TY - CONF A1 - Weiss, Nils A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Automated Threat Evaluation of Automotive Diagnostic Protocols T2 - ESCAR USA, 2021, Virtual N2 - Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime. KW - Automotive Diagnostic Protocols KW - Security Metrics KW - Automated Network Scan Y1 - 2021 UR - https://opus4.kobv.de/opus4-oth-regensburg/frontdoor/index/index/docId/2988 UR - https://nbn-resolving.org/urn:nbn:de:bvb:898-opus4-29882 ER -