OTARQ: Adaptive and Automated Risk Quantification Method for OTA Updates in SDVs
Year: 2026
Type: preprint
Abstract: The increasing frequency of Over-The-Air (OTA) updates on Software-Defined Vehicles (SDVs), combined with heterogeneous OTA architectures, introduces unpredictable attack entry points and vulnerabilities that may scale with fleet size. These vulnerabilities can escalate from external infrastructure components to in-vehicle systems, expanding the attack surface across the update ecosystem. In SDV architectures, realtime vulnerability risk management is challenging, as OTA updates may be deployed before corresponding security patches are released and validated. This work presents OTARQ (OTA Risk Quantification), an automated risk quantification framework that integrates cybersecurity, safety, and fleet impact assessment. The framework automatically computes a final risk score from natural-language vulnerability descriptions. OTARQ is adaptive and context-aware, dynamically adjusting its parameters according to update criticality and vulnerability location. Experiments on representative OTA threat scenarios validate both the accuracy of the risk quantification and its sensitivity to deployment context.SDV, OTA updates, vulnerability analysis
Source: HAL
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7202008465