WP3 – Vulnerabilities Management
Coordinated by
GRAD (M01-M30)
Objective
This work package has the following objectives:
- Analyze the state of the art to incorporate the latest advances in detection, forecasting and propagation of vulnerabilities
- Compile a representative dataset of software vulnerabilities, taking into account the data provided by BIECO’s use cases as well as from other public sources, and select the most representative features for an effective vulnerability detection process.
- Provide advanced tools to detect and forecast accurately vulnerabilities in ICT systems and components.
- Provide an advanced tool to analyze the propagation of vulnerabilities across the ICT supply chain.
Deliverables
- D3.1 Report on the state of the art of vulnerability management WP3 (5 – GRADIANT) Report Public M6
- D3.2 Dataset with software vulnerabilities WP3 (4 – UTC) Other Confidential, only for members of the consortium (including the Commission Services) M12
- D3.3 Report of the tools for vulnerability detection and forecasting WP3 (5 – GRADIANT) Report Public M18
- D3.4 Report of the tools for vulnerabilities propagation WP3 (5 – GRADIANT) Report Public M21
- D3.5 Updated Report of the tools for vulnerability detection and forecasting WP3 (5 – GRADIANT) Report Public M30
- D3.6 Updated Report of the tools for vulnerabilities propagation WP3 (5 – GRADIANT) Report Public M30
Outcomes
Monitoring Tool
The monitoring tool is an infrastructure in charge of setting up and managing a monitoring component. It is based on event messages and enables the collection of complex events.
Security Testing Tool
GdpR-based cOmbinatOrial Testing (GROOT) is a general combinatorial strategy for testing systems managing GDPR’s concepts (e.g., Data Subject, Personal Data or Controller).
Domain Specific Language
The domain specific language enables specification of digital twin behaviour in a manner that can enable a predicted evaluation of its trustworthy behaviour in a simulated environment
Fail-operation clock synchronization methodology
Synchronization loss can occur due to many reasons, either because of a device or link failure or due to a targeted attack on the reference node, which supplies the corrected time to the network’s nodes.
Time sensitive network simulation
Simulate the real time communication for the distributed based on the Time sensitive network simulation. Additionally, simulate the fail-operation clock synchronization methodology. This simulation will validate the communication stack.
Remote updating- upgrading of vehicle firmware
Securing remote and in-vehicle communications against cyber-attacks, possibly performed with quantum computers in the near future, is a major goal in the automotive sector.
