Threat Landscape and Integrated Cybersecurity Framework for V2V and Autonomous Electric Vehicles

Abstract

This study conducts a detailed analysis of cybersecurity threats, including artificial intelligence (AI)-driven cyber-attacks targeting vehicle-to-vehicle (V2V) and electric vehicle (EV) communications within the rapidly evolving field of connected and autonomous vehicles (CAVs). As autonomous and electric vehicles become increasingly integrated into daily life, their susceptibility to cyber threats such as replay, jamming, spoofing, and denial-of-service (DoS) attacks necessitates the development of robust cybersecurity measures. Additionally, EV-specific threats, including battery management system (BMS) exploitation and compromised charging interfaces, introduce distinct vulnerabilities requiring specialized attention. This research proposes a comprehensive and integrated cybersecurity framework that rigorously examines current V2V, vehicle-to-everything (V2X), and EV-specific systems through systematic threat assessments, vulnerability analyses, and the deployment of advanced security controls. Unlike previous state-of-the-art approaches, which primarily focus on isolated threats or specific components such as V2V protocols, the proposed framework provides a holistic cybersecurity strategy addressing the entire communication stack, EV subsystems, and incorporates AI-driven threat detection mechanisms. This comprehensive and integrated approach addresses critical gaps found in the existing literature, making it significantly more adaptable and resilient against evolving cyber-attacks. Our framework aligns with industry standards and regulatory requirements, significantly enhancing the security, safety, and reliability of modern transportation systems. By incorporating specialized cryptographic techniques, secure protocols, and continuous monitoring mechanisms, the proposed approach ensures robust protection against sophisticated cyber threats, thereby safeguarding vehicle operations and user privacy.

1. Introduction

In recent years, the automotive industry has experienced significant advancements with the development and refinement of vehicle-to-vehicle (V2V) communication and software-driven autonomous driving technologies. These innovations have transformed the transportation sector, enhancing protection, efficiency, and connectivity across vehicular systems [1]. Furthermore, this evolution has led to the emergence of smart vehicles that are safer and more reliable than ever before. Cybersecurity in connected and automated vehicle (CAV) environments comprises various security issues [2]. The introduction of V2V and autonomous vehicles (AVs) has presented new cybersecurity challenges, such as GPS spoofing, man-in-the-middle attacks, sensor manipulation, denial-of-service (DoS) attacks, and unauthorized data access, for the automotive industry and public safety. AV continuously exchanges data, posing cybersecurity threats, including data privacy issues. AV systems are also susceptible to attacks, such as spoofing, which can disrupt traffic flow, and hacking, which poses a risk to passenger safety by impairing critical features like steering and braking [3]. AVs using vehicle-to-cloud (V2C) technology rely on numerous complex sensors, communication technologies and artificial intelligence to navigate and make real-time decisions [4]. The research highlighted that the automotive industry’s V2V and AV infrastructure could be divided into three main sections: the infrastructure with which autonomous vehicles interact, the interaction between vehicles and V2V, and the communication technology that facilitates interactions between vehicles and infrastructure [5]. Each element of the V2V architecture has specific components designed to perform certain functions needed for the technical operations. Such three-dimensional classification enables higher security devices for separate components and, at the same time, systematizes and categorizes the specific cybersecurity problems that each portion encounters.

Figure 1 illustrates the communication architecture of CAVs, forming the basis for identifying cybersecurity vulnerabilities across Vehicle-to-Everything (V2X) interfaces, including V2V and vehicle-to-infrastructure (V2I) communications. This network perspective enables analysis of how various cyber threats can infiltrate the AV ecosystem via exposed nodes and channels. While roadside units (RSUs), base stations, and cell towers are part of the infrastructure, they are displayed separately in Figure 1 to emphasize their specific roles in wireless communication within the V2X ecosystem. The general infrastructure label refers to broader physical components such as traffic lights, roadside buildings, or parking structures. These elements are critical, as they have a direct impact on the security and operation of antivirus software, underscoring the need for cybersecurity evaluation and improvement in these areas. DoS attacks can disrupt the infrastructure that V2V systems use to communicate, thereby preventing AVs from accessing vital information.

The operational integrity of the vehicle can also be remotely compromised if an attacker introduces a rogue device into the infrastructure, which sends misleading information to it [6]. The smart car itself becomes vulnerable to various cyber-attacks. While malicious software can be remotely installed in a car through hacking, an attacker may use software to obtain unauthorized access. Attackers can copy the vehicle’s parts, which puts its functionalities at serious risk [7]. Similarly, the communication technologies used by vehicles to interact with their surroundings are vulnerable to attacks, such as signal jamming, which interrupts wireless communication. Additionally, data injection attacks can be executed to manipulate the information, potentially leading either the vehicle or the infrastructure to make inaccurate decisions based on falsified data [8,9]. The vehicle’s sensors and other components can interact through hacked communication technology, leaving the system vulnerable to several cybersecurity risks [10,11]. This review highlights the following.

Cybersecurity attacks against AV systems exploit numerous technological vulnerabilities, revealing critical discoveries and gaps in the technology that attackers target in each kind of attack. In order to address cybersecurity issues in CAVs, the study proposes a comprehensive review by offering a thorough analysis of the cybersecurity risks these technologies face.

The remainder of this paper is structured as follows. Section 2 provides a comprehensive background study, highlighting the evolution of CAVs and the associated cybersecurity challenges. Section 3 outlines the materials and methods used, including the literature review strategy, paper selection criteria, and data extraction focused on attack types, impacts, and defensive mechanisms. Section 4 introduces a security framework for V2V communication, detailing the threat assessment, vulnerability analysis, and the implementation of protocol-level security measures. Section 5 presents the continuous monitoring phase, demonstrating how the proposed approach ensures adherence to established regulatory and industry cybersecurity requirements through the integration of Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) tools. Finally, Section 6 concludes the paper and outlines future research directions, including AI-driven security solutions and lightweight cryptographic methods to strengthen the resilience of CAV ecosystems.

2. Background Study

This section provides detailed background information on the cybersecurity challenges faced by connected and autonomous vehicles. It outlines key vulnerabilities in V2V communication systems and highlights the need for a robust security framework to address these threats.

2.1. Technological Foundations of CAVs

AVs utilize cutting-edge information and communication technology to enable cars to perceive their surroundings and move autonomously, which has increased. In the creation and development of CAVs, artificial intelligence greatly expands their capabilities. The accuracy and efficacy of the models employed directly affect the performance of CAVs since machine learning (ML) models are essential for analyzing data and making decisions in real-time that ensure safe and efficient operation. A thorough analysis is performed based on the state-of-the-art work on cybersecurity in CAVs. Three primary categories are the focus of numerous research studies and articles published in reputable journals: cybersecurity attacks on the component parts of CAVs, threats to the infrastructure that supports them, and the communication protocols used for vehicle interactions.

2.2. Overview of the Cybersecurity Attacks CAVS

A number of research studies and articles that have been published in respectable journals concentrate on three main topics: threats to the infrastructure supporting CAVs, cybersecurity attacks on the CAVs’ component parts, and the communication protocols used for vehicle interactions [12]. The purpose of this analysis is to highlight the significant cybersecurity threats to CAV systems, as identified in numerous studies and articles. These threats, selected for their severity and frequency, underscore the urgent need to bolster the security and resilience of CAV systems.

GPS spoofing CAVs are dependent on GPS systems for navigation. By spoofing GPS signals, attackers can feed false location data to the car’s navigation system, leading to incorrect routing or navigation to unsafe locations. Figure 2 shows that the technique involves transmitting false GPS signals to deceive a GPS receiver into obtaining an incorrect position, speed, or time value. Such manipulation is known as GPS spoofing, which can have detrimental effects on vehicle safety and coordination [13].

Electric vehicles (EVs), as highly digitized systems, are increasingly vulnerable to cybersecurity threats across their software-defined infrastructure. Beyond conventional V2V vulnerabilities, EVs present unique attack surfaces through their battery management systems (BMS), charging interfaces, and over-the-air (OTA) firmware updates [14]. Attackers can target the BMS to alter thermal regulation or misreport charge levels, leading to battery degradation or even fire hazards. Public EV charging stations, particularly those using open communication protocols such as open charge point protocol (OCPP), are vulnerable to man-in-the-middle and spoofing attacks that can disrupt billing or inject malware into vehicle systems [14]. Compromised OTA updates can be exploited to install malicious firmware affecting drivetrain or braking systems. These threats necessitate a customized security framework that encompasses authentication for charge points, encrypted communication with the BMS, and integrity checks for firmware updates, thereby ensuring the safety and reliability of EV-specific digital infrastructure [14]. An attempt to expose or gain unauthorized access to a network system resource is known as a network attack. A variety of attack types that interfere with communication are listed and explained in

Table 1. Attacks on CAVs.

Attack Type	Description	Impact	Countermeasures
Spoofing [15]	The attacker copies a real device to gain unauthorized access or disrupt communication	Lead to identity theft, unauthorized access, and system compromise	Authentication, encryption, and monitoring of anomalous behavior
Meaconing [15]	Retransmitting legitimate signals to mislead the target system into inappropriate actions	Systems will process false data, leading to incorrect decisions	Secure communication protocols
Jamming [16]	Troublesome communication by flooding the communication channel with noise	Disables the quality of communication, leading to a loss of service	Use of frequency hopping, signal modulation
Replay [17]	Capturing valid communication to trick the system into suffering the repeated data	Compromise authentication or authorization mechanisms	Timestamping, usage nonce values, and sequence numbers to detect repeated data
Denial-of-Service [18,19]	Overloading a system’s resources or network to prevent legitimate users from accessing the system or services	Causes downtime, performance degradation, or total unavailability of services	Rate limiting, network firewalls, traffic analysis, and redundancy to distribute the load
Disruptive [20]	Attacks that cause disturbances in the operation of a system	System reliability, availability, and performance affected	Monitoring for abnormal behaviors and recovery measures
Relay [21]	Interrupting messages between two deceive	Breach of confidential data	Encryption and secure key exchange protocols can be used
Time Synchronization [22]	Interrupts the synchronization of time-sensitive operations in V2V communication	Falsify vehicles communication	Strong anomaly detection systems
Routing [22]	Serious risks to the communication infrastructure	Flaws in routing protocols	Monitoring for abnormal behaviors and recovery measures
Blinding [23]	Systems or sensors manipulated by attackers	Disables system performance, often rendering it blind	Robust sensor design and anomaly detection in systems

, which categorizes them as spoofing attacks, meaconing attacks, replay attacks, and jamming attacks. In addition,

Table 2. Autonomous Vehicles Surveys Summary.

Ref.	Survey	Area Covered
[24]	Autonomous vehicles challenges	AV data gathering using sensors
[25]	Autonomous vehicle’s progress, and challenges	Focuses on the current state of research
[26]	Artificial intelligence applications in the development of autonomous vehicles: A survey	AI in supporting primary applications in AVs in decision-making
[27]	Decision-making for autonomous vehicles	Trends and challenges in autonomous vehicles
[28]	Vehicular communication systems	Intensive road safety and traffic efficiency
[29]	Proposed security models	Enhanced study on common attacks and attack defenses
[30]	Smart car sensors and applications	Consider an intelligent autonomous vehicle control system
[31]	Anonymous batch authenticated and key agreement (ABAKA) scheme	Personalized for autonomous vehicles to authenticate multiple requests

summarizes previous related work on attacks targeting autonomous vehicles, providing insights from recent surveys and studies.

2.3. Electronic Control Unit Manipulation

The Electronic Control Unit (ECU) is the heart of the CAV’s, regulating a number of operations such as gear shifts, explosion systems, electronic window controls, and climate control. V2V communication technology relies on ECUs to read and respond to information received from other vehicles, ultimately enhancing safety, efficiency, and the overall driving experience. Typically, the ECU manufacturer releases firmware updates to enhance functionality, address security vulnerabilities, or correct system errors. Hackers can exploit vulnerabilities in the update procedure, inserting malicious malware into the update files during firmware updates [17]. A Controller Area Network is a message-based protocol designed to allow the ECU and other components of the vehicle to communicate with each other [32].

SAE J1939 is the standard for vehicle buses. It is a recommended approach used for communication among vehicle components. Since the SAE J1939 bus is designed to inherit all the vulnerabilities of a CAN bus [33]. Advanced sensor technologies like Light Detection and Ranging (LiDAR) are commonly used by CAVs and AVs for navigation and environmental perception. Yet, depending too much on LiDAR also creates security flaws, particularly concerning physical threats [33]. Physical LiDAR assaults occur when an attacker interferes with the LiDAR system’s functionality.

2.4. Cybersecurity Attacks on the Infrastructure of Connected and Autonomous Vehicles

Figure 3 and Figure 4 illustrate different dimensions of the cybersecurity threat landscape within V2V communication systems. V2V communication is essential for road safety, enabling vehicles to exchange critical information such as location, speed, and braking status. Figure 3 highlights internal components of CAVs, including the in-vehicle network, CAN, sensors, cameras, GPS, and ECUs, which are susceptible to cyber-attacks such as spoofing or signal manipulation [32]. In contrast, Figure 4 focuses on the external infrastructure that facilitates CAV communication, including base stations, cellular towers, roadside units (RSUs), and other IoT-based connectivity elements [34]. Together, these figures demonstrate that both in-vehicle systems and communication infrastructure must be secured to ensure the overall cybersecurity of CAVs.

The infrastructure through which CAVs communicate includes base stations, cellular towers, traffic signals, parking buildings, and IoT devices [34].

2.5. Cybersecurity Threats to CAV Communication Protocols

V2X communication in vehicular cellular networks requires low latency and high performance since these networks function as high-speed information systems. They demand fast connectivity with the development of 5G technology [35]. To improve connectivity in-vehicle networks, protocols were proposed, including Cellular Vehicle-to-Everything (C-V2X) over 5G and Dedicated Short-Range Communications (DSRC). V2V communication protocols enable the exchange of data between vehicles. Some commonly used protocols include:

Dedicated Short-Range Communications (DSRC): IEEE 802.11p, also known as Wireless Access in Vehicular Environments (WAVE), is common for low-latency vehicle communication. DSRC operates in the 5.9 GHz band specifically designed for vehicle communications.

Cellular-V2X (C-V2X): Cellular-based technology that utilizes existing LTE/5G networks to enable direct V2V and V2I communication.

Additionally, EVs rely on advanced communication protocols for real-time data exchange between critical subsystems, such as BMS, charging infrastructure, telematics, and cloud services [36,37,38]. These include OCPP, ISO/IEC 15118 (Plug and Charge), and CAN bus extensions for powertrain coordination [38,39,40]. However, these protocols present several cybersecurity vulnerabilities. OCPP sessions can be intercepted or spoofed, allowing attackers to manipulate charging commands or falsify billing data. ISO/IEC 15118, which facilitates seamless EV-grid interaction, may be exploited via man-in-the-middle attacks to gain unauthorized control over charging events [41].

The above background study concluded that high-performance data exchange and communication between vehicles are essential for autonomous vehicle networks.

3. Materials and Methods

3.1. Literature Review Strategy

IEEE Xplore, ACM, Elsevier, and Springer provide a vast library of peer-reviewed papers on technology, security, and automotive advancements, making them reliable sources for literature. Therefore, we selected it as the primary source for our literature review. The study concepts are categorized into three primary groups: cybersecurity, frameworks, and connected AVs [42,43,44,45,46,47].

Table 3. Keyword Search.

Group	Keywords
CAVs	“Autonomous Vehicle(s)”, “CAV(s)”, “V2V technology”, “connected and autonomous vehicle(s)”, “smart car(s)”, “vehicle-to-vehicle technology”
Framework	“CAV security framework(s)”, “autonomous vehicle security framework(s)”, “V2V cybersecurity framework(s)”, “cybersecurity framework(s)”, “cybersecurity frameworks for autonomous vehicle(s)”, “framework”
Cybersecurity	“cyber-attack(s)”, “cyber security”, “hacker(s)”, “attack(s)”, “cyber safety”

shows several other search queries that used combinations of phrases from these categories. In addition,

Table 4. Abbreviations.

Abbreviations	Explanation
CAVs	Connected Autonomous Vehicles
AI	Artificial Intelligence
CRF	Cyber Security Regulatory Framework
DSRC	Dedicated short-range Communication
ITS	Intelligence Transport System
V2X	Vehicle-to-Everything
ECU	Electronic Control Unit
UWB	Ultra-Wideband

lists the abbreviations and acronyms used throughout this paper for clarity.

To guarantee the quality and relevance of the literature the following standards are considered, research released from 2015 to the present to document new developments in cybersecurity and connected autonomous vehicle technology. Articles that are not published in English language, those that are not subjected to peer review, and those that focus on general automotive technology without any cybersecurity components are excluded. Titles and abstracts served as the basis for the first screening. A full-text review was conducted on articles that seemed to fit the requirements in order to confirm their applicability.

3.2. Data Extraction from Selected Papers

To gather data from each chosen paper, we focus on the following aspects:

• Attack Types: Particular cybersecurity risks have been identified for CAV infrastructure, communication protocols, and components.
• Impact: The seriousness of each attack and its possible effects on data integrity and vehicle safety.
• Defensive Mechanisms: Current or suggested strategies to neutralize recognized threats.

After that, each paper was categorized into three main focus areas: communication protocols, infrastructure communication, or CAV components. This classification helps in organizing unique cybersecurity issues in each domain, providing a clearer overview of the current situation.

3.3. Quality Assessment

The study carried out a quality evaluation using the following standards to guarantee the validity of our conclusions:

• Relevance: Checks how much the paper discusses in the review conducted is based on cybersecurity in relation to CAVs.
• Contribution to Knowledge: Whether the study offers theoretical frameworks, empirical data, or fresh viewpoints on cybersecurity threats.
• Methodological Reliability: Evaluation of the employed methodology, such as attack simulations, vulnerability assessments, or empirical analysis.

Figure 5 illustrates the systematic literature review (SLR) methodology workflow used in this study. The process begins by defining the research goal and scope, followed by keyword group definition and selection of key academic databases such as IEEE Xplore, ACM Digital Library, Elsevier, and Springer. A multi-layered inclusion and exclusion strategy is applied, filtering papers based on language (English), peer-review status, publication date (2015 or later), and relevance to CAV cybersecurity, while excluding general automotive topics. An initial screening of titles and abstracts is performed, followed by a full-text review of potentially relevant papers. This process ensures that only the literature specifically addressing cybersecurity in the context of CAVs is retained.

Data extraction focuses on identifying key cybersecurity aspects such as attack types, impacts, and defensive mechanisms, which are then categorized by focus areas (communication protocols, infrastructure communication, or CAV components). A final quality assessment stage, evaluating relevance, methodological rigor, and contribution to knowledge, ensures that only high-quality, relevant papers contribute to the final dataset for analysis, which forms the basis for the detailed data processing workflow shown in Figure 6.

Figure 6 illustrates the structured data extraction and categorization process that complements the inclusion/exclusion workflow in Figure 5. After the relevant papers are sourced and screened, key cybersecurity metrics are systematically extracted, including attack types, impacts, and defensive mechanisms. The extracted data is then categorized into three main focus areas: communication protocols, CAV components, and infrastructure communication. A quality assessment step evaluates each paper’s relevance, contribution to knowledge, and methodological reliability. Together, these steps form a transparent and reproducible SLR process that provides a solid foundation for threat assessment, vulnerability analysis, and the development of effective cybersecurity controls.

4. Framework of Security Protocols and Standards in V2V Communication

A secure industrial and business systems design starts by identifying the cyber security objectives of the host systems [36]. To develop a secure design, a framework has to be followed to ensure all the cyber security objectives are met every single time. New systems demand more security as new objectives are introduced over time [37]. This section presents a structured review methodology designed to evaluate existing research on securing CAVs and V2V systems against both current and emerging cybersecurity threats, and to inform the development of an original, integrated cybersecurity framework. Grounded in a comprehensive analysis of high-quality studies, the proposed framework goes beyond synthesis by offering a novel, review-informed solution that prioritizes the implementation of robust security controls, continuous cyber threat monitoring, and strong privacy protection mechanisms. This contribution directly addresses cybersecurity challenges in both V2V communications and EV-specific subsystems, thereby enhancing the practical relevance of the study.

4.1. Threat Assessment

The first phase of the framework focuses on performing a threat assessment on the CAV and V2V infrastructure and communication protocols to gain threat intelligence. Cyber threat intelligence can be gathered on the identified assets. Based on literature review studies from the past, these assets are open-source data, shared intelligence from other organizations, or performing threat hunts on V2V systems [38]. The gathered threat intelligence is then used to assess risks based on NIST and MITRE ATTACK cybersecurity frameworks.

Deep Packet Inspection (DPI) provides enhanced security by examining packet payloads and headers in real-time [39]. For autonomous vehicle networks, DPI tools like Suricata can be configured to identify anomalous V2V traffic such as spoofed Cooperative Awareness Messages (CAMs) or malformed Basic Safety Messages (BSMs) [39]. Vulnerabilities in protocols such as IEEE 802.11p and 3GPP-based C-V2X are particularly critical under real-time constraints, as improper authentication or message flooding can lead to latency or denial-of-service conditions [39]. Comparative testing using fuzzing tools like AFL or Scapy within a virtual testbed (e.g., Veins with SUMO) enables the assessment of protocol robustness [39]. Furthermore, deploying rule-based DPI with behavioral anomaly detection (via machine learning) enhances the system’s adaptability to zero-day threats. The proposed framework’s DPI layer bridges traditional protocol assurance with real-time detection in vehicular contexts [39].

4.2. Attacks Analysis Framework

The second phase of the framework focuses on previously performed vulnerability analysis, testing, and validation. Figure 7 details the stages to ensure there is no vulnerability gap in the V2V system and that it is not susceptible to both seen and unseen cybersecurity vulnerabilities.

Simulation-based testing is a crucial phase for evaluating autonomous vehicle cybersecurity under realistic conditions. Tools such as CARLA and Veins allow the emulation of GPS spoofing, jamming, and replay attacks in controlled environments [40]. By simulating urban vs. highway environments, researchers can analyze attack propagation, latency changes, and packet loss across DSRC and C-V2X networks [40]. For instance, GPS spoofing can introduce average position errors exceeding 250 ms in congested networks [40]. Data collected during these simulations supports the development of attack signatures and guides anomaly detection thresholds in IDS systems [40]. Furthermore, a testbed enables the validation of mitigation strategies, such as frequency hopping or timestamping, in replay-resilient communication.

Vulnerability analysis can be conducted in two ways within a controlled environment:

• Option 1: Perform dispersion testing to identify any known vulnerabilities. Dispersion testers also attempt to exploit the system to uncover unknown attacks and gaps, including issues in authentication mechanisms, encryption protocols, and message integrity verification [38].
• Option 2: Regular vulnerability scanning must be conducted using dedicated tools, which scan the entire system plus assets to detect any known vulnerabilities. Vulnerability analysis performed includes:

  i.

  Controlled security testing and vulnerability scanning are the two primary methods used in controlled security testing, which is the first step in the process [40]. To reduce the threats to real systems, this stage makes sure that the testing is carried out in a secure and regulated setting.

  ii.

  Figure 8 shows dispersion testing, which involves simulating cyber-attacks on the system to identify potential threats.

  iii.

  Vulnerability scanning automated technology is used in bikes with penetration testing to find any known threats in systems.

  iv.

  Vulnerability evaluation involves validating and ranking the results to determine which vulnerabilities are the most dangerous.

  v.

  Document findings; every vulnerability that has been found is included, along with information on its seriousness and its effects.

  vi.

  Risk assessment based on collected findings to determine the risk level of each vulnerability. Prioritizing which issues require instant attention and which can wait is made easier by this assessment.

  vii.

  Security controls evaluation of current security measures in addressing the vulnerabilities found is assessed.

  viii.

  Continuous improvement analysis used the recorded findings and evaluation outcomes. This helps maintain strong security over time, which entails upgrading testing procedures, enhancing tools, and consistently checking for new threats.

Finally, the vulnerability analysis is introduced based on the above steps, which can be used during the security controls evaluation phase to validate existing security controls and establish new ones.

4.3. Privacy Considerations

The third phase of the framework focuses on privacy aspects of the system design based on the CIA Triad: Confidentiality, Integrity, and Availability, as illustrated in Figure 9. It is ensured that the user’s data is kept private and secure based on data encryption, with appropriate access control and user rights [41]. The security of data gets improved through differential privacy by introducing noise to the information, which protects individual vehicles from identification during analysis of aggregated statistics. Homomorphic encryption further enhances data privacy by enabling the computation of encrypted vehicle information directly through secure processes that protect sensitive data throughout the entire operation. Additionally, secure multi-party computation (MPC) enables different vehicles to collaborate on data-driven decisions by obscuring their raw data, thereby minimizing privacy threats in V2 communication. Autonomous systems gain protection from data attacks because these techniques employ an effective combination of security methods that safeguard vehicle data while maintaining system efficiency.

In V2V communication systems, ensuring data confidentiality and integrity is paramount. Lightweight cryptographic algorithms such as PRESENT and Ascon, recently standardized by NIST, are particularly suitable for resource-constrained embedded systems in autonomous vehicles [42]. These ciphers provide security while maintaining efficiency and low computational overhead, ideal for real-time V2V message exchange. Moreover, the integration of homomorphic encryption enables encrypted data processing, allowing for operations like traffic prediction without compromising user privacy [42]. Additionally, secure multi-party computation (SMPC) enables multiple vehicles to collaboratively make decisions, such as route planning or congestion analysis, without exposing sensitive data. By using these cryptographic schemes, the system can defend against eavesdropping, man-in-the-middle, and injection attacks [42]. Combining these methods within the proposed framework not only ensures robust communication security but also aligns with future-proof privacy-by-design principles for vehicular networks.

5. Continuous Monitoring, Compliance and Regulations

The framework in Figure 10 focuses on performing continuous monitoring of the CAV, the infrastructure, and the communication technologies for cyber threats and AI-driven attacks using tools like SIEM and EDR tools. This is supportive to ensure that no V2V system component is targeted by cyber-attacks; if a cyber-attack takes place, continuous monitoring is used to ensure it gets flagged, and mitigation techniques can be followed to prevent the attack.

The integration of SIEM and EDR tools is increasingly recognized as essential in the context of CAVs. SIEM tools offer centralized visibility by collecting, correlating, and analyzing events from various vehicle systems, which is crucial for detecting suspicious or unauthorized activities in real time [43]. Meanwhile, EDR tools provide continuous endpoint monitoring, enabling rapid identification and response to cyber threats and anomalous behaviors within vehicle networks [44]. The complementary deployment of SIEM and EDR creates a layered defense that significantly enhances the ability to detect, contain, and investigate security incidents, thus supporting both operational safety and regulatory compliance [44,45]. This approach is particularly important as connected vehicles and V2V communication systems face an evolving threat landscape and increasingly stringent compliance requirements [46].

To ensure continuous compliance and security in V2V technology, we implement the following measures:

i.

EDR tool installed on endpoints to rapidly detect and respond to cyber-attacks, thereby ensuring no endpoint becomes compromised [47].

ii.

Compliance and regulations are evaluated regularly to ensure that the defined standards and techniques are followed exactly as they are defined.

iii.

Ensure regulatory compliance verifies that V2V technology complies with applicable regulations and standards, such as ISO/SAE 21434 for automotive cybersecurity or regional regulatory requirements.

iv.

Adhering to industry best practices helps V2V security practices utilize industry-recognized frameworks and guidelines, such as the NIST Cybersecurity Framework or those specific to the Automotive Industry.

v.

Participate in information sharing and engage with industry consortia, government agencies, and cybersecurity communities to share threat intelligence and best practices for enhancing the security of V2V technology.

Furthermore, this approach is aligned with recent research and industry guidance highlighting the necessity of real-time monitoring, rapid incident response, and forensic capabilities provided by SIEM and EDR systems in automotive environments [48]. These tools also facilitate compliance with standards and regulations, ensuring that security events are properly logged, documented, and reported as required by emerging automotive cybersecurity frameworks [48].

The proposed continuous monitoring strategy is designed to ensure practical compliance with key regulatory frameworks such as ISO/SAE 21434 and the NIST Cybersecurity Framework [49]. ISO/SAE 21434 mandates continuous risk assessment and cybersecurity monitoring throughout the vehicle lifecycle, which is operationalized in our framework through the integration of SIEM and EDR systems [49]. These tools provide real-time threat detection, log correlation, and automated incident response, directly supporting the “Monitor” and “Respond” functions defined in the NIST framework [43]. Furthermore, our approach supports traceability, auditability, and evidence collection required for compliance reporting under ISO/SAE 21434 by ensuring that security events are continuously logged, assessed against known attack patterns, and escalated according to predefined thresholds [49]. This practical alignment ensures that autonomous vehicle systems are secure, auditable, and regulatory-ready across their operational lifecycle.

Security Controls Evaluation

Figure 11 illustrates that the last phase of the framework is based on the findings and evaluations of other phases in the framework to evaluate and create new security controls.

i.

New security controls are created based on the requirements, or existing ones are evaluated.

ii.

Threat assessments are performed, evaluated, and documented according to the objectives.

iii.

Privacy considerations are assessed and documented according to the objectives;

iv.

Continuous monitoring, compliance, and regulations are performed, evaluated, and documented according to the objectives.

v.

A detailed evaluation and documentation review is conducted.

vi.

Based on the findings, new control protocols are created.

6. Comparative Analysis and Discussion

The growing penetration of CAVs into contemporary transportation networks has intensified the need for robust cybersecurity measures. While prior research has made significant progress, it often addresses individual components in isolation, for example, securing V2V communication protocols or identifying vulnerabilities in EV subsystems such as the BMS [14,36,37,38]. Although valuable, these contributions generally lack a unified perspective capable of addressing the complex and evolving cyber threats in CAV environments.

As illustrated in our proposed framework (Figure 7), we offer a comprehensive solution for cybersecurity that secures both V2V, V2X, and EV-specific elements simultaneously. Through AI-based threat identification, secure cryptographic methods, and ongoing monitoring mechanisms, the framework protects against both traditional and novel cyber-attacks such as spoofing, replay, jamming, and DoS.

Table 5. Comparative Analysis of the Proposed Cybersecurity Framework for CAVs and EVs.

Ref.	Problem Focused	Key Contribution	Limitation	Proposed Framework
[50]	CAV security	Proposed an emerging framework for CAVs	Limited integration across V2V, V2X, and EVs	Offers holistic protection across all subsystems
[51,52]	Lightweight cryptography	Surveyed cryptographic techniques for IoT	Lacks specific adaptation to V2V/EVs	Adapts lightweight crypto for EV-specific needs
[51,53,54]	Technology standardization, Ethics and user trust	Explores ethical concerns in automation and outlines policy frameworks	Not focused on technical cybersecurity	Integrates security with regulatory/ethical alignment
[55,56,57,58]	Human training and performance	Enhances AV user understanding via training	Focus on human factors, not system-level threats	Complements technical cybersecurity with user education
[59,60]	V2V authentication	Proposed a dual-factor AKE protocol using biometrics and PUF	Focused on V2V only; lacks broader system integration	Integrates strong AKE within a monitored multi-layered architecture
[61,62]	Industrial IoT in Industry 5.0	Describes IIoT and scalability challenges	No direct application to transportation systems	Bridges Industry 5.0 principles with vehicular networks
[63]	IoT-Digital Twins (Industry 5.0)	Outlines IoT-based frameworks for digital twins	Focus on manufacturing, not CAVs	Applies principles to EV infrastructure and firmware updates
Proposed Study	V2V, V2X, EVs (integrated)	AI-driven, cryptographic, lightweight, regulatory-aligned cybersecurity framework	Not yet empirically validated; implementation remains future work	Comprehensive, scalable, and adaptive to evolving cyber threats

provides a comparative analysis of the proposed cybersecurity framework against existing approaches in the literature.

The comparative analysis highlightsrecent research and models in the domain of CAV cybersecurity and Industry 5.0 applications. Although most contributions provide important findings on lightweight cryptography [52], digital twin technologies [61], or security of CAV components [50], few focus on particular subsystems individually or fail to adapt to changing threat landscapes. In contrast to other work that tends to neglect interdependencies [50,51] between EV-specific subsystems and communications layers, our approach promotes system-level resilience and concurs with regulatory demands as well as industry expectations. This integrated approach not only fills current research gaps but also enhances adaptability to quickly changing attack vectors. In addition, our comparative threat model analysis and deployment of sophisticated countermeasures highlight the effectiveness of an integrated security stance to protect both vehicle operation and user privacy. The results highlight the need for moving away from fragmented defenses to consolidated, adaptive cybersecurity systems in smart transport networks. With the evolving threat landscape, upcoming research should look at real-time verification, deployment in heterogeneous environments, and cooperative sharing of threat intelligence among manufacturers and infrastructure providers.

7. Conclusions and Future Work

This study provides an in-depth literature review on cybersecurity attacks targeting V2V communications, showcasing how these technologies are becoming increasingly integral to modern life, offering substantial benefits in terms of safety, efficiency, and convenience. However, the vulnerabilities exposed by cyber threats, such as AI-driven attacks, DoS, spoofing, replay, and jamming, necessitate stringent cybersecurity measures. Adopting advanced mathematical cryptographic techniques inspired by innovations in Industry 5.0 could bolster the security frameworks for these systems. By integrating lightweight cryptographic models designed for resource-limited settings, similarly to those used in industrial IoT devices within Industry 5.0, the proposed framework could ensure scalability and enhanced protection against sophisticated cyber threats. The proposed approach demonstrates superior adaptability and robustness in mitigating a wide range of cyber-attacks, including spoofing, replay, jamming, and AI-driven intrusions. Unlike existing state-of-the-art approaches that often address isolated threats, our integrated framework covers the full communication stack, subsystem interactions, and AI-based threat detection mechanisms. Our comprehensive cybersecurity framework serves as a detailed guide for safeguarding V2V, V2X, and CAV systems, employing a structured approach to risk mitigation that covers major areas such as threat assessment, vulnerability analysis, security control evaluation, and privacy considerations. The framework is aligned with industrial standards, emphasizing regulatory compliance and the adoption of best practices in cybersecurity. Implementing this approach, with an emphasis on cryptographic security as relevant in Industry 5.0, will enhance the security landscape of V2V and V2X technologies, thereby increasing confidence in the security and reliability of autonomous and connected vehicles. This adaptation is pivotal in ensuring that our cybersecurity measures keep pace with the rapid advancements in Industry 5.0 and the transportation industry, marking a significant step towards securing the interconnected and automated industrial settings of the future.

Future work will focus on enhancing the AI-driven threat intelligence layer by integrating real-time data collection pipelines and adaptive learning models to improve attack prediction and autonomous response. Additionally, we aim to deploy and validate the proposed framework in simulated and real-world V2X testbed environments, enabling evaluation of its scalability, resilience, and practical deployment performance under dynamic vehicular conditions.