Vehicle Cybersecurity
Imagine you’re driving at 130 km/h on the highway. Suddenly, your car radio starts acting up. The volume goes up and down randomly, and instead of music, all you can hear is noise. Hackers have managed to gain access to your car and take control of the radio.
Yaman Qendah is researching scenarios like this at the Chair of Computer Engineering at the University of Passau. To do so, she isn’t sitting in a car, but in her office in front of two large monitors. On the left-hand screen, a Jeep is driving through a virtual environment that she can configure as she wishes. Highway, city, country road—anything is possible. The weather conditions too, as these can influence risk assessments. Running in the background is a code that simulates an attack.
Computers on Wheels, Moving Targets
Connected cars have long been computers on wheels, with touchscreens dominating the cockpits. However, as technical capabilities grow, cyber security is emerging as another key issue. "Modern vehicles are connected in many ways—via voice control, Wi-Fi or mobile networks. Each of these interfaces is a potential gateway for attackers. In the worst-case scenario, someone could take control of the steering from outside the vehicle," says Qendah.
Researchers have been highlighting such risks for years. In 2013, the Jeep hack made headlines: Researchers exploited a remote vulnerability to gain access to the vehicle. Yet while many studies uncover security flaws, few address the following question: How should the system respond when it is attacked?
Resilient Systems as a Lifeline
This is precisely what Qendah focuses on: "We analyze how critical an attack is and what countermeasures the system should take to limit potential damage." Professor Stefan Katzenbeisser, holder of the Chair of Computer Engineering, recognized the importance of this research years ago: "The question of how to make an autonomous vehicle respond to an attack is decisive for bringing autonomous driving onto the roads at all," he says.
Qendah is pursuing her doctorate in the DFG project RESURREC (Resilient Safety-Critical Systems through Run-time Risk Assessment, Isolation, and Recovery), which investigates how the systems of autonomous vehicles can be made more resilient. The German Research Foundation (DFG) is funding the project as part of its priority program on ‘Resilience in Networked Worlds’. The University of Passau is collaborating on this research project with the Darmstadt University of Applied Sciences.
Mathematics Rather than Artificial Intelligence
Until now, research into vehicle cybersecurity has often focused on preventing attacks before they occur. The DFG project takes a different approach: It accepts that no software is perfect. Instead, the aim is to keep the consequences of a successful hack under control. Yaman Qendah has developed a mathematical model for this purpose that determines which countermeasures the vehicle should take in the event of an attack. "We first looked at what damage could occur in specific scenarios and carried out a risk assessment on that basis. This allows us to predefine specific countermeasures, such as three to five options per scenario," she explains its functioning.
She deliberately chose not to use artificial intelligence for the impact analysis process of an incoming attack, since safety-critical systems require predictable, transparent, and fully traceable behavior. This is the case with her model, which is based on logic. The vehicle strictly follows the predefined list, which can be updated as required.
AI could still be integrated into other aspects of the model, such as data analysis, pattern recognition, or vulnerability analysis. In these areas, AI has the potential to enrich the analysis and improve model capabilities while maintaining dependable and verifiable control.
Established Research Area Cybersecurity at the University of Passau
At the University of Passau, Qendah is part of an international team conducting research into cybersecurity from various perspectives. This includes, for example, cybersecurity in everyday life and in rail transport. The fact that the University of Passau has an established research area in the field of cybersecurity is also reflected in its degree programs. The English-taught Master’s in Computer Science includes a module on IT security and system reliability.
That is precisely what drew Qendah to Passau. She had completed a Bachelor’s degree in Computer Science at Birzeit University in Palestine, but she felt there was a lack of awareness regarding security issues. "At that time, the focus was primarily on developing software applications to make our lives easier. But I quickly realized that this doesn’t work without security concepts."
So she specifically searched for English-taught Master’s programs that also covered the topic of cybersecurity. One of the few matches was the University of Passau. As she has relatives in both Germany and Austria, the border town was a good compromise.
Trilingual with a Bavarian Touch
The start was challenging, as the pandemic made it difficult to settle in and make new friends. But together with her husband, who also began a Master’s degree in Computer Science in Passau, she overcame the challenge. Today, the family has many acquaintances in the city—partly thanks to their son, who is now three years old. He is raised trilingually, speaking German, Arabic and English. Friends from northern Germany even claim to have detected a Bavarian touch in him, Qendah says with a laugh.
In the department’s laboratory, there is a test cockpit for autonomous vehicles, which Qendah uses for her experiments. In an earlier project, a team led by Professor Katzenbeisser had already developed a security architecture for networked systems. Qendah is now using the prototype to test how well her model works in practice. Through her work, she is constructing another building block for the future of driving—ensuring that the vehicle knows what to do if, for example, an attacker takes control of the car radio.
