A Study on Extending the TARA Methodology for Physical AI : A Case Study of ADS

Artifacts for "A Study on Extending the TARA Methodology for Physical AI: A Case Study of ADS" Paper: A Study on Extending the TARA Methodology for Physical AI: A Case Study of ADS Authors: Jihun Woo1, Junhyeong Lee1,* 1 KTR Software, Seoul, Republic of Korea* Corresponding author: [e-mail] Venue: USENIX VehicleSec 2026 1. Overview This repository contains the complete dataset artifacts for our extended Threat Analysis and Risk Assessment (TARA) methodology applied to an Automated Driving System (ADS) on the NVIDIA Jetson platform. The methodology integrates STRIDE, MITRE ATLAS, and OWASP Top 10 for LLMs within an ISO/SAE 21434-compliant process. These artifacts serve two purposes: Reproducibility — Reviewers can trace every claim in the paper (e.g., 100% UN R155 Annex 5 coverage, 29% additional AI-specific risks, 38 security checklists) back to the underlying data provided here. Reusability — Practitioners and researchers conducting TARA or threat modeling for other Physical AI / ADS architectures can use these artifacts as a reference template, adapting the DFDs, Attack Library, and checklist derivation process to their own systems. 2. Directory Structure ├── 1. DFD/ │ ├── Level 0.png # System context diagram │ ├── Level 1.png # Subsystem-level DFD │ └── Level 2.png # Component-level DFD │ ├── 2. AttackLibrary/ │ ├── Attack.pdf # Consolidated Attack Library │ └── Attack/ │ ├── CVE.pdf # CVE-based attack references │ ├── CWE.pdf # CWE-based weakness references │ ├── Paper.pdf # Academic paper-based attack references │ ├── Standard.pdf # Standard-based references │ └── Technical Report.pdf # Technical report-based references │ ├── 3. Threat Scenario/ │ ├── Threat Scenario(STRIDE).pdf # Baseline threat scenarios (Table 3) │ ├── Threat Scenario(ATLAS).pdf # AI-specific threats via MITRE ATLAS (Table 4) │ └── Threat Scenario(OWASP).pdf # LLM-specific threats via OWASP Top 10 (Table 5) │ ├── 4. Damage Scenario/ │ └── Damage Scenario.pdf # Impact analysis and damage scenarios (Table 6) │ ├── 5. Attack Path Analysis/ │ └── Attack Path.pdf # Traceability: Threat + Attack Library + Damage (Table 7) │ ├── 6. Derivation Security Requirements/ │ └── Security Requirement.pdf # Security requirements per threat (Table 8) │ ├── 7. Derivation CheckList/ │ └── Checklist.pdf # 38 actionable security checklists (CL-01 to CL-38) │ └── 8. Mapping to UN R 155 Annex 5 Threats/ └── Mapping to UN R 155 Annex 5 Threats.pdf # Checklists Are Mapping to UN R 155 Annex 5 Each directory corresponds to a step in the extended TARA process (Sections 3–4 of the paper). All documents are provided in PDF format. 3. System Requirements - Hardware: None required. - Software: A PDF reader (e.g., Adobe Acrobat, any web browser). No code execution is needed — these artifacts are analytical datasets. 4. Paper-to-Artifact Mapping The table below shows which files correspond to which parts of the paper, so reviewers can locate the full underlying data behind any table or figure. Paper Section Table / Figure Artifact 4.1 Asset Identification Figure A.1–A.3 1. DFD (Level 0, 1, 2) 3.2 Attack Library Construction Table 1 2. AttackLibrary 4.2 Threat Scenario (STRIDE) Table 3 3. Threat Scenario/Threat Scenario(STRIDE).pdf 4.2 Threat Scenario (ATLAS) Table 4 3. Threat Scenario/Threat Scenario(ATLAS).pdf 4.2 Threat Scenario (OWASP) Table 5 3. Threat Scenario/Threat Scenario(OWASP).pdf 4.3 Impact Rating Table 6 4. Damage Scenario/Damage Scenario.pdf 4.4 Attack Path Analysis Table 7 5. Attack Path Analysis/Attack Path.pdf 4.5 Security Requirements Table 8 6. Derivation Security Requirements/Security Requirement.pdf 4.6 Checklist Derivation Table A.4, A.5 7. Derivation CheckList/Checklist.pdf 5.1 Legal Coverage Table B.1, B.2 8. Mapping to UN R 155 Annex 5 Threats/Mapping to UN R 155 Annex 5 Threats.pdf The paper's tables present representative examples; the artifacts here contain the complete, unabridged datasets. 5. How to Use This Dataset 5.1 Reproducing the ADS Case Study These artifacts are the complete output of our case study (Section 4). Since the TARA process is an analytical methodology — not a computational experiment — **the dataset itself is the result**. Reviewers can verify the paper's findings by: Opening any artifact and confirming that the paper's tables are faithful subsets of the full data. Tracing any checklist item (e.g., CL-25) backward through the entire pipeline to verify end-to-end traceability: CL-25 (Checklist) → Security Requirement (6. Derivation Security Requirements/) → Attack Path (5. Attack Path Analysis/) → Threat Scenario (3. Threat Scenario/) + Attack Library (2. AttackLibrary/) → Asset in DFD (1. DFD/) 5.2 Reusing for ADS Threat Modeling Researchers or practitioners conducting TARA on an ADS — whether on the same NVIDIA Jetson platform or a similar architecture — can directly reuse or extend the following artifacts: Attack Library(2. AttackLibrary) — The library is constructed from CVEs, CWEs, academic papers, standards, and technical reports relevant to ADS. It can be used as-is for any ADS sharing similar components (camera, LiDAR, radar, MLLM, sensor fusion), or filtered/extended for a specific target system. Threat Scenarios(3. Threat Scenario) — The STRIDE, ATLAS, and OWASP threat scenarios are derived per asset type. For an ADS with the same perception-planning-control architecture, these scenarios serve as a baseline that can be adopted or adapted. Checklist(7. Derivation CheckList) — The 38 security checklists are validated against UN R155 Annex 5. They can be used directly as a compliance checklist for ADS cybersecurity assessment or Vehicle Type Approval (VTA) preparation. 5.3 Adapting to Other Physical AI Systems For systems beyond ADS (e.g., autonomous drones, robotic surgery, smart manufacturing), the artifacts serve as a reference template for applying the extended TARA methodology: Define your system architecture using multi-level DFDs (see 1. DFD for the format and decomposition approach). Build or extend the Attack Library — the CVE/CWE/Paper structure in 2. AttackLibrary can be reused for shared components (e.g., GPU, OS, sensors) and supplemented with domain-specific entries. Apply the three-framework threat identification in parallel: - STRIDE for software/network threats - MITRE ATLAS for AI/ML-specific threats - OWASP Top 10 for LLMs (if applicable) Follow the TARA pipeline (directories 4–7) as a process template to derive damage scenarios, attack paths, security requirements, and checklists for your target system. 6. License This dataset is released under the [Creative Commons Attribution 4.0 International License (CC BY 4.0)](https://creativecommons.org/licenses/by/4.0/). You are free to share and adapt this material for any purpose, provided you give appropriate credit. If you use these artifacts in your work, please cite: bibtex @inproceedings{woo2026tara, title = {A Study on Extending the TARA Methodology for Physical AI: A Case Study of ADS}, author = {Woo, Jihun and Lee, Junhyeong}, booktitle = {Proceedings of the USENIX Workshop on Vehicle Security (VehicleSec)}, year = {2026} }### 《面向物理人工智能的TARA方法论扩展研究：自动驾驶系统案例》配套数据集 **论文**：《面向物理人工智能的TARA方法论扩展研究：自动驾驶系统案例》 **作者**：Woo Jihun¹, Lee Junhyeong¹,* ¹韩国首尔KTR软件公司 *通讯作者：[e-mail] **发表会议**：USENIX 2026年车辆安全研讨会（VehicleSec） 1. 概述 本仓库包含针对NVIDIA Jetson平台上自动驾驶系统（Automated Driving System，简称ADS）所扩展的威胁分析与风险评估（Threat Analysis and Risk Assessment，简称TARA）方法论的完整配套数据集。该方法论将STRIDE、MITRE ATLAS以及面向大语言模型（Large Language Model，简称LLM）的OWASP Top 10整合至符合ISO/SAE 21434标准的流程中。 本配套数据集具备两大用途： - **可复现性**：审稿人可将论文中的所有结论（例如100%覆盖UN R155附件5、新增29%针对人工智能的专属风险、38项安全检查清单）追溯至本文提供的原始数据。 - **可复用性**：针对其他物理人工智能/自动驾驶系统架构开展TARA或威胁建模的从业者与研究者，可将本数据集作为参考模板，将数据流图（Data Flow Diagram，简称DFD）、攻击库以及检查清单推导流程适配至自身系统中。 2. 目录结构 ├── 1. 数据流图（Data Flow Diagram，简称DFD）/ │ ├── Level 0.png # 系统上下文图 │ ├── Level 1.png # 子系统级数据流图 │ └── Level 2.png # 组件级数据流图 │ ├── 2. 攻击库/ │ ├── Attack.pdf # 整合式攻击库文档 │ └── Attack/ │ ├── CVE.pdf # 基于通用漏洞披露（Common Vulnerabilities and Exposures，简称CVE）的攻击参考文档 │ ├── CWE.pdf # 基于通用弱点枚举（Common Weakness Enumeration，简称CWE）的弱点参考文档 │ ├── Paper.pdf # 基于学术论文的攻击参考文档 │ ├── Standard.pdf # 基于行业标准的参考文档 │ └── Technical Report.pdf # 基于技术报告的参考文档 │ ├── 3. 威胁场景/ │ ├── Threat Scenario(STRIDE).pdf # 基线威胁场景（对应论文表3） │ ├── Threat Scenario(ATLAS).pdf # 基于MITRE ATLAS的人工智能专属威胁场景（对应论文表4） │ └── Threat Scenario(OWASP).pdf # 基于OWASP Top 10的大语言模型专属威胁场景（对应论文表5） │ ├── 4. 损害场景/ │ └── Damage Scenario.pdf # 影响分析与损害场景文档（对应论文表6） │ ├── 5. 攻击路径分析/ │ └── Attack Path.pdf # 可追溯性文档：威胁+攻击库+损害场景（对应论文表7） │ ├── 6. 安全需求推导/ │ └── Security Requirement.pdf # 基于威胁的安全需求文档（对应论文表8） │ ├── 7. 检查清单推导/ │ └── Checklist.pdf # 38项可落地安全检查清单（编号CL-01至CL-38） │ └── 8. UN R155附件5威胁映射/ └── Mapping to UN R 155 Annex 5 Threats.pdf # 检查清单与UN R155附件5威胁的映射文档 每个目录对应扩展后的TARA方法论流程的一个步骤（对应论文第3~4章节）。所有文档均以PDF格式提供。 3. 系统要求 - 硬件：无要求。 - 软件：PDF阅读器（例如Adobe Acrobat、任意网页浏览器）。 无需执行代码——本数据集为分析型数据集。 4. 论文与数据集映射关系 下表展示了各文件与论文对应部分的关联关系，便于审稿人定位任意表格或图表背后的完整原始数据。 | 论文章节 | 表格/图表 | 配套数据集文件 | |----------|-----------|----------------| | 4.1 资产识别 | 图A.1~A.3 | 1. DFD（Level 0、1、2） | | 3.2 攻击库构建 | 表1 | 2. 攻击库 | | 4.2 威胁场景（STRIDE） | 表3 | 3. 威胁场景/Threat Scenario(STRIDE).pdf | | 4.2 威胁场景（ATLAS） | 表4 | 3. 威胁场景/Threat Scenario(ATLAS).pdf | | 4.2 威胁场景（OWASP） | 表5 | 3. 威胁场景/Threat Scenario(OWASP).pdf | | 4.3 影响评级 | 表6 | 4. 损害场景/Damage Scenario.pdf | | 4.4 攻击路径分析 | 表7 | 5. 攻击路径分析/Attack Path.pdf | | 4.5 安全需求推导 | 表8 | 6. 安全需求推导/Security Requirement.pdf | | 4.6 检查清单推导 | 表A.4、A.5 | 7. 检查清单推导/Checklist.pdf | | 5.1 合规覆盖范围 | 表B.1、B.2 | 8. UN R155附件5威胁映射/Mapping to UN R 155 Annex 5 Threats.pdf | 论文中的表格仅展示代表性示例；本数据集包含完整、未删减的原始数据集。 5. 数据集使用方法 5.1 复现自动驾驶系统案例研究 本配套数据集为本次案例研究（对应论文第4章节）的完整输出成果。由于TARA方法论属于分析型方法而非计算型实验，**本数据集本身即为研究成果**。审稿人可通过以下方式验证论文结论： - 打开任意配套数据集文档，确认论文中的表格为完整数据的忠实子集。 - 对任意检查清单条目（例如CL-25）进行全流程追溯，验证端到端可追溯性： CL-25（检查清单） → 安全需求（6. 安全需求推导/） → 攻击路径（5. 攻击路径分析/） → 威胁场景（3. 威胁场景/） + 攻击库（2. 攻击库/） → 数据流图中的资产（1. 数据流图/） 5.2 复用至自动驾驶系统威胁建模 针对自动驾驶系统（无论基于NVIDIA Jetson平台还是同类架构）开展TARA研究的从业者与研究者，可直接复用或扩展以下配套数据集： - **攻击库（2. 攻击库）**：本攻击库基于与自动驾驶系统相关的CVE、CWE、学术论文、行业标准及技术报告构建。对于配备相似组件（摄像头、激光雷达、雷达、多模态大语言模型、传感器融合系统）的自动驾驶系统，可直接复用该攻击库；也可针对特定目标系统进行筛选或扩展。 - **威胁场景（3. 威胁场景）**：基于STRIDE、MITRE ATLAS及OWASP框架的威胁场景已按资产类型推导完成。对于采用相同感知-规划-控制架构的自动驾驶系统，这些场景可作为基线直接采用或适配调整。 - **检查清单（7. 检查清单推导）**：38项安全检查清单已通过UN R155附件5验证，可直接用作自动驾驶系统网络安全评估或车辆型式认证（Vehicle Type Approval，简称VTA）准备的合规检查清单。 5.3 适配至其他物理人工智能系统 对于自动驾驶系统以外的物理人工智能系统（例如自主无人机、手术机器人、智能制造系统），本配套数据集可作为应用扩展后TARA方法论的参考模板： 1. 使用多级数据流图定义系统架构（详见1. 数据流图/的格式与分解方法）。 2. 构建或扩展攻击库：可复用2. 攻击库/中的CVE/CWE/学术论文结构，针对共享组件（例如GPU、操作系统、传感器）进行适配，并补充领域专属条目。 3. 并行应用三大框架开展威胁识别： - STRIDE：针对软件/网络威胁 - MITRE ATLAS：针对人工智能/机器学习专属威胁 - OWASP Top 10：针对大语言模型（如适用） 4. 遵循TARA流程框架（目录4~7）作为流程模板，为目标系统推导损害场景、攻击路径、安全需求及检查清单。 6. 授权协议 本数据集采用[知识共享署名4.0国际许可协议（Creative Commons Attribution 4.0 International License，简称CC BY 4.0）](https://creativecommons.org/licenses/by/4.0/)发布。 您可自由共享、改编本材料用于任意用途，只需提供适当署名。若您在研究工作中使用本配套数据集，请引用如下文献： bibtex @inproceedings{woo2026tara, title = {A Study on Extending the TARA Methodology for Physical AI: A Case Study of ADS}, author = {Woo, Jihun and Lee, Junhyeong}, booktitle = {Proceedings of the USENIX Workshop on Vehicle Security (VehicleSec)}, year = {2026} }