How to Better Cope with New Automotive Security Risks: VSOC Empowered by Threat Intelligence

With the continuous enrichment of vehicle functions, the attack surface of vehicle cybersecurity is also increasing. In order to cope with the increasing risks of automotive cyber security and carry out real-time monitoring, sensing and response defense of vehicle cyber security, automotive cyber security intrusion detection systems and vehicle security operation centers(VSOC) have come into being to establish a protective barrier for vehicle security in the operation phase. However, the current VSOC built within the automotive industry has problems such as weak threat perception capability, few threat data samples, and narrow coverage of associated ecological risks, and is in urgent need of corresponding supplementation and upgrading in terms of data capability. This paper takes better response to the new security risks of vehicles as the starting point, and puts forward a new idea of vehicle threat intelligence empowering VSOC to enhance the whole chain of capabilities. First of all, common system scenarios, components and related functionalities of VSOC, as well as related elements of automotive threat intelligence classification, were examined separately. Then, the multiple imperatives of combining the two have been analysed. Finally, the application scenarios and combination ideas of vehicle security operation center empowered by threat intelligence were put forward, which provides valuable ideas and references for the actual business capability of vehicle security operation center.