Conference
From TARA to CAN firewall rules
| Τίτλος: | From TARA to CAN firewall rules |
|---|---|
| Συγγραφείς: | Navarra, Luca, Cornelio, Anastasia (Dr. rer. nat.), Romano, Simon Pietro (Prof. Dr.-Ing.) |
| Έτος έκδοσης: | 2026 |
| Συλλογή: | Dokumentenrepositorium der RUB / RUB-Repository (Ruhr-Universität Bochum) |
| Θεματικοί όροι: | ddc:004 |
| Περιγραφή: | Translating cybersecurity risk assessments into concrete and enforceable in-vehicle security controls remains a critical challenge in automotive engineering. Although ISO/SAE 21434 defines a structured Threat Analysis and Risk Assessment (TARA) process, the derivation of implementation-level countermeasures, such as CAN-based firewall policies, is largely left unspecified and is typically performed manually, limiting scalability, consistency, and traceability across modern vehicle network architectures. This work presents a risk-driven methodology and an automated tool for deriving CAN firewall rules directly from TARA artifacts. Threat scenarios and mitigated attack paths are correlated with vehicle network descriptions to generate gateway-enforceable policies such as identifier whitelisting, rate limiting, and payload-aware inspection, with explicit traceability to cybersecurity risks. To address the lack of semantic information in network databases, the approach introduces an LLM-assisted, human-in-the-loop workflow for identifying security-critical signals within protected CAN frames using functional specifications and damage scenarios. A multi-agent architecture is adopted to decompose semantic extraction, threat-driven reasoning, and adversarial validation, improving robustness compared to single-agent configurations while preserving engineering oversight. The proposed solution is evaluated on industrial automotive data through an expert-based assessment involving two independent domain specialists. The results show that deterministic automation, complemented by conservative and human-supervised AI assistance, significantly reduces manual engineering effort while maintaining consistency with expert assessments and alignment with ISO/SAE 21434. |
| Τύπος εγγράφου: | conference object |
| Περιγραφή αρχείου: | application/pdf |
| Γλώσσα: | English |
| Διαθεσιμότητα: | https://hss-opus.ub.ruhr-uni-bochum.de/opus4/frontdoor/index/index/docId/14794 https://nbn-resolving.org/urn:nbn:de:hbz:294-147946 https://hss-opus.ub.ruhr-uni-bochum.de/opus4/files/14794/Paper6.pdf |
| Rights: | https://hss-opus.ub.ruhr-uni-bochum.de/opus4/default/license/index/licId/11 ; info:eu-repo/semantics/openAccess |
| Αριθμός Καταχώρησης: | edsbas.9F79BC9A |
| Βάση Δεδομένων: | BASE |
| FullText | Text: Availability: 0 CustomLinks: – Url: https://hss-opus.ub.ruhr-uni-bochum.de/opus4/frontdoor/index/index/docId/14794# Name: EDS - BASE (ns324271) Category: fullText Text: View record from BASE |
|---|---|
| Header | DbId: edsbas DbLabel: BASE An: edsbas.9F79BC9A RelevancyScore: 1026 AccessLevel: 3 PubType: Conference PubTypeId: conference PreciseRelevancyScore: 1025.63562011719 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: From TARA to CAN firewall rules – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Navarra%2C+Luca%22">Navarra, Luca</searchLink><br /><searchLink fieldCode="AR" term="%22Cornelio%2C+Anastasia+%28Dr%2E+rer%2E+nat%2E%29%22">Cornelio, Anastasia (Dr. rer. nat.)</searchLink><br /><searchLink fieldCode="AR" term="%22Romano%2C+Simon+Pietro+%28Prof%2E+Dr%2E-Ing%2E%29%22">Romano, Simon Pietro (Prof. Dr.-Ing.)</searchLink> – Name: DatePubCY Label: Publication Year Group: Date Data: 2026 – Name: Subset Label: Collection Group: HoldingsInfo Data: Dokumentenrepositorium der RUB / RUB-Repository (Ruhr-Universität Bochum) – Name: Subject Label: Subject Terms Group: Su Data: <searchLink fieldCode="DE" term="%22ddc%3A004%22">ddc:004</searchLink> – Name: Abstract Label: Description Group: Ab Data: Translating cybersecurity risk assessments into concrete and enforceable in-vehicle security controls remains a critical challenge in automotive engineering. Although ISO/SAE 21434 defines a structured Threat Analysis and Risk Assessment (TARA) process, the derivation of implementation-level countermeasures, such as CAN-based firewall policies, is largely left unspecified and is typically performed manually, limiting scalability, consistency, and traceability across modern vehicle network architectures. This work presents a risk-driven methodology and an automated tool for deriving CAN firewall rules directly from TARA artifacts. Threat scenarios and mitigated attack paths are correlated with vehicle network descriptions to generate gateway-enforceable policies such as identifier whitelisting, rate limiting, and payload-aware inspection, with explicit traceability to cybersecurity risks. To address the lack of semantic information in network databases, the approach introduces an LLM-assisted, human-in-the-loop workflow for identifying security-critical signals within protected CAN frames using functional specifications and damage scenarios. A multi-agent architecture is adopted to decompose semantic extraction, threat-driven reasoning, and adversarial validation, improving robustness compared to single-agent configurations while preserving engineering oversight. The proposed solution is evaluated on industrial automotive data through an expert-based assessment involving two independent domain specialists. The results show that deterministic automation, complemented by conservative and human-supervised AI assistance, significantly reduces manual engineering effort while maintaining consistency with expert assessments and alignment with ISO/SAE 21434. – Name: TypeDocument Label: Document Type Group: TypDoc Data: conference object – Name: Format Label: File Description Group: SrcInfo Data: application/pdf – Name: Language Label: Language Group: Lang Data: English – Name: URL Label: Availability Group: URL Data: https://hss-opus.ub.ruhr-uni-bochum.de/opus4/frontdoor/index/index/docId/14794<br />https://nbn-resolving.org/urn:nbn:de:hbz:294-147946<br />https://hss-opus.ub.ruhr-uni-bochum.de/opus4/files/14794/Paper6.pdf – Name: Copyright Label: Rights Group: Cpyrght Data: https://hss-opus.ub.ruhr-uni-bochum.de/opus4/default/license/index/licId/11 ; info:eu-repo/semantics/openAccess – Name: AN Label: Accession Number Group: ID Data: edsbas.9F79BC9A |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=edsbas&AN=edsbas.9F79BC9A |
| RecordInfo | BibRecord: BibEntity: Languages: – Text: English Subjects: – SubjectFull: ddc:004 Type: general Titles: – TitleFull: From TARA to CAN firewall rules Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Navarra, Luca – PersonEntity: Name: NameFull: Cornelio, Anastasia (Dr. rer. nat.) – PersonEntity: Name: NameFull: Romano, Simon Pietro (Prof. Dr.-Ing.) IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 01 Type: published Y: 2026 Identifiers: – Type: issn-locals Value: edsbas – Type: issn-locals Value: edsbas.oa |
| ResultId | 1 |