A Systematic Review of Threat Analysis and Risk Assessment Methodologies for Connected and Automated Vehicles
archive: archived pipeline: cataloged verified
Get this paper ↗ (DOI — opens at the source; we link to it, we don't host it)
Summary
This paper presents a systematic review of Threat Analysis and Risk Assessment (TARA) methodologies tailored for Connected and Automated Vehicles (CAVs). The research is motivated by the increasing cyber risks associated with CAVs, which rely on complex sensors, artificial intelligence, and Vehicle-to-everything (V2X) connections. Regulatory bodies, including the UNECE and ISO/SAE, have mandated TARA to ensure acceptable risk levels. However, existing standardized TARA methods are often not ready-to-use, lack granularity regarding CAV-specific assets, and fail to adequately address the distinct properties of higher automation levels (SAE Levels 4 and 5). The study aims to identify knowledge gaps and shape the next generation of TARA methods by evaluating how current methodologies handle automation levels, privacy impacts, and risk scoring subjectivity. The authors conducted a systematic literature review following Kitchenham and Charters guidelines. They searched academic databases (ACM, IEEE, MDPI, etc.) and Standard Development Organisation portals for publications between January 2014 and April 2023. From an initial pool of 3,929 results, 23 manuscripts were selected for deep evaluation based on inclusion criteria requiring alignment with TARA essence, focus on the automotive domain, and relevance to CAVs. The review analyzed each method across ten factors, including release year, qualitative/quantitative nature, asset vs. scenario-based categorization, supported SAE automation levels, privacy impact assessment, risk metrics, rating practices, and compliance with standards such as ISO/SAE 21434. The findings classify TARA methods into fundamental techniques (e.g., STRIDE, Attack Tree Analysis, FAIR) and CAV-specific methodologies. The review highlights that while fundamental methods like STRIDE and Attack Trees are widely used for threat modeling, they often lack integrated risk scoring. Among CAV-specific methods, the study identifies a shift toward methodologies compliant with ISO/SAE 21434, such as TARA 1.0, ThreatGet, and Dobaj et al.’s security-driven lifecycle. The analysis reveals that many earlier methods, like EVITA and RACE, are limited to lower automation levels (L0–L2) and require human intervention. In contrast, newer methods like SARA, VeRA, and Zhou et al.’s framework address L3–L5 vehicles. The review also notes significant variability in how privacy is assessed; while some methods explicitly include privacy metrics, others do not. Furthermore, risk rating practices vary from expert knowledge to standardized scales like ISO/IEC 15408 or quantitative models like FAIR. The significance of this work lies in its comprehensive mapping of the TARA landscape for CAVs, identifying critical gaps in current methodologies. The authors conclude that existing methods often lack readiness for fully automated vehicles (L4/L5) and struggle with the heterogeneity of CAV properties. The study underscores the influence of ISO/SAE 21434 in driving a paradigm shift toward more structured, asset-based TARA processes. By detailing the limitations of current approaches regarding automation level consideration, privacy integration, and subjective risk scoring, the paper provides a foundation for developing more robust, standardized, and adaptable TARA frameworks capable of supporting the safety and security of future autonomous transportation systems.
Provenance
The full processing record for this entry. Every stage of this paper's journey through the pipeline is logged — what ran, with which tool and model, how many attempts it took, and when it last completed.
| Stage | Outcome | Tool | Model | Prompt | Attempts | Completed |
|---|---|---|---|---|---|---|
| discover | success | Crossref | — | — | 1 | 2026-06-18 |
| archive | success | openalex | — | — | 5 | 2026-06-25 |
| extract | success | cached | — | — | 2 | 2026-06-26 |
| clean | success | clean | — | — | 1 | 2026-06-20 |
| chunk | success | chunk | — | — | 1 | 2026-06-20 |
| embed | success | embed | Qwen/Qwen3-Embedding-8B | — | 1 | 2026-06-20 |
| enrich | success | openalex | — | — | 1 | 2026-06-20 |
| promote | success | — | — | — | 1 | 2026-06-18 |
| summarize | success | llm | qwen3.6-27b-prismaquant | summ-v5 | 1 | 2026-06-26 |
| tag | success | vector_similarity | — | — | 6 | 2026-06-20 |
| verify | success | — | — | — | 1 | 2026-06-26 |
Summary generated by qwen3.6-27b-prismaquant on 2026-06-26; verification: verified.
Topics
Ranked by relevance to this paper. Hover a topic for its definition.
Information type
What kind of knowledge this paper contributes, grouped by family — independent of topic (what it is about) and method (how it was studied).
- Applied Guidance: standards test procedures