@inproceedings{HachaniSteyFuxenetal., author = {Hachani, Murad and Stey, Miguel and Fuxen, Philipp and Graf, Julian and Hackenberg, Rudolf}, title = {GFDG: a genetic fuzzing method for the Controller Area Network Protocol}, series = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, booktitle = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, organization = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {40 -- 45}, abstract = {Ensuring the security of modern automotive systems is critical due to their increasing complexity and reliance on interconnected Electronic Control Units. The Controller Area Network still serves as a key communication protocol within these systems, making it a primary target for security testing. Traditional fuzz testing approaches for Controller Area Networks often rely on random or brute-force message generation, not leveraging the system's feedback to improve the generation process. This paper introduces the Genetic Fuzz Data Generator, a fuzzing method that leverages Genetic Algorithms and side-channel analysis to enhance Controller Area Network security testing. The Genetic Fuzz Data Generator dynamically refines its fuzzing strategy by evaluating system responses through side-channel data, such as processing unit temperatures and power supply variations. By structuring Controller Area Network messages as genetic individuals and applying evolutionary principles—including selection, crossover, and mutation—the Genetic Fuzz Data Generator systematically identifies active Controller Area Network IDs and generates targeted fuzz messages. Experimental validation was conducted on a real automotive electronic control unit within a controlled laboratory setup. The first results demonstrated the approach's effectiveness, revealing system anomalies, including a Denial of Service vulnerability that disrupted functions of the investigated Electronic Control Unit. The findings highlight the potential of feedback-driven fuzzing for improving the efficiency of black-box security testing in Controller Area Network-based systems. Future research could further optimize fitness functions or explore additional side-channel metrics.}, language = {en} } @inproceedings{ReichelGerstnerSchilleretal., author = {Reichel, Tobias and Gerstner, Mathias and Schiller, Leo and Attenberger, Andreas and Hackenberg, Rudolf and Dološ, Klara}, title = {A forensic analysis of GNSS spoofing attacks on autonomous vehicles}, series = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, booktitle = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, organization = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {32 -- 39}, abstract = {Global Navigation Satellite Systems (GNSSs) are essential for modern technology, enabling precise geographic positioning in aviation, maritime shipping, and automotive systems. In the future, their role will be even more critical for autonomous vehicles, which rely on accurate localization for navigation and decision-making. However, the increasing connectivity of autonomous vehicles exposes them to cyber threats, including GNSS spoofing attacks, which manipulate location data to mislead onboard systems. As reliance on GNSS grows, so does the risk posed by spoofing attacks, making it a critical security concern. This paper describes GNSS spoofing attacks on autonomous vehicles, focusing on their detection both during and after an attack. Furthermore, we analyze data storage strategies to facilitate effective forensic analysis. We highlight the importance of position, signal, and camera data, which should be preserved to ensure a comprehensive forensic investigation. Finally, we suggest a simulation setup that enables studying which data could be used for a forensic investigation. Additionally, we examine established data frameworks and decide whether they are suitable for detecting GNSS spoofing attacks.}, language = {en} } @inproceedings{GerstnerHackenberg, author = {Gerstner, Mathias and Hackenberg, Rudolf}, title = {Context-aware forecasting of mobile network quality for autonomous vehicle connectivity}, series = {Vehicular analytics 2025 : the second conference on vehicular systems}, booktitle = {Vehicular analytics 2025 : the second conference on vehicular systems}, publisher = {IARIA}, isbn = {978-1-68558-320-0}, doi = {10.35096/othr/pub-8616}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-86166}, pages = {7}, abstract = {As autonomous driving becomes increasingly feasible, the German government has introduced a legal framework to enable the operation with Level 4 automated driving functionality. A key requirement is the maintenance of a continuous connection between such vehicles and a remote technical supervisor. If this link is lost, the vehicle must transition into a safe state by bringing itself to a controlled stop. To mitigate the risk of connection loss, accurate forecasting of mobile network availability along routes is essential. This paper presents an Exploratory Data Analysis (EDA) based on 38 measurement runs collected over ten months along a rural 64 km route in Germany. The dataset includes passive mobile network signal quality parameters, Global Navigation Satellite System (GNSS) position and precision data, as well as contextual features, such as speed, driving direction, day of the week, weather, and distance to the connected base station. Although mean values capture overall tendencies for areas with consistently good or poor coverage, they fail to capture the variability necessary for reliable prediction on a per-trip basis. Notably, some route segments show high variance in signal quality across different measurement runs. This variability is assumed to result from changing environmental influences, such as weather or traffic conditions at different times. Our analysis reveals weak but statistically relevant correlations between several contextual features (e.g., temperature ≈ -0.2) and network quality indicators. The inclusion of weather parameters or the day of the week has been shown to lower the Mean Absolute Error (MAE) compared to a prediction based only on measurements from the past. These findings underscore the importance of contextual information and localized modeling to predict network availability for safety-critical systems, such as autonomous vehicles.}, language = {en} } @inproceedings{GrafHachaniFischeretal., author = {Graf, Julian and Hachani, Murad and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A heuristic packet processing model for improved encrypted network analysis}, series = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, booktitle = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, publisher = {ACM}, address = {New York, USA}, doi = {10.1145/3736130.3764510}, pages = {12}, abstract = {Modern networked systems, such as those in the automotive sector, face increasing complexity and growing attack surfaces due to the rise of interconnected and data-driven technologies. Detecting malicious behavior in these environments requires efficient and scalable methods that can operate reliably despite limited resources and high communication volumes. This paper proposes a heuristic packet processing model designed to support intrusion detection based on structural and temporal characteristics of encrypted network traffic. The model follows a modular architecture consisting of four key phases: recording, sorting, prioritizing, and analyzing. At the core of the approach is the Polymetric Queueing Topology Space, a feature space that combines statistical and time series attributes derived from model structure and flow data. These features serve as input for machine learning models, which can effectively distinguish between benign and intrusion traffic patterns without relying on packet data beyond the transport layer. The approach was evaluated using the publicly available ToN_IoT dataset and demonstrated that reliable classification is achievable using a subset of the developed feature space that contains model-derived traffic features. We used Random Forest for supervised binary and multi-class classification achieving high accuracy scores of 99\% for binary and 98\% for multi-class classification. Additionally, for unsupervised anomaly detection, we created an Isolation Forest model accomplishing F1-scores of 0.92 for the benign and 0.96 for intrusion class. The architecture is designed to enable dynamic traffic prioritization and to offer a flexible foundation that can observe diverse network domains while maintaining efficient performance under constrained computational conditions.}, language = {en} } @article{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Security risk analysis of the cloud infrastructure of Smart Grid and IoT - 4-Level-Trust-Model as a security solution}, series = {International Journal on Advances in Internet Technology}, volume = {13}, journal = {International Journal on Advances in Internet Technology}, number = {1\&2}, pages = {11 -- 20}, abstract = {The digital transformation has found its way into business and private life. It consists of digitization and digitaliza- tion. Digitization means the technical process and digitalization is the socio-technological process. Technologies of digitization are Cloud Computing (CC), Internet of Things (IoT) and Smart Grid (SG), which are separate technologies. The increasing digitalization in the private sector and of the energy industry connect these technologies. Actually, there is no connection between the CC infrastructure and the SG infrastructure at the moment, because in Germany the SG is currently under construction. If one looks at the CC and IoT, it must be stated there is an connection between the IoT infrastructure and the CC infrastructure as a service provider. To connect the technologies CC, IoT and SG and also build an SG cloud for innovative services, the new laws for privacy must be implemented. For privacy and security analyses it is important to know which data can be stored and distributed on a cloud. To illustrate this analysis, we connect the SG infrastructure with the IoT. An IoT device (car charging station) should be able to transfer data to and from the SG. SG is a critical infrastructure and the IoT device a potential insecure device and network. We show the communication between the smart meter switching box and the IoT device and the data transferred between their clouds. The charging station is connected to the SG to get the current amount of renewable energy in the grid. This is necessary to create a new smart service. But this service also generates private data (e.g., name, address, payment details). The private data should not be transferred to the IoT cloud. For the connection of SG and IoT, availability, confidentiality and integrity must be ensured. A risk analysis over all the cloud connections, including the vulnerability and the ability of an attacker, the resulting risk and the 4-Level- Trust-Model for security assessment are developed. Furthermore, we show the application of the 4-Level-Trust-Model in this paper.}, language = {en} } @inproceedings{SchoenhaerlFuxenGrafetal., author = {Sch{\"o}nh{\"a}rl, Stefan and Fuxen, Philipp and Graf, Julian and Schmidt, Jonas and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {An Automotive Penetration Testing Framework for IT-Security Education}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {1 -- 6}, abstract = {Automotive Original Equipment Manufacturer (OEM) and suppliers started shifting their focus towards the security of their connected electronic programmable products recently since cars used to be mainly mechanical products. However, this has changed due to the rising digitalization of vehicles. Security and functional safety have grown together and need to be addressed as a single issue, referred to as automotive security, in the following article. One way to accomplish security is automotive security education. The scientific contribution of this paper is to establish an Automotive Penetration Testing Education Platform (APTEP). It consists of three layers representing different attack points of a vehicle. The layers are the outer, inner, and core layers. Each of those contains multiple interfaces, such as Wireless Local Area Network (WLAN) or electric vehicle charging interfaces in the outer layer, message bus systems in the inner layer, and debug or diagnostic interfaces in the core layer. One implementation of APTEP is in a hardware case and as a virtual platform, referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theory, such as constructivism and problem-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH)Regensburg experienced the challenges as part of a special topic course and provided positive feedback.}, language = {en} }