Vehicle security monitoring for critical infrastructure (CRITIS 2025)
From 21 to 23 October 2025 we presented our current research at CRITIS 2025, the 20th International Conference on Critical Information Infrastructures Security, at Jönköping University in Sweden.
Our paper: "Towards a Holistic and Multi-Modal Vehicle Security Monitoring"
Ali Recai Yekta presented our paper in the "Vehicles" session. It was written together with our team (Cenk Yekta) and our FINESSE partners INCYDE (Dominik Spychalski, Markus Heinrich, Christoph Krauß) and the University of Passau (Prof. Stefan Katzenbeisser).
The core argument
Vehicles today are highly connected, complex systems, and they need security monitoring built for them. The difficulty: monitoring vehicles and building a Vehicle Security Operations Center (VSOC) is fundamentally different from running a classic IT or OT SOC.
The differences that matter:
- Vehicles are mobile, distributed assets with changing connectivity
- Heterogeneous systems with a wide range of protocols and interfaces
- Multi-modal data sources, from in-vehicle sensors to backend systems
- Specific requirements for automotive and for rail
Our paper looks at how a Vehicle Security Operations Center can be designed for the automotive and rail industries, and what each domain can take from the other. We propose an approach that combines fleet data with background information from the automotive environment and uses a formalised data model to assemble the monitored information into one picture of the security situation.
From the conference
CRITIS 2025 covered a wide range of work on cyber-physical systems and the security of critical infrastructure. The keynote by Annelie Mannerström, CISO of Jönköping Energi, was one of the most useful sessions: a report from inside a mid-sized energy company, and the concrete security problems an operator of critical infrastructure actually faces.
The conference gave us conversations with researchers and practitioners from several fields of critical infrastructure security, and a look at current work from threat modelling frameworks through to cybersecurity in autonomous vehicles.
Alongside the academic programme there was a visit to the Husqvarna Museum, which traces the company from traditional craft to modern industrial production over the past century.
The project: FINESSE, attack detection for road and rail