Autonomous Cyber Defense in Connected Vehicles: A Multi-Agent Approach to V2X Security
2026-08-19 • Cryptography and Security
Cryptography and SecurityDistributed, Parallel, and Cluster ComputingMultiagent SystemsNetworking and Internet Architecture
AI summaryⓘ
The authors address the problem of very fast decisions (within 100 milliseconds) that connected cars must make to tell if safety messages are real or fake. They propose a three-level system: a quick onboard check that decides whether to accept, ignore, or escalate messages; a roadside unit that looks at data from multiple cars to better judge threats; and a cloud system that improves detection models over time. This setup respects strict timing limits based on industry standards and aims to balance safety and security carefully. They also note future challenges like tougher attacks and regulatory issues.
Connected vehicleBasic Safety MessageV2X communicationIntrusion detection systemByzantine fault toleranceFederated learningEdge computingSAE J2735ETSI EN 302 637-2Safety-security conflict
Authors
Krishna Teja Medam
Abstract
A connected vehicle has roughly 100 milliseconds to decide whether an incoming Basic Safety Message is real or fabricated. If a false emergency braking alert reaches the planning pipeline in time, the car brakes - a safety failure triggered by a security failure. Existing intrusion detection systems are not designed to handle that coupling. They operate per vehicle, per message, with static rules - blind to attack patterns that only emerge across a fleet or over time, and blind to the fundamental tension between dropping a suspicious message and dropping a real emergency alert. We propose a three-tier multi-agent architecture that treats this timing constraint as a hard design requirement, not a performance target. At the vehicle level, an onboard agent classifies each incoming V2X message into one of four actions - Accept, Drop, Quarantine, or Escalate - within a 10-millisecond budget, deliberately biased toward Escalate when uncertain, passing ambiguous cases to the roadside edge agent rather than risking a dropped legitimate alert. The edge agent operates across a roadside unit zone with a 50-millisecond budget, fusing threat assessments from multiple vehicles and resolving safety-security conflicts using complementary sensor observations. The cloud tier refines detection models through Byzantine fault-tolerant federated learning and redistributes updated weights to the fleet. Every timing constraint derives directly from the 100-millisecond Basic Safety Message cycles mandated by SAE J2735 and ETSI EN 302 637-2. No existing framework simultaneously assigns standards-grounded latency budgets to all three deployment tiers while treating safety-security conflict resolution as a first-class design constraint. Remaining open problems - adversarial poisoning at the edge and the absence of regulatory frameworks for autonomous security response - are discussed as future work.