Stage 5
By extending the Vehicle Node the vehicle class relationship extends to the Vehicle Model and Vehicle parent class. This reference model provides further subclass and predicate information and a Vehicle Digital Twin model of vehicle functions.
The Vehicle Digital Twin model breaks down into vehicle functions such as Acceleration, Object Detection and Navigation. A domain predicate – Has Failed Service – links to known vulnerability or service history and a range predicate – Has Policy – that refers to Vehicle policy controls such as Security that would detail rules or thresholds.
By extending the Vehicle location or Street Node to show that a Traffic Light was in proximity, the relationship to the Traffic Light Digital Twin may indicate if there were the Device Capability (TDM) to communicate with the Vehicle and if this could be the possible source of the malware.
The Traffic Light Digital Twin has multiple Subclasses, that show Device Capabilities (TDM), that would breakdown further into specific class types showing features and properties of the Device (TDM) that could communicate with Vehicle functions.
A final extension relates the security event to a Mitre Att&ck pattern class to help with evidence of known attack methods and vectors. Each extension of the original Nodes was able to provide either reference knowledge or additional support for an investigation through the examination of a technology Device Digital Twin and its parts and functions. This final relationship offers threat hunting research scenarios.
Smart City Cyber Security 