@inproceedings{FischerTolvanenTavakoliKolagari2024, author = {Fischer, Alexander and Tolvanen, Juha-Pekka and Tavakoli Kolagari, Ramin}, title = {Automotive Cybersecurity Engineering with Modeling Support}, series = {Annals of Computer Science and Information Systems}, volume = {39}, booktitle = {Annals of Computer Science and Information Systems}, publisher = {IEEE}, isbn = {978-83-969601-6-0}, issn = {2300-5963}, doi = {10.15439/2024F5017}, pages = {319 -- 329}, year = {2024}, abstract = {Rapid advances of connected and autonomous vehicle technology have led to an increase in cyber-attacks. This in turn has driven the development of the ISO 21434 standard aimed at supporting the management of cybersecurity risks in the automotive industry. There is, however, a disconnect between the standard and the currently applied model-based development approaches that are increasingly applied for systems and software development. In this paper, we present tool support created for model-based automotive cybersecurity engineering. This tool is built upon the existing automotive systems development language, EAST-ADL, with extensions to address security in accordance with the ISO 21434 standard covering modeling support, calculation of security-related metrics such as impact, risk, and attack feasibility, and generation of ISO 21434 compliant security threat reports. Meeting the requirements of cybersecurity engineeering according to ISO 21434 are demonstrated with two examples.}, language = {en} } @inproceedings{FischerTavakoliKolagari2024, author = {Fischer, Alexander and Tavakoli Kolagari, Ramin}, title = {Harmonization of Security Standards for Embedded Systems in a Comprehensive Metamodel: The Security Abstraction Model}, series = {24th International Conference on Software Quality, Reliability, and Security Companion (QRS-C)}, booktitle = {24th International Conference on Software Quality, Reliability, and Security Companion (QRS-C)}, publisher = {IEEE}, isbn = {979-8-3503-6565-8}, doi = {10.1109/QRS-C63300.2024}, pages = {1314 -- 1315}, year = {2024}, abstract = {The development of reliable systems is inextricably linked to the consideration of security aspects during the development process. Especially in the context of autonomous vehicles, security is crucial to ensure user trust in this technology. This work presents an overview of the harmonization of the Security Abstration Model (SAM). The results demonstrate that our approach is compliant with relevant security standards for embedded systems, indicating compliance and robustness. The utilization of SAM improves conceptual understanding and promotes clarity in security engineering.}, language = {en} } @incollection{FischerTolvanenTavakoliKolagari2025, author = {Fischer, Alexander and Tolvanen, Juha-Pekka and Tavakoli Kolagari, Ramin}, title = {Embedded Systems Security Co-design: Modeling Support for Managers and Developers}, series = {Lecture Notes in Business Information Processing}, booktitle = {Lecture Notes in Business Information Processing}, publisher = {Springer Nature Switzerland}, address = {Cham}, isbn = {978-3-031-84913-8}, issn = {1865-1348}, doi = {10.1007/978-3-031-84913-8_8}, pages = {206 -- 232}, year = {2025}, abstract = {The proliferation of connected and autonomous vehicle technologies has significantly increased cybersecurity risks. Modern vehicles, as complex and networked computer systems, require comprehensive protection against malicious external attacks, much like conventional computers. Addressing these challenges requires robust tools that align established automotive model-based development approaches with the ISO/SAE 21434 standard for automotive cybersecurity, which became mandatory following its publication in 2021. Building on prior research, this paper introduces key innovations in the conceptual framework and the tool support that integrate seamlessly into existing automotive development methodologies. These advancements are rooted in extensions to the Security Abstraction Model (SAM) informed by the ISO/SAE 21434 standard. Notably, SAM now incorporates advanced methods for score calculation, including an attack potential-based approach for assessing attack feasibility and the computation of risk scores using risk matrices. Usability improvements are also a contribution, achieved through the introduction of BPMN-style (Business Process Model and Notation) diagrams tailored for the accessible visualization of otherwise complex security models. These diagrams make multifaceted attack trees easier to interpret, enabling managers and other non-technical stakeholders to intuitively understand security vulnerabilities and make informed decisions. Additionally, the tool supports updated metrics for impact and risk analysis, demonstrated through practical applications involving automotive subsystems such as braking. These examples illustrate improved traceability between SAM and functional design, ensuring that cybersecurity requirements are effectively integrated into the broader development lifecycle.}, language = {en} } @inproceedings{FischerBurkTavakoliKolagarietal.2025, author = {Fischer, Alexander and Burk, Louis and Tavakoli Kolagari, Ramin and Wienkop, Uwe}, title = {Machine-Readable by Design: Language Specifications as the Key to Integrating LLMs into Industrial Tools}, series = {Annals of Computer Science and Information Systems}, volume = {43}, booktitle = {Annals of Computer Science and Information Systems}, publisher = {IEEE}, isbn = {978-83-973291-6-4}, issn = {2300-5963}, doi = {10.15439/2025F5613}, pages = {531 -- 542}, year = {2025}, abstract = {We propose a meta-language-based approach enabling Large Language Models (LLMs) to reliably generate structured, machine-readable artifacts referred to as Meta-Language-defined Structures (MLDS) adapted to domain requirements, without adhering strictly to standard formats like JSON or XML. By embedding explicit schema instructions within prompts, we evaluated the method across diverse use cases, including automated Virtual Reality environment generation and automotive security modeling. Our experiments demonstrate that the meta-language approach significantly improves LLM-generated structure compliance, with an 88 \% validation rate across 132 test scenarios. Compared to traditional methods using LangChain and Pydantic, our MLDS method reduces setup complexity by approximately 80 \%, despite a marginally higher error rate. Furthermore, the MLDS artifacts produced were easily editable, enabling rapid iterative refinement. This flexibility greatly alleviates the "blank page syndrome" by providing structured initial artifacts suitable for immediate use or further human enhancement, making our approach highly practical for rapid prototyping and integration into complex industrial workflows.}, language = {en} } @inproceedings{FischerTavakoliKolagari2024, author = {Fischer, Alexander and Tavakoli Kolagari, Ramin}, title = {Towards Robust Autonomous Vehicle Software: Extending SAM for a Holistic Security Analysis}, series = {2024 8th International Conference on System Reliability and Safety (ICSRS)}, booktitle = {2024 8th International Conference on System Reliability and Safety (ICSRS)}, publisher = {IEEE}, isbn = {979-8-3503-5450-8}, doi = {10.1109/ICSRS63046.2024.10927601}, pages = {578 -- 586}, year = {2024}, abstract = {The Security Abstraction Model (SAM) is a meta-model that enables comprehensive security modeling and does not only consider technological aspects, but also takes into consideration the influence of social engineering. This plays an important role by exploiting vulnerabilities in human behavior and thus represents a dimension that must not be neglected in possible attacks on vehicle systems. This work is dedicated to the advancement of the Security Abstraction Model (SAM) with the aim of enabling improved modelling and analysis of vulnerabilities in the context of software and system security; the relevant standards and best practices of the international security literature for embedded systems are harmonized in one metamodel. By extending SAM, this research enables a more nuanced understanding and representation of vulnerabilities, attacks and scenarios, improving the effectiveness of security analysis and remediation strategies. The integration of different perspectives, including technological, social and behavioral factors, underlines the comprehensive nature of the proposed model. This interdisciplinary approach recognizes the complexity of security threats in autonomous vehicle systems and enables stakeholders to develop more effective countermeasures. This work presents an overview of the extension of the Security Abstration Model (SAM) and evaluates this security technology through expert interviews. The results demonstrate that our approach is compliant not only in the automotive domain, but also with standards for embedded systems from other domains. It thus provides a comprehensive and universal approach for the development of secure systems.}, language = {en} }