Paper deep dive
Security and Resilience in Autonomous Vehicles: A Proactive Design Approach
Chieh Tsai, Murad Mehrab Abrar, Salim Hariri
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%
Last extracted: 4/15/2026, 1:38:12 AM
Summary
This paper proposes an 'AV Resilient' (AVR) architecture for autonomous vehicles, utilizing a layered threat modeling framework and proactive defense mechanisms. The architecture integrates redundancy, diversity, and adaptive reconfiguration, supported by anomaly-based intrusion detection and hash-based integrity validation. Experimental validation on the Quanser QCar platform confirms the system's ability to detect and mitigate perception-level attacks, such as camera blinding and software tampering, ensuring operational continuity.
Entities (5)
Relation Signals (4)
AVR Architecture → integrates → Anomaly-based Intrusion Detection
confidence 95% · the AVR architecture is designed to operate across all functional layers... supported by anomaly- and hash-based intrusion detection techniques
AVR Architecture → integrates → Hash-based Integrity Validation
confidence 95% · the AVR architecture is designed to operate across all functional layers... supported by anomaly- and hash-based intrusion detection techniques
Quanser QCar → validatedby → AVR Architecture
confidence 95% · Experimental validation on the Quanser QCar platform demonstrates the effectiveness of these methods
Cross-Layer Coordinator → manages → AVR Architecture
confidence 90% · A dedicated Cross-Layer Coordinator oversees these functions by monitoring anomalies
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Autonomous vehicles (AVs) promise efficient, clean and cost-effective transportation systems, but their reliance on sensors, wireless communications, and decision-making systems makes them vulnerable to cyberattacks and physical threats. This chapter presents novel design techniques to strengthen the security and resilience of AVs. We first provide a taxonomy of potential attacks across different architectural layers, from perception and control manipulation to Vehicle-to-Any (V2X) communication exploits and software supply chain compromises. Building on this analysis, we present an AV Resilient architecture that integrates redundancy, diversity, and adaptive reconfiguration strategies, supported by anomaly- and hash-based intrusion detection techniques. Experimental validation on the Quanser QCar platform demonstrates the effectiveness of these methods in detecting depth camera blinding attacks and software tampering of perception modules. The results highlight how fast anomaly detection combined with fallback and backup mechanisms ensures operational continuity, even under adversarial conditions. By linking layered threat modeling with practical defense implementations, this work advances AV resilience strategies for safer and more trustworthy autonomous vehicles.
Tags
Links
- Source: https://arxiv.org/abs/2604.12408v1
- Canonical: https://arxiv.org/abs/2604.12408v1
Trouble viewing inline? Open PDF directly →
Full Text
46,677 characters extracted from source content.
Expand or collapse full text
Security and Resilience in Autonomous Vehicles: A Proactive Design Approach Chieh Tsai Murad Mehrab Abrar Salim Hariri Abstract Autonomous vehicles (AVs) promise efficient, clean and cost-effective transportation systems, but their reliance on sensors, wireless communications, and decision-making systems makes them vulnerable to cyberattacks and physical threats. This chapter presents novel design techniques to strengthen the security and resilience of AVs. We first provide a taxonomy of potential attacks across different architectural layers, from perception and control manipulation to Vehicle-to-Any (V2X) communication exploits and software supply chain compromises. Building on this analysis, we present an AV Resilient architecture that integrates redundancy, diversity, and adaptive reconfiguration strategies, supported by anomaly- and hash-based intrusion detection techniques. Experimental validation on the Quanser QCar platform demonstrates the effectiveness of these methods in detecting depth camera blinding attacks and software tampering of perception modules. The results highlight how fast anomaly detection combined with fallback and backup mechanisms ensures operational continuity, even under adversarial conditions. By linking layered threat modeling with practical defense implementations, this work advances AV resilience strategies for safer and more trustworthy autonomous vehicles. Accepted for publication in: Connected, Cooperative and Autonomous Mobility (IntechOpen) Keywords: Autonomous vehicles, Cybersecurity 1 Introduction The emergence of Autonomous Vehicles (AVs) represents a transformative shift in transportation, with the potential to drastically improve road safety, traffic efficiency, and accessibility to mobility [1, 2]. By integrating complex subsystems such as perception, localization, planning, and control, AVs operate with minimal or no human intervention. These systems rely on a wide range of sensors (e.g., LiDAR, cameras, radar), communication protocols (e.g., V2V, V2I), and artificial intelligence (AI) algorithms to make decisions in real time. However, this increasing system complexity also introduces new vulnerabilities [3, 4]. As AVs become more connected and data-driven, their attack surface expands, exposing them to a wide range of cyber and physical threats that can compromise safety, reliability, and user trust. Recent incidents and research have highlighted that autonomous systems are susceptible to adversarial manipulation at multiple layers—from sensor spoofing and GPS interference to model poisoning and control signal injection[5, 6]. These attacks not only pose risks to the integrity and availability of autonomous functions but may also lead to catastrophic physical consequences, including loss of life collisions and traffic disruption. Therefore, ensuring the security and resilience of AVs have become a critical research challenge, requiring robust threat modeling, proactive defense mechanisms, and intelligent detection systems capable of responding in real time. Traditional cybersecurity techniques, while foundational, are often insufficient to address the dynamic and real-time constraints of AVs. A resilience-focused approach—one that utilizes redundancy, diversity, and adaptive response mechanisms—is essential for maintaining critical functionality in the presence of faults or attacks [7, 8]. Moreover, the development of lightweight, real-time anomaly detection systems and self-recovery mechanisms are crucial to support operational continuity under adversarial conditions. This chapter aims to provide a comprehensive overview of the threat landscape in autonomous systems and explore state-of-the-art methodologies for enhancing their security and resilience. We begin by outlining the motivation for AV-specific security measures, followed by a taxonomy of known attacks and an evaluation of current anomaly detection and mitigation techniques. We then introduce a layered threat modeling framework and propose a set of practical defense strategies, supported by experimental demonstrations using a physical AV platform. Finally, we present an AV resilience architecture that integrates detection, validation, and fallback strategies, paving the way for more robust and trustworthy operations of autonomous systems. 2 Background and Related Work 2.1 Major AV components Autonomous vehicles are generally organized into three major components: perception, planning, and control [9, 10]. Planning and control together define how the vehicle determines a feasible path and executes the necessary maneuvers to follow it safely. Perception, however, forms the foundation of this pipeline, as it equips the vehicle with awareness of its surrounding environment [11, 12]. A perception system integrates data from multiple sensors such as LiDAR, radar, and cameras, enabling the detection, localization, and tracking of objects and road features. The importance of perception lies in its role as the primary source of information for autonomous navigation: without reliable perception, subsequent planning and control processes cannot operate effectively. 2.1.1 Perception System Attacks Recent studies have conducted real-world experiments on remote attacks against these perception sensors [13, 14]. The perception system plays a central role in autonomous driving, as it integrates a diverse suite of sensors such as cameras, LiDAR, radar, ultrasonic sensors, GPS, and Inertial Measurement Unit (IMU) to construct an accurate understanding of the surrounding environment. Since each of these components contributes uniquely to situational awareness, the compromise of even a single sensor can degrade perception accuracy and mislead decision-making modules [15]. 2.1.2 Perception Security: To secure vehicle perception, a robust detection system along with a mitigation strategy is crucial. Based on the existing literature ([13], [16, 17, 15, 18, 19]), the current approaches for detecting perception sensor attacks against AVs can be categorized as follows: (i) Incorporating redundancy by adding more sensors, (i) Cross-vehicle verification through Vehicle-to-Vehicle (V2V) communication, and (i) Relying on alternative sensors and sensor fusion. Although sensor redundancy improves resilience against random attacks, it is ineffective against intentional attacks specific to a particular sensor, where the attacker has prior knowledge of the sensor. Using inter-vehicle communications like V2V to compare sensor measurements is ineffective when the victim vehicle is out of the communication range [20, 21]. Multi-modal fusion, like combining LiDAR and camera data, has shown promising results in improving robustness under benign conditions but still struggles against coordinated multi-sensor adversarial attacks [22, 23, 24, 25]. Recent work has explored adversarial training and certified defense mechanisms for perception models, aiming to improve robustness against crafted perturbations [26, 25]. However, these approaches often incur high computational costs and are limited to specific attack models, making them less practical for real-time autonomous driving [27, 28]. Thus, there remains a critical need for lightweight, adaptable defenses that can operate under diverse and evolving attack scenarios. Given these limitations of the existing methods, there is a need for a holistic resilient solution that can comprehensively detect and mitigate attacks without relying on specific sensors, sensor redundancy, or other vehicles and networks. 3 Redefining the AV Architecture for Threat and Resilience Modeling In this work, the AV stack is intentionally redefined to emphasize resilience and security considerations. While conventional AV architectures typically separate the system into perception, planning, and control, here the stack is organized into distinct functional layers that more directly capture the operational roles and potential threat surfaces relevant to our study. Although the overall layered concept is inspired by prior work [29], the specific redefinition presented here is tailored to resilience analysis rather than intended as a universal AV taxonomy. • Driver Interface and Control System: Provides the human driver with inputs and outputs, including steering feedback, dashboard displays, and manual override functions. This layer forms the boundary between human operators and the autonomous driving system. Modern AVs increasingly emphasize intuitive human–machine interfaces (HMIs), ensuring that drivers can safely monitor vehicle status and intervene during edge cases or system failures. • Control Layer: Responsible for low-level actuation such as steering, throttle, and braking, as well as implementing motion control algorithms to execute trajectories generated at higher levels. Advanced architectures often integrate high-frequency feedback loops, redundancy in actuation, and fail-safe control policies to guarantee safety in the presence of disturbances or component failures. • Decision-Making Layer: Manages tactical and strategic planning, including path planning, obstacle avoidance, and maneuver selection. This layer translates high-level goals into executable control commands. Current systems leverage reinforcement learning and optimization-based planners to handle complex traffic scenarios, dynamic obstacles, and rule-based constraints in real time. • Knowledge Processing Layer (Data Fusion and Interpretation): Integrates heterogeneous data from multiple onboard sensors and external sources to maintain a coherent representation of the environment and vehicle state. In prior studies, this functionality was often included within the Perception Layer, but here it is explicitly separated to emphasize its role in resilience and security. Advanced architectures employ AI-driven sensor fusion and map-matching techniques to reduce uncertainty and dynamically adapt to changing conditions, improving the robustness of situational awareness. • Perception Layer: Processes raw sensor data (camera, LiDAR, radar, GPS, etc.) to perform object detection, tracking, and environmental mapping, which are essential for situational awareness. Recent approaches use deep neural networks for multi-modal perception and adopt adversarially robust methods to reduce susceptibility to spoofing, noise, or environmental disturbances. • Communication Framework (V2V, V2I, V2C): Supports information exchange between vehicles, infrastructure, and cloud services, enabling cooperative perception, coordinated maneuvers, and extended situational awareness. With the introduction of 5G and Cellular Vehicle to Any, this layer increasingly underpins cooperative driving, low-latency hazard alerts, and real-time map updates. • Cross-Layer Coordinator: Ensures synchronization, resilience, and consistency across all layers of the AV stack, maintaining reliable operations and overall system coherence. This cross-layer is crucial for fault tolerance and safety assurance, as it enables graceful degradation, redundancy management, and system-wide cybersecurity monitoring. 4 Layer-based Attack Scenarios To systematically evaluate threats in autonomous vehicles (AVs), we adapt the IoT threat modeling framework [30] to the AV domain. Each architectural layer is examined in terms of its core functions, attack surfaces, impact, and mitigation strategy. This structured approach enables a consistent mapping between functional responsibilities and their associated vulnerabilities. Representative cases derived from this methodology are presented in Table 1. 4.1 Layer Descriptions The AV architecture can be conceptualized as a hierarchy of interdependent functional layers, each responsible for specific operations and each presenting unique attack surfaces. At the top, the Driver Interface and Control System links the human operator to the vehicle via dashboards, controls, and manual override mechanisms. Compromise at this layer may confuse the driver, override legitimate commands, or inject malicious control inputs. Beneath it, the Control Layer governs low-level actuation, including throttle, steering, and braking. Attacks here can silently alter vehicle dynamics, producing deviations that are difficult to detect but potentially dangerous. Building upward in abstraction, the Decision-Making Layer manages tactical and strategic behaviors such as lane changes, obstacle avoidance, and path planning. Manipulating decision models or outputs may lead to unsafe maneuvers or traffic violations. The Knowledge Processing Layer, which fuses multisensor and external data into a coherent world model is needed to support the decision-making processes. Poisoned streams or corrupted fusion algorithms can distort situational awareness and undermine downstream decisions. The Perception Layer translates raw inputs from LiDAR, radar, cameras, and GPS into object detections, classifications, and environmental maps. It is especially exposed to spoofing, adversarial perturbations, and physical-world manipulations (e.g., altered traffic signs). Complementing perception, the Communication Framework handles information exchange with other vehicles, infrastructure, and the cloud via V2V, V2I, and V2C links, respectively. Replay, spoofing, or denial-of-service attacks on this layer can disrupt cooperative driving and erode trust. Finally, the Cross-Layer Coordinator ensures synchronization and resilience across all layers. Because it influences the entire stack, faults or injected errors here can cascade through the architecture, destabilizing the system as a whole. Together, these layers provide a structured visibility through which attacks can be mapped, analyzed, and countered using the five-step methodology. In this chapter, we focus primarily on the Perception and Knowledge Processing layers as case studies to demonstrate how resilience and security measures can be integrated into an AV system. Layer Attack Surface (AS) Impact Mitigation Strategy Driver Interface and Control System Malicious driver input injection; compromised dashboard/override signals Unauthorized override of system behavior; driver confusion leading to unsafe maneuvers Authenticate commands, secure UI design, redundant safety checks for manual override Control Layer Command injection in steering/braking; kernel-level rootkits Silent manipulation of vehicle dynamics, risk of collisions Runtime integrity monitoring, secure boot, anomaly detection in actuation signals Decision-Making Layer Tampered ML models; adversarial inputs to planning module Unsafe maneuvers, rule violations, unsafe path selection Model validation, adversarial robustness testing, consensus-based decision redundancy Knowledge Processing Layer Data poisoning; sensor fusion manipulation Distorted environmental model, leading to misinformed decisions Trusted data provenance, anomaly detection in fused data, hash-based detection, back up and fall back Perception Layer Sensor spoofing (LiDAR, radar, camera); adversarial image perturbations Incorrect object detection, phantom obstacles, missed hazards Sensor redundancy, adversarial training, anomaly detection Communication Framework V2V/V2I spoofing, replay, DoS, packet manipulation Loss of situational awareness, degraded coordination between vehicles Encryption, authentication protocols, rate limiting, intrusion detection systems Cross-Layer Coordinator Early-stage poisoning cascading through layers System-wide compromise, cascading unsafe behavior Cross-layer consistency checks, layered anomaly detection, resilient failover strategies Table 1: Threat Modeling for the proposed AV architecture. Each row summarizes the attack surface, safety impact, and candidate mitigation strategy. 5 Security and Resilience Methodology Based on the system architecture and identified mitigation strategies, we present an Autonomous Vehicle Resilient (AVR) Architecture in conjunction with targeted threat and intrusion detection techniques to enhance the security and operational robustness of autonomous vehicles. The overall concept of the AVR architecture is illustrated in Figure 1, while the anomaly detection framework is depicted in Figure 3. Detailed mechanisms are discussed in further detail in the following section. 5.1 AVR Architecture The AVR architecture is designed to operate across all functional layers of the autonomous vehicle stack, providing a systematic framework to anticipate, detect, and recover from failures or attacks. Its resilience is achieved through three complementary functions: • Redundant Functions – critical modules are backed up by verified functionally equivalent redundant modules to ensure continuity of operations in the event of component failures or malicious tampering. This approach reduces the risk of single points of failure and provides a safety net for vital system operations. • Diversity Functions – by incorporating heterogeneous sensors, algorithms, and models, the system mitigates common-mode failures and increases robustness against attacks that depend on existing vulnerabilities in a single type of module or data source. • Shuffle Functions – periodic reconfiguration of software, communication channels, and system parameters introduces a high degree of ambiguity and consequently reduces the likelihood that adversaries can exploit deterministic system behaviors. A dedicated Cross-Layer Coordinator oversees these functions by monitoring anomalies, enforcing consistency across layers, and triggering dynamic reconfiguration when anomalies are detected. This ensures that multi-stage or stealthy attacks are isolated and mitigated before they can propagate, effectively enhancing overall AV system resilience. Figure 1: AVR architecture integrated across AV functional layers and coordinated by a Cross-Layer Coordinator. 5.1.1 Backup and Fallback Mechanism We illustrate the backup and fallback concept through two operational scenarios: a normal state and a failure state. In the normal state, the Primary module (P) executes normally, and no intervention is required. The system continues to operate smoothly as long as the detection function D(⋅)D(·) reports no anomalies. In contrast, the failure state occurs when D(P)=1D(P)=1 signals a compromise or fault in the primary module. At this point, control is immediately transferred to the Fallback module (F), which is a verified and trusted redundant module. The transition ensures that the system preserves safety-critical functions even under attack or malfunction. Figure 2 depicts this mechanism: under normal conditions the primary operates, but upon detection of failure, the fallback takes over seamlessly. This dual-scenario design embodies the redundancy principle of the AVR architecture shown in Figure 1. Figure 2: Two operational scenarios for the backup/fallback mechanism: (1) happy state with primary execution, (2) failure state with automatic switchover to verified fallback. 5.2 Intrusion Detection Techniques An intrusion detection system (IDS) is used in this work to provide real-time indications of compromises and to trigger resilience responses. We employ two complementary techniques: (i) anomaly-based detection to identify deviations in runtime behavior at the perception level, and (i) hash-based integrity validation to detect unauthorized modifications to software artifacts (e.g., model weights and configuration files). These are described in the following subsections and together provide both behavioral and software integrity assurance. Figure 3: Intrusion Detection Techniques: anomaly-based (perception) and hash-based (software/system integrity). 5.2.1 Anomaly-Based Detection Anomaly-based detection techniques identify unusual or unexpected system behavior that may indicate a cyberattack. It relies on a normal behavior model of the whole system or system components. System activities are continuously monitored and compared against the baseline normal behavior model. When instantaneous behavior deviates beyond a predefined normality threshold, it is flagged as anomalous, which may indicate a potential intrusion. In the context of AVs, anomaly-based intrusion detection depends on accurately characterizing the vehicle’s normal operational behavior, which is typically learned through offline modeling and training. If an attacker attacks vehicle components (for example, by injecting malicious data into sensors) that cause the vehicle to behave abnormally, the IDS identifies this deviation and raises an alert. A key strength of anomaly-based IDS is its capability to identify previously unseen attacks better than other detection algorithms; however, developing an accurate normal behavior model is challenging. Inaccuracies in this model can lead to high false positive or false negative errors. To address this, we develop the normal behavior model of AVs using a combination of a mathematical model of the vehicle system called the Autonomous Vehicle Behavior Model (AVBM) and machine learning algorithms. The mathematical model characterizes the instantaneous state of the vehicle, while the learning-based components account for the data-driven variations in normal operation. A simplified overview of the AVBM is illustrated in Fig. 4, and further details are available in [31, 32]. Figure 4: Simplified Autonomous Vehicle Behavior Model Anomaly-based Intrusion Detection Methodology. Figure 5: Anomaly-based Intrusion Detection Methodology Fig. 5 shows a diagram of anomaly-based intrusion detection technique for AVs. We define the anomaly detection approach over a finite set of driving events U. Set U is divided into two subsets: NormalNormal driving events N and AbnormalAbnormal driving events A, such that: N∪A=UN∪ A=U and N∩A=∅N∩ A= . A representation map R is used to model U, which maps driving events in U to patterns in URU^R. Similarly, N and A driving sets are mapped to NRN^R and ARA^R using the representation map R. These can be mathematically expressed as: U→URU RU^R, N→NRN RN^R, A→ARA RA^R, and NR∪AR=URN^R∪ A^R=U^R. A detector D is defined as D=(f,M)D=(f,M); where f denotes the normal behavior characterization function expressed as f:UR×M⇒[0,1]f:U^R× M [0,1], and M is denoted as the system memory that stores the normal behavior model extracted from the set of normal driving events NRN^R. Function f specifies the degree of abnormality of a sample s∈URs∈ U^R by comparing it with M. The higher the value of f(s,M)f(s,M), the more abnormal the sample is. If the value of f(s,M)f(s,M) exceeds a predefined threshold T, detector D raises an alarm that indicates the occurrence of an abnormal event. Detector D can be mathematically expressed as follows [31]: D(s)=Abnormalif(s,M)>NormalotherwiseD(s)= casesAbnormal 28.45274ptif f(s,M)>T\\ Normal 36.98866ptotherwise cases 5.2.2 Hash-Based Integrity Validation Hash-based integrity validation is used in this work as a lightweight, runtime safeguard for the QCar perception stack [33] [34]. Specifically, the electronic control unit (ECU) periodically computes a cryptographic hash (SHA-256) over a predefined set of integrity-critical artifacts, including the deployed YOLOv8 model weights and associated configuration files (e.g., detection thresholds and class-to-label mappings). The computed digest is compared against a trusted baseline hash stored in a protected location. A hash mismatch is treated as a software-tampering event. Upon detection, the system logs the anomaly (timestamped) and immediately triggers the resilience response: execution is switched to a pre-verified fallback/backup perception module and trusted files are restored, allowing the vehicle to maintain safety-critical behaviors without requiring a system restart. The fallback remains active in an event-driven manner as long as the integrity violation persists, and normal operation is automatically restored once the expected hash values are re-established. 6 Experimental Setup and Results Experiments were conducted using Quanser’s QCar self-driving platform, a small-scale, high-fidelity testbed for perception, planning, and control research [35]. The vehicle is equipped with a drive motor, steering servo, 4 cameras, a 2D LiDAR, an Intel RealSense depth camera, and a 9-axis inertial measurement unit (IMU). An onboard NVIDIA Jetson Orin processor executes control algorithms, receives commands via Wi-Fi from a ground station, and transmits sensor data back for monitoring. As mentioned in previous sections, our experiments focus on attacks targeting the Perception and Knowledge Processing layers. Perception-layer attacks include sensor-level manipulations, such as laser blinding of the depth camera, degrading obstacle detection and braking. Knowledge-layer attacks involve software manipulations, including modifications to the YOLOv8 model and configuration files, aiming to compromise data fusion and world-model integrity. These experiments evaluate the effectiveness of resilience mechanisms, including anomaly detection, hash-based integrity validation, and backup/fallback strategies. Two experimental setups were employed, each corresponding to a distinct threat detection technique and backup and fallback for resilience. 6.1 Anomaly-based Intrusion Detection Setup 6.1.1 Attack Experiment In this experimental setup, we performed a real-world depth camera blinding attack against the onboard depth camera of QCar to degrade obstacle detection and braking capabilities during autonomous driving. A laser blinding attack was performed as explained by Yan et al. [18]. The hardware setup of the attack device consisted of a wide-beam laser controlled by an Arduino, which recorded digital clock timestamps corresponding to the laser’s on and off states. The device generated a binary signal, where a value of 1 denoted laser activation and 0 denoted deactivation. Both the QCar and the attack device operated at the same data sampling rate and were initialized simultaneously to ensure temporal alignment. Fig. 6 illustrates the setup used for the anomaly-based intrusion detection experiments. Figure 6: Setup of the depth camera blinding attack experiment on QCar 6.1.2 Data Collection: AVP-Dataset The Autonomous Vehicle Behavior Model in Fig. 4 highlights the essential parameters necessary for estimating the present and future states of the vehicle. This helps model the normal behavior of the vehicle and guides us in collecting data of specific features for our experimental analysis. The Autonomous Vehicle Perception Dataset (AVP-Dataset) is prepared by incorporating the parameters obtained from the AVBM. The full AVP-Dataset is publicly available at [36, 31]. 6.2 Hash-based Integrity Validation Setup 6.2.1 Attack Experiment In this experimental setup, we conducted a software-based perception tampering attack on the QCar’s onboard NVIDIA Jetson AGX Orin main ECU to evaluate the effectiveness of hash-based integrity validation. The attack degrades obstacle detection and braking behavior by modifying internal perception parameters at runtime, such as YOLOv8 model configuration files, object detection thresholds, or class-to-label mappings. Unlike physical-layer attacks, this approach does not interfere with sensors directly and instead represents realistic advanced driver-assistance systems (ADAS) and autonomous vehicle threats originating from within the ECU. To assess robustness and repeatability, five independent software tampering events were triggered under each experimental condition, with each event treated as an individual attack trigger and distributed across multiple autonomous driving runs. No explicit upper limit was imposed on the number of triggers, allowing the system to handle repeated tampering events without requiring a restart or manual intervention. When an integrity violation is detected, the system does not issue an emergency stop. Instead, it automatically switches to a pre-verified fallback perception module, enabling the vehicle to continue operating while preserving safety-critical functions. The fallback mechanism remains active as long as the abnormal configuration persists and is released once the trusted state is restored. As a result, the vehicle does not unconditionally stop after an attack but continues to drive safely and executes appropriate behaviors, such as stopping for pedestrians or stop signs, based on the fallback perception output. Figure 7: Software-based attack: ECU perception module compromise on QCar2. 6.2.2 Data Collection: Integrity-Validation Dataset Data was collected under normal operation and during software attacks. In the normal scenario, the YOLOv8 model and configuration files remained unaltered, with hashes matching the trusted baseline value. During attacks, modified models or configuration files generated hash mismatches, which were logged by the system. The Integrity-Validation Dataset contains synchronized traces of both normal and attack scenarios, capturing system responses, detection outcomes, and integrity validation results. 6.3 Experimental Results 6.3.1 Results: Anomaly-Based Detection This experiment evaluates the performance of seven supervised binary classification models, namely Random Forest (RF), Logistic Regression (LR), XGBoost (XGB), K-Nearest Neighbor (KNN), Support Vector Classifier (SVC), Multi-Layer Perceptron (MLP), and Naive Bayes (NB), using the AVP-Dataset. The evaluation was conducted on the full dataset comprising 88,976 samples, including 45,001 normal instances (50.57%) and 43,975 abnormal instances (49.43%). Classifier performance was assessed using four standard metrics: accuracy, precision, recall, and F1 score. Since the primary objective is to identify abnormal samples, all metrics were computed by treating the abnormal class as the positive class. To ensure unbiased evaluation, a stratified 5-fold cross-validation scheme was employed to preserve class balance across folds. In each fold, 80% of the data were used for training and the remaining 20% were used for testing. The comparative performance of the evaluated models is summarized in Table 2. The results indicate that Random Forest achieved the highest accuracy, precision, recall, and F1 score among all classifiers. Logistic Regression, K-Nearest Neighbor, and Multi-Layer Perceptron demonstrated competitive performance with comparable F1 scores, following closely behind Random Forest. Table 2: Depth Camera Blinding Attack Detection Performance of Different Machine Learning Models Metrics RF LR XGB KNN SVC MLP NB Precision 0.801 0.800 0.751 0.793 0.742 0.786 0.692 Recall 0.894 0.872 0.876 0.877 0.913 0.874 0.923 F1 Score 0.845 0.834 0.809 0.833 0.819 0.828 0.791 Accuracy 0.838 0.829 0.795 0.826 0.800 0.820 0.759 6.3.2 Tuning the Detection Threshold T for Anomaly-based Detection Figure 8: Distribution of Random Forest abnormal-class probability scores for normal and attack data. The evaluation fold consists of 3,893 normal samples and 13,902 attack samples. An effective detection threshold lies in the range =0.4T=0.4–0.50.5. In this experiment, we investigated the selection of an appropriate predefined threshold T for the Anomaly Behavior Analysis framework by examining the predicted probability scores associated with normal and abnormal samples. Since the Random Forest model exhibited the strongest overall performance in Experiment 2, it was selected for this experiment. The probability outputs were visualized to identify a suitable separation margin for threshold placement. Fig. 8 illustrates the overlaid probability score distributions for normal and abnormal data, where a clear distinction between the two classes can be observed, as highlighted by the dotted boundaries. Table 3 reports the corresponding misclassification rates as we widen the decision margin. The results indicate that choosing the threshold T within the interval of 0.4 to 0.5 provides the most favorable trade-off. In this range, 155 normal samples are incorrectly labeled as abnormal, while no attack samples are misclassified, resulting a False Positive Rate of 0.0398 (3.98%) and a False Negative Rate of 0. Thus, setting the predefined threshold T to a value between 0.4 and 0.5 for the Anomaly Behavior Analysis approach ensures an optimal attack detection capability. Table 3: False Positive (FP) and False Negative (FN) Rates for Different Detection Margins Detection Margin Normal Data Misclassified Attack Data Misclassified FP Rate FN Rate 0.4 – 0.5 155 0 0.0398 0 0.3 – 0.5 293 0 0.0752 0 0.4 – 0.6 155 26 0.0398 0.00187 0.3 – 0.6 293 26 0.0752 0.00187 6.3.3 Results: Hash-Based Integrity Validation Detection Accuracy and Timing. We evaluated the hash-based detection mechanism on QCar under varying speeds from 0.5 m/s to 1.75 m/s with update intervals of 1 s, 3 s, and 5 s. Across all configurations, the system achieved a 100% success rate, demonstrating that hash-based validation reliably detects any modification to the model or configuration regardless of vehicle speed or update frequency (Figure 9). Figure 9: Success rate of hash-based integrity validation across vehicle speeds (0.5–1.75 m/s) and hash update intervals (1 s, 3 s, and 5 s), showing reliable detection of all software modifications. Scalability Discussion. In a full-scale vehicle with dozens of concurrent software modules, continuous hashing of all artifacts at high frequency may be impractical. In practice, integrity validation can be scoped to safety-critical artifacts only and executed using staggered schedules or event-driven triggers (e.g., on update, on process restart, or on policy-defined checkpoints), which reduces CPU and I/O contention while preserving tamper detection capability. Resilience Results. System Resilience Evaluation. Beyond detection, we measured the system’s response to attacks, focusing on how backup and fallback mechanisms maintain safe operation. Using hash-based monitoring, the system detected a malicious update within 0.030 s after its onset at 25.00 s. The built-in backup mechanisms immediately restored the trusted configuration and model in 0.002 s (Figure 10), preventing any unsafe behavior. These results emphasize the importance of having robust fallback strategies: in “normal” scenarios where no attack occurs, the backup remains idle but ready, ensuring normal operation is unaffected; in “attack (abnormal)” scenarios with tampering, the fallback enables the system to revert to a safe, trusted state before any compromised module can influence vehicle behavior. This demonstrates that the combination of fast detection and reliable backup is critical for maintaining both safety and operational continuity in autonomous vehicles. Figure 10: System response timeline under software tampering. The attack is detected via hash mismatch within 0.030 s after onset, and the trusted configuration is restored within 0.002 s, preventing unsafe vehicle behavior. Physical Validation and Behavior Analysis. We further validated the proposed resilience mechanisms on the QCar testbed. During normal operation, the vehicle speed stabilized near 0.33 m/s, corresponding to low-speed operation on the scaled platform and being qualitatively comparable to approximately 12 km/h driving in a full-scale vehicle. At 10 s, a software tampering attack was introduced; despite this, the vehicle correctly halted at a STOP sign at 20 s, illustrating that the backup and recovery mechanisms successfully maintained functional safety (Figure 11). This physical experiment demonstrates the practical value of the resilience layer: it not only detects attacks but also ensures that safety-critical behaviors are preserved, preventing unsafe outcomes even under real-world attack conditions. Figure 11: QCar speed profile during ECU tampering. After the attack is injected at 10 s, the vehicle continues operating under the fallback perception module and correctly stops at a STOP sign at 20 s, demonstrating preserved safety behavior without an emergency halt. 7 Conclusion As autonomous vehicles (AVs) become integral to the future of transportation systems, it becomes critically important to enhance security and resilience of AVs. This chapter has addressed the multifaceted vulnerabilities that AVs face, stemming from their dependency on complex sensor systems, wireless networks, and decision-making processes. By categorizing potential threats across various architectural layers, we have highlighted several ways in which these vehicles can be compromised, how they can be detected and mitigated. The introduction of an AV Resilient architecture, characterized by redundancy, diversity, and adaptive reconfiguration, offers a robust framework to tolerate AV attacks. The integration of innovative intrusion detection techniques, such as anomaly detection and hash-based verification, further enhances the security and protection of the AV operations. The successful experimental validation conducted on the Quanser QCar platform exemplifies the practical effectiveness of these strategies in real-world scenarios, particularly in thwarting depth camera blinding attacks and software tampering. Ultimately, this work establishes a critical link between threat modeling and the implementation of practical defense mechanisms, paving the way for more resilient autonomous vehicle systems. As we advance toward a future where AVs play an essential role in our transportation landscape, it is imperative that we continue to refine and evolve these security and resilience measures. By prioritizing resilience, we not only enhance the safety and trustworthiness of autonomous vehicles but also contribute to the broader goal of creating intelligent transportation systems that can adapt to ever-evolving challenges in our complex digital world. Conflict of interest The author declares no conflict of interest. Acknowledgments This work was supported in part by the National Science Foundation (NSF) under Grant 1624668, Grant 1921485, Grant 1303362 (Scholarship-for-Service), Grant 2413009, and the WISPER Center. Support was also provided by the 2025 Technology and Research Initiative Fund/National Security Systems Initiative administered by the University of Arizona, Office of Research and Partnerships, funded under Proposition 301, the Arizona Sales Tax for Education Act (2000). Any opinions, findings, conclusions, or recommendations expressed in this chapter are those of the author(s) and do not necessarily reflect the views of the NSF. Portions of this manuscript were linguistically polished with the assistance of AI-based language tools (ChatGPT) for grammar and clarity. The authors are solely responsible for the content and technical accuracy of the work. Portions of this chapter are based on previously published work that appeared as a preprint under the title “GPS-IDS: An Anomaly-Based GPS Spoofing Attack Detection Framework for Autonomous Vehicles,” available on arXiv (arXiv:2405.08359), 2024. References [1] Todd Litman. Autonomous vehicle implementation predictions. 2017. [2] Steven E Shladover. Connected and automated vehicle systems: Introduction and overview. Journal of Intelligent Transportation Systems, 22(3):190–200, 2018. [3] Jonathan Petit and Steven E Shladover. Potential cyberattacks on automated vehicles. IEEE Transactions on Intelligent transportation systems, 16(2):546–556, 2014. [4] Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage, Karl Koscher, Alexei Czeskis, Franziska Roesner, and Tadayoshi Kohno. Comprehensive experimental analyses of automotive attack surfaces. In 20th USENIX security symposium (USENIX Security 11), 2011. [5] Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. Adversarial sensor attack on lidar-based perception in autonomous driving. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 2267–2281, 2019. [6] Daniel P Shepard, Jahshan A Bhatti, and Todd E Humphreys. Drone hack: Spoofing attack demonstration on a civilian unmanned aerial vehicle.(2012). Google Scholar, 2012. [7] James PG Sterbenz, David Hutchison, Egemen K Çetinkaya, Abdul Jabbar, Justin P Rohrer, Marcus Schöller, and Paul Smith. Resilience and survivability in communication networks: Strategies, principles, and survey of disciplines. Computer networks, 54(8):1245–1265, 2010. [8] Alexander A Ganin, Avi C Mersky, Andrew S Jin, Maksim Kitsak, Jeffrey M Keisler, and Igor Linkov. Resilience in intelligent transportation systems (its). Transportation Research Part C: Emerging Technologies, 100:318–329, 2019. [9] Scott Drew Pendleton, Hans Andersen, Xinxin Du, Xiaotong Shen, Malika Meghjani, You Hong Eng, Daniela Rus, and Marcelo H Ang. Perception, planning, control, and coordination for autonomous vehicles. Machines, 5(1):6, 2017. [10] Simon Ulbrich, Andreas Reschka, Jens Rieken, Susanne Ernst, Gerrit Bagschik, Frank Dierkes, Marcus Nolte, and Markus Maurer. Towards a functional system architecture for automated vehicles. arXiv preprint arXiv:1703.08557, 2017. [11] Keli Huang, Botian Shi, Xiang Li, Xin Li, Siyuan Huang, and Yikang Li. Multi-modal sensor fusion for auto driving perception: A survey. arXiv preprint arXiv:2202.02703, 2022. [12] Zhangjing Wang, Yu Wu, and Qingqing Niu. Multi-sensor fusion in automated driving: A survey. Ieee Access, 8:2847–2868, 2019. [13] Jonathan Petit, Bas Stottelaar, Michael Feiri, and Frank Kargl. Remote attacks on automated vehicles sensors: Experiments on camera and lidar. Black Hat Europe, 11(2015):995, 2015. [14] Yuan Xu, Xingshuo Han, Gelei Deng, Jiwei Li, Yang Liu, and Tianwei Zhang. Sok: Rethinking sensor spoofing attacks against robotic vehicles from a systematic view. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 1082–1100. IEEE, 2023. [15] Radoslav Ivanov, Miroslav Pajic, and Insup Lee. Attack-resilient sensor fusion for safety-critical cyber-physical systems. ACM Transactions on Embedded Computing Systems (TECS), 15(1):1–24, 2016. [16] Hocheol Shin, Dohyun Kim, Yujin Kwon, and Yongdae Kim. Illusion and dazzle: Adversarial optical channel exploits against lidars for automotive applications. In International conference on cryptographic hardware and embedded systems, pages 445–467. Springer, 2017. [17] Wenyuan Xu, Chen Yan, Weibin Jia, Xiaoyu Ji, and Jianhao Liu. Analyzing and enhancing the security of ultrasonic sensors for autonomous vehicles. IEEE Internet of Things Journal, 5(6):5015–5029, 2018. [18] Chen Yan, Wenyuan Xu, and Jianhao Liu. Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle. Def Con, 24(8):109, 2016. [19] Jinshan Liu and Jung-Min Park. “seeing is not always believing”: Detecting perception error attacks against autonomous vehicles. IEEE Transactions on Dependable and Secure Computing, 18(5):2209–2223, 2021. [20] Fahad Ali Milaat and Hang Liu. Decentralized detection of gps spoofing in vehicular ad hoc networks. IEEE Communications Letters, 22(6):1256–1259, 2018. [21] Gabriele Oligeri, Savio Sciancalepore, Omar Adel Ibrahim, and Roberto Di Pietro. Gps spoofing detection via crowd-sourced information for connected vehicles. Computer Networks, 216:109230, 2022. [22] Charles R Qi, Wei Liu, Chenxia Wu, Hao Su, and Leonidas J Guibas. Frustum pointnets for 3d object detection from rgb-d data. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 918–927, 2018. [23] Xiaozhi Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. Multi-view 3d object detection network for autonomous driving. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 1907–1915, 2017. [24] Jason Ku, Melissa Mozifian, Jungwook Lee, Ali Harakeh, and Steven L Waslander. Joint 3d proposal generation and object detection from view aggregation. In 2018 IEEE/RSJ international conference on intelligent robots and systems (IROS), pages 1–8. IEEE, 2018. [25] James Tu, Huichen Li, Xinchen Yan, Mengye Ren, Yun Chen, Ming Liang, Eilyan Bitar, Ersin Yumer, and Raquel Urtasun. Exploring adversarial robustness of multi-sensor perception systems in self driving. arXiv preprint arXiv:2101.06784, 2021. [26] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. [27] Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, Qi Alfred Chen, and Z Morley Mao. On adversarial robustness of trajectory prediction for autonomous vehicles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15159–15168, 2022. [28] Haizhong Zheng, Ziqi Zhang, Juncheng Gu, Honglak Lee, and Atul Prakash. Efficient adversarial training with transferable adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1181–1190, 2020. [29] Amal Yousseef, Shalaka Satam, Banafsheh Saber Latibari, Jesus Pacheco, Soheil Salehi, Salim Hariri, and Partik Satam. Autonomous vehicle security: A deep dive into threat modeling. arXiv preprint arXiv:2412.15348, 2024. [30] Pratik Satam, Shalaka Satam, Salim Hariri, and Amany Alshawi. Anomaly behavior analysis of iot protocols. Modeling and design of secure internet of things, pages 295–330, 2020. [31] Murad Mehrab Abrar. Anomaly-based intrusion detection system for autonomous vehicles, 2023. [32] Murad Mehrab Abrar, Amal Youssef, Raian Islam, Shalaka Satam, Banafsheh Saber Latibari, Salim Hariri, Sicong Shao, Soheil Salehi, and Pratik Satam. Gps‐ids: An anomaly‐based gps spoofing attack detection framework for autonomous vehicles. arXiv preprint arXiv:2405.08359, 2024. Submitted 14 May 2024; Revised 17 December 2024. [33] Wisnu Uriawan, Ray Ramadita, Rizky Dwi Putra, Rizqi Ilham Siregar, and Risyad Addiva. Authenticate and verification source files using sha256 and hmac algorithms. 2024. [34] Chieh Tsai and Hariri Salim. Intelligent obstacle resilience in autonomous vehicles under security threats. pages 34–41, 11 2025. [35] QCar2 Developers. Qcar2: Autonomous vehicle simulation platform. https://w.qcar2.com. Accessed: 2025-08-18. [36] AVP-Dataset: Autonomous Vehicle Perception Dataset. https://github.com/mehrab-abrar/AVP-Dataset/, 2023. GitHub repository; accessed 19 August 2025.