Feasibility study of Generative AI in Automotive Cybersecurity Threat Modelling

由于AECS（自动、电动、互联和共享）技术的进步，交通运输行业正在经历一场革命性的变革。这导致了汽车专用网络安全工具的创新浪潮。随着汽车越来越多地由软件定义和联网，网络攻击的风险呈指数级上升，汽车网络安全成为一项重大挑战。此外，汽车网络安全现在在UNECE国家受到监管，这进一步增加了行业遵守ISO/SAE 21434标准、UNECE R155/R156法规的压力。如果不采取网络安全措施，2024年7月以后将无法进入市场。最近发布的ISO/SAE 21434标准包括第15条和第8条，其中描述了进行威胁和风险评估（TARA）以及管理汽车产品漏洞的过程和要求。然而，这些标准并不提倡或强制使用特定的网络安全工具来进行风险评估和漏洞管理。目前的汽车网络安全工具是手动的、劳动密集型的、成本高昂的，而且缺乏自动化，导致风险评估和威胁建模缓慢、无法管理。随着数字化和软件导向车辆的增加，网络安全变得至关重要。当前工具的不足之处在于，需要一种满足监管标准的解决方案，同时简化和自动化网络安全风险评估和威胁建模。Secure Elements创新的CRISKLE是一种尖端的软件即服务（SaaS）平台，用于进行威胁和风险评估、漏洞管理和威胁建模。CRISKLE自动化了ISO/SAE 21434标准第15条和第8条中概述的要求，集成了UNECE WP 29附件5中的威胁建模场景和基于项目需求的定制场景。然而，有必要使用生成式人工智能生成和自动化威胁库/场景，以增强CRISKLE的智能，指导安全专业人员进行风险评估，并根据新的威胁模型生成安全控制。通过在CRISKLE中集成生成式AI，我们的目标是开发更有效的网络安全威胁模型。这项可行性研究为探索生成式人工智能在交通（汽车）网络安全行业中尚未开发的潜力提供了机会，超越了生成威胁模型和安全控制的传统方法，从而提高和加速了CRISKLE的有效性。通过这项可行性研究，我们将与生成式人工智能和汽车网络安全领域的领先专家合作，充分利用我们团队在这两个领域的专业知识。这项研究是将我们定位在交通网络安全革命前沿的关键一步，为将集成了生成式人工智能功能的增强网络安全工具解决方案推向大众市场铺平了道路。

The transportation industry is experiencing a revolutionary transformation due to advancements in AECS (autonomous, electric, connected, and shared) technology. This has led to a wave of innovations in automotive-specific cybersecurity tooling. As vehicles become increasingly software-defined and connected, the risk of cyber-attacks rises exponentially, making automotive cybersecurity a critical challenge. Moreover, automotive cybersecurity is now regulated in the UNECE countries, adding further pressure on the industry to comply with the ISO/SAE 21434 standard, UNECE R155/R156 regulation. Failure to implement cybersecurity measures will result in the loosing access to market after July 2024\.The recently published ISO/SAE 21434 standard includes clauses 15 and 8, which describe the process and requirements for conducting threat and risk assessments (TARA) and managing vulnerabilities for automotive products. However, the standards do not promote or mandate specific cybersecurity tools for conducting risk assessments and vulnerability management.The current state of automotive cybersecurity tooling is manual, labour-intensive, costly, and lacks automation, resulting in slow, unmanaged risk assessments and threat modelling. With increasing digitisation and software-oriented vehicles, cybersecurity becomes crucial. The inadequacy of the current tooling demands a solution that meets regulatory standards while streamlining and automating cybersecurity risk assessments and threat modelling.Secure Elements innovation CRISKLE, is a cutting-edge software as a service (SaaS) platform for conducting threat and risk assessments, vulnerability management and threat modelling. CRISKLE automates requirements outlined in Clause 15 and Clause 8 of the ISO/SAE 21434 standard, integrating threat modelling scenarios from UNECE WP 29 Annex 5 and customised scenarios based on project needs. However, there is a need to generate and automate threat libraries/scenarios using Generative AI to enhance CRISKLE's intelligence to guide security professionals in conducting risk assessments and generating security controls based on the new threat models.By integrating Generative AI in CRISKLE, we aim to develop more effective cybersecurity threat models.This feasibility study presents an opportunity to explore the untapped potential of Generative AI in the transportation (automotive) cybersecurity industry, moving beyond traditional methods of generating threat models and security controls thereby improving and accelerating the effectiveness of CRISKLE.Through this feasibility study, we will collaborate with leading experts in Generative AI and automotive cybersecurity, leveraging our team's expertise in both domains. This study is a crucial step in positioning ourselves at the forefront of the transportation cybersecurity revolution paving the way for enhanced cybersecurity tooling solutions with integrated Generative AI capability to be made available to mass market.