Research Projects
Explore our portfolio of automotive cybersecurity research initiatives, from active projects to future plans.
ASRG V4 Platform
Next-generation web platform for the Automotive Security Research Group. Built with Next.js 15, Payload CMS 3, and PostgreSQL, it serves as the central hub for ASRG's community, research, intelligence, and event management. Features include a public marketing site, authenticated member portal, CMS-driven content management, OpenCTI threat intelligence integration, event management with WordPress migration, company directory, knowledge base, and security advisory publishing.
Asset Database
AssetDB is ASRG's automotive asset database: it discovers, imports, and organizes automotive assets — vehicle → ECU → hardware/software BOMs — with full provenance, confidence scoring, and dedup on every record.
AutoVulnDB
AutoVulnDB is an automated vulnerability database for automotive cybersecurity. It aggregates, categorizes, and tracks security vulnerabilities specific to automotive systems including ECUs, infotainment, telematics, V2X, and connected vehicle platforms. Features include automated CVE ingestion, automotive-specific categorization, API access for integration with CSMS tools, and community-contributed vulnerability reports.
Automotive Security Intelligence Project
ASRG's integrated threat intelligence platform aggregates automotive-specific threat data from OEM security teams, independent researchers, CVE databases, and dark-web monitoring. Powered by OpenCTI, it provides real-time visibility into threats targeting connected and autonomous vehicles. Features include threat actor tracking, vulnerability correlation, MITRE ATT&CK mapping for automotive, and automated indicator of compromise (IoC) sharing across ASRG member organizations.
Automotive Threat Catalog
Comprehensive catalog of known threats, attack vectors, and vulnerabilities specific to automotive systems. Organized by vehicle subsystem (powertrain, chassis, body, ADAS, infotainment, connectivity) and mapped to UNECE WP.29 threat categories. Used by OEMs and suppliers for threat analysis and risk assessment (TARA) as required by ISO/SAE 21434 and UNECE R155. Includes attack trees, threat scenarios, and mitigation strategies.
CSMS Tool Evaluation Framework
Community-driven evaluation framework for automotive Cybersecurity Management System (CSMS) tools, anchored in ISO/SAE 21434. Provides a structured methodology for comparing and assessing tools used in automotive cybersecurity management, helping organizations select the right solutions for their CSMS implementation. Features include standardized evaluation criteria, scoring methodology, vendor comparison matrices, and community-contributed reviews. The framework covers key CSMS domains: threat analysis, risk assessment, vulnerability management, and incident response tooling.
openXSAM
Open eXchange Security Assessment Model (openXSAM) - a framework and data model to exchange risk-related information between entities inside and outside of organizations in the automotive industry in a clear, well-defined, unambiguous and machine-readable format. openXSAM enables standardized sharing of security assessment data including threat scenarios, risk ratings, vulnerability findings, and mitigation strategies across the automotive supply chain.