Real-World Evaluation of Protocol-Compliant Denial-of-Service Attacks on C-V2X-based Forward Collision Warning Systems

2025-08-04

AI Summary

This work exposes the real-world threat of protocol-compliant denial-of-service (DoS) attacks against C-V2X forward collision warning (FCW) systems. We identify and exploit two vulnerabilities—UDP flooding at the transport layer and oversized Basic Safety Message (BSM) payloads at the application layer—and design, for the first time, standards-conformant attacks adhering to both 3GPP and SAE J2735 specifications. These attacks inject high-frequency, large-volume yet syntactically and semantically valid message streams over PC5 direct communication. Experimental evaluation in a realistic vehicular environment demonstrates that the attacks reduce end-to-end packet delivery ratio by 87% and induce latency exceeding 400 ms, causing severe FCW alert delays or complete failure—effectively degrading system functionality to near-collapse. This study provides the first empirical validation of the fragility of the “compliance implies security” assumption in C-V2X, delivering critical evidence to inform the evolution of C-V2X security standards and the design of robust defense mechanisms.

Technology Category

• Application Domains: Mobility, Driving & Flight
• Computer Vision: Adversarial Attacks & Robustness
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Cellular Vehicle-to-Everything (C-V2X) technology enables low-latency, reliable communications essential for safety applications such as a Forward Collision Warning (FCW) system. C-V2X deployments operate under strict protocol compliance with the 3rd Generation Partnership Project (3GPP) and the Society of Automotive Engineers Standard (SAE) J2735 specifications to ensure interoperability. This paper presents a real-world testbed evaluation of protocol-compliant Denial-of-Service (DoS) attacks using User Datagram Protocol (UDP) flooding and oversized Basic Safety Message (BSM) attacks that 7 exploit transport- and application-layer vulnerabilities in C-V2X. The attacks presented in this study transmit valid messages over standard PC5 sidelinks, fully adhering to 3GPP and SAE J2735 specifications, but at abnormally high rates and with oversized payloads that overload the receiver resources without breaching any protocol rules such as IEEE 1609. Using a real-world connected vehicle 11 testbed with commercially available On-Board Units (OBUs), we demonstrate that high-rate UDP flooding and oversized payload of BSM flooding can severely degrade FCW performance. Results show that UDP flooding alone reduces packet delivery ratio by up to 87% and increases latency to over 400ms, while oversized BSM floods overload receiver processing resources, delaying or completely suppressing FCW alerts. When UDP and BSM attacks are executed simultaneously, they cause near-total communication failure, preventing FCW warnings entirely. These findings reveal that protocol-compliant communications do not necessarily guarantee safe or reliable operation of C-V2X-based safety applications.

Problem

• Evaluating protocol-compliant DoS attacks on C-V2X FCW systems
• Assessing impact of UDP and oversized BSM flooding attacks
• Testing real-world vulnerabilities in 3GPP/SAE-compliant C-V2X communications

Innovation

• UDP flooding exploits transport-layer vulnerabilities
• Oversized BSM attacks target application-layer weaknesses
• Protocol-compliant DoS attacks degrade FCW performance