Akos Csilling

Threat Analysis and Risk Assessment (TARA) in automotive cybersecurity requires connecting cyber threat intelligence (CTI) with the architecture and technical context of the system under evaluation. However, relevant evidence is dispersed across heterogeneous repositories whose records do not directly establish automotive applicability or correspondence with regulatory threat categories. This paper presents an OWL 2 DL ontology linking structured CTI with automotive system concepts, selected ISO/SAE 21434 TARA concepts, UN Regulation No. 155 threat categories, and STRIDE classifications. A Neo4j implementation combines deterministic ingestion of CAPEC, CWE, and CVE/NVD records and their explicit cross-references with large-language-model-assisted candidate annotations for automotive relevance and contextual classification. Evaluation comprises ontology consistency checking with HermiT, competency-question assessment, and comparison with a human-curated automotive reference. HermiT reported no inconsistency or unsatisfiable classes. Of the 59 CAPEC Meta patterns in the reference, the evaluated output selected 52 as automotive-relevant (88.1%); label overlap was highest for technology domain (50/59) and STRIDE (49/59) and lowest for UN R155 threat categories (27/59). A headlamp proof of concept demonstrates node-centric retrieval of candidate regulatory threats, attack patterns, weaknesses, and vulnerabilities. The framework provides a semantic foundation for traceable TARA evidence preparation; product-specific applicability assessment and complete attack-path and risk analysis remain outside the demonstrated scope.

The proliferation of cyber–physical systems in modern vehicles, characterized by densely interconnected Electronic Control Units (ECUs) and heterogeneous communication networks, has significantly expanded the automotive attack surface. Traditional Threat Analysis and Risk Assessment (TARA) methodologies remain predominantly manual processes that exhibit limitations in scalability, and comprehensive threat identification. This research addresses these limitations by developing a formalized framework for automating attack path analysis within the automotive architecture. While attack graph methodologies have demonstrated efficacy in conventional information technology domains, their application within automotive cybersecurity contexts presents unique challenges stemming from domain-specific architectural constraints. We propose a novel Graph-based Attack Path Prioritization (GAPP) methodology that integrates Extended Finite State Machine (EFSM) modeling. Our implementation employs the Neo4j property graph database architecture to establish the mappings between architectural components, security states, and exploitation vectors. This research contributes a systematic approach to automotive security assessment, enhancing vulnerability identification capabilities while reducing analytical complexity.