Advancing Security in Software-Defined Vehicles: A Comprehensive Survey and Taxonomy

2025-10-08

AI Summary

Software-Defined Vehicles (SDVs) face unprecedented cybersecurity risks and resilience challenges due to deep integration of third-party applications, continuous over-the-air (OTA) updates, and pervasive connectivity—exceeding those of conventional vehicles. Existing research predominantly addresses connected and autonomous vehicles (CAVs) without explicitly distinguishing SDV-specific characteristics or systematically analyzing novel attack surfaces introduced by their software-centric, service-decoupled architecture. Method: We propose a novel, layered SDV-specific attack taxonomy that uniquely maps concrete attack techniques to core SDV attributes—including programmability, remote upgradability, and service decoupling—as well as multi-dimensional attack vectors. Our methodology combines systematic literature review, taxonomic analysis, case studies, and evaluation of experimental defense mechanisms. Contribution: This work establishes the first comprehensive SDV cybersecurity research framework spanning ecosystem, architecture, and threat dimensions, providing a foundational theoretical basis and systematic reference for advancing both offensive and defensive technologies in the SDV domain.

Technology Category

• Application Domains: Mobility, Driving & Flight
• Computer Vision: Adversarial Attacks & Robustness
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Web applications in cross-disciplinary domains and verticals such as mixed reality, smart cities, and digital health
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Vertical and domain-specific search

Abstract

Software-Defined Vehicles (SDVs) introduce innovative features that extend the vehicle's lifecycle through the integration of outsourced applications and continuous Over-The-Air (OTA) updates. This shift necessitates robust cybersecurity and system resilience. While research on Connected and Autonomous Vehicles (CAV) has been extensive, there is a lack of clarity in distinguishing SDVs from non-SDVs and a need to consolidate cybersecurity research. SDVs, with their extensive connectivity, have a broader attack surface. Besides, their software-centric nature introduces additional vulnerabilities. This paper provides a comprehensive examination of SDVs, detailing their ecosystem, enabling technologies, and the principal cyberattack entry points that arise from their architectural and operational characteristics. We also introduce a novel, layered taxonomy that maps concrete exploit techniques onto core SDV properties and attack paths, and use it to analyze representative studies and experimental approaches.

Problem

• Distinguishing Software-Defined Vehicles from non-Software-Defined Vehicles
• Consolidating cybersecurity research for Software-Defined Vehicles
• Addressing broader attack surfaces from extensive connectivity and software

Innovation

• Introducing a layered taxonomy for SDV security
• Mapping exploit techniques to SDV properties and paths
• Analyzing studies using the novel taxonomy framework