhury, Muhaimin Bin Munir et al.

Existing threat modeling frameworks related to transportation cyber-physical systems (CPS) are often narrow in scope, labor-intensive, and require substantial cybersecurity expertise. To this end, we introduce the Transportation Cybersecurity and Resiliency Threat Modeling Framework (TraCR-TMF), a large language model (LLM)-based threat modeling framework for transportation CPS that requires limited cybersecurity expert intervention. TraCR-TMF identifies threats, potential attack techniques, and relevant countermeasures for transportation CPS. Three LLM-based approaches support these identifications: (i) a retrieval-augmented generation approach requiring no cybersecurity expert intervention, (ii) an in-context learning approach with low expert intervention, and (iii) a supervised fine-tuning approach with moderate expert intervention. TraCR-TMF offers LLM-based attack path identification for critical assets based on vulnerabilities across transportation CPS entities. Additionally, it incorporates the Common Vulnerability Scoring System (CVSS) scores of known exploited vulnerabilities to prioritize threat mitigations. The framework was evaluated through two cases. First, the framework identified relevant attack techniques for various transportation CPS applications, 73% of which were validated by cybersecurity experts as correct. Second, the framework was used to identify attack paths for a target asset in a real-world cyberattack incident. TraCR-TMF successfully predicted exploitations, like lateral movement of adversaries, data exfiltration, and data encryption for ransomware, as reported in the incident. These findings show the efficacy of TraCR-TMF in transportation CPS threat modeling, while reducing the need for extensive involvement of cybersecurity experts. To facilitate real-world adoptions, all our codes are shared via an open-source repository.

Mohammad Imtiaz Hasan, Abyad Enan, Jean Michel Tine et al.

Connected Vehicles (CVs) rely extensively on communication technologies to enable data-driven predictive analyses for enhancing performance and safety. These communication channels can be exploited by adversaries to launch cyberattacks such as Sybil attacks, which could threaten both safety-critical and mobility applications, leaving CVs vulnerable and putting human lives at risk. As CV deployment continues to expand, the need to detect and mitigate cyberattacks in real-time becomes increasingly urgent. This study presents an in-vehicle Digital Twin (DT)-based collision warning framework with built-in capabilities for Sybil attacks detection. The framework integrates a Temporal Convolutional Network (TCN) for learning temporal dependencies in vehicle trajectory data and Hierarchical Navigable Small World (HNSW) algorithms for efficient similarity-based classification. Our framework is evaluated on real-world Sybil attack data, collected through field experiments. The framework achieved accuracy, recall, and F1 scores of 0.984, 1.00, and 0.944, respectively, in detecting Sybil-generated fake vehicles. During the safety evaluation, the framework reduced the mean Time Exposed Time-To-Collision (TET) and mean Time Integrated Time-To-Collision (TIT) of near-collision events by 88% and 72%, respectively. Furthermore, real-world feasibility evaluation shows that the framework conformed to the standardized maximum allowable latency for safety applications and operated well within the capacity of modern processors -- demonstrating the promise of an in-vehicle DT-based framework as an attack mitigation mechanism against Sybil attacks for next-generation CVs.