Threat Analysis and Detection in In-Vehicle Infotainment System Leveraging MITRE ATT&CK and Suricata

Explore cybersecurity vulnerabilities in automotive in-vehicle infotainment (IVI) systems through this 15-minute conference presentation from VehicleSec '25. Examine how IVI systems, which serve as central consoles offering convenient features and comprehensive vehicle management, have evolved to handle privacy-sensitive data while creating new attack surfaces for malicious actors. Investigate 11 distinct attack scenarios targeting Automotive Grade Linux (AGL), the predominant operating system used in IVI systems, and learn how these scenarios map to tactics, techniques, and procedures (TTPs) defined in the MITRE ATT&CK framework. Discover how attack scenarios are categorized into five classifications based on attacker intent and system impact levels, and understand the development of multi-phase attack sequences that integrate three to four scenarios targeting specific applications. Analyze the methodology for detecting four selected attack scenarios using Suricata, a network-based intrusion detection system, and gain insights into how this research informs IVI defense development, security response strategies, and supports vehicle security certification and compliance efforts.