, Common Criteria for Information Technology Security Evaluation, Part 1: Introduction and general model, Version 3.1, Revision 1 (CCMB-2006-09-001), 2006.

P. Abrahamsson, Speeding up embedded software development. ITEA Innovation report, 2007.

A. Grau, The internet of things needs firewalls too

A. Alebrahim and M. Heisel, Applying performance patterns for requirements analysis, Proceedings of the 20th European Conference on Pattern Languages of Programs, EuroPLoP '15, vol.35, pp.1-35, 2015.

Y. Ali, S. El-kassas, and M. Mahmoud, A rigorous methodology for security architecture modeling and verification, Proceedings of the 42nd Hawaii International Conference on System Sciences, 2009.

D. Altavilla, When the IOT fails: Nest recalls over 400k smoke detectors

M. Althoff, O. Stursberg, and M. Buss, Model-based probabilistic collision detection in autonomous driving, IEEE Transactions on Intelligent Transportation Systems, vol.10, issue.2, pp.299-310, 2009.

M. Althoff, O. Stursberg, and M. Buss, Safety assessment of autonomous cars using verification techniques, American Control Conference, 2007. ACC'07, pp.4154-4159, 2007.

R. Alur, C. Courcoubetis, and D. Dill, Model-checking for real-time systems, Proceedings. Fifth Annual IEEE Symposium on Logic in Computer Science, pp.414-425, 1990.

A. Medini, , 2017.

A. Apvrille, Slides at framadrive.org/index.php/s/Wk6nxAKMpVTdQl4, Geek usages for your Fitbit Flex tracker Hack.lu, 2015.

L. Apvrille, L. Li, and Y. Roudier, Model-driven engineering for designing safe and secure embedded systems, Architecture-Centric Virtual Integration (ACVI), pp.4-7, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01974731

L. Apvrille and Y. Roudier, SysML-Sec: A Model Driven Approach for Designing Safe and Secure Systems, 3rd International Conference on Model-Driven Engineering and Software Development, Special session on Security and Privacy in Model Based Engineering, 2015.

L. Apvrille, If I secure my car, 2014.

L. Apvrille and . Webpage, , 2015.

L. Apvrille and L. W. Li, 9-Safe and Secure Support for Public Safety Networks, Wireless Public Safety Networks, vol.3, pp.185-210, 2017.

L. Apvrille and Y. Roudier, SysML-Sec Attack Graphs: Compact Representations for Complex Attacks, Graphical Models for Security, pp.35-49, 2016.
URL : https://hal.archives-ouvertes.fr/hal-02287141

A. Armoush, F. Salewski, and S. Kowalewski, Effective pattern representation for safety critical embedded systems, Computer Science and Software Engineering, vol.4, pp.91-97, 2008.

D. Arora, S. Ravi, A. Raghunathan, and N. K. Jha, Secure embedded processing through hardwareassisted run-time monitoring, Design, Automation and Test in Europe, vol.1, pp.178-183, 2005.
URL : https://hal.archives-ouvertes.fr/hal-00181513

W. Ashford, Developers lack skills needed for secure devops

C. Atkinson and T. Kühne, Profiles in a strict metamodeling framework, Science of Computer Programming, vol.44, issue.1, pp.5-22, 2002.

M. Backes, T. Holz, B. Kollenda, P. Koppe, S. Nürnberger et al., You can run but you can't read: Preventing disclosure exploits in executable code, Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp.1342-1353, 2014.

M. Backes, C. Hritcu, and M. Maffei, Automated verification of remote electronic voting protocols in the applied pi-calculus, Computer Security Foundations Symposium, 2008. CSF'08. IEEE 21st, pp.195-209, 2008.

F. Balarin, Y. Watanabe, H. Hsieh, L. Lavagno, C. Passerone et al., Metropolis: An Integrated Electronic System Design Environment, Computer, vol.36, issue.4, pp.45-52, 2003.

M. Barr and A. Massa, Programming embedded systems: with C and GNU development tools, 2006.

K. Beck and W. Cunningham, Using pattern languages for object-oriented programs, 1987.

N. Becker, Safety of the intended functionality for ADAS

G. Behrmann, A. David, and K. Larsen, A tutorial on uppaal, Formal methods for the design of real-time systems, pp.200-236, 2004.

J. Bengtsson and W. Yi, Timed automata: Semantics, algorithms and tools, Lecture Notes on Concurrency and Petri Nets, vol.3098, pp.87-124, 2004.

, Estimating password-cracking times

J. Birch, Safety argument framework for vehicle autonomy

N. Bißmeyer, J. Njeukam, J. Petit, and . Bayarou, Central misbehavior evaluation for VANETS based on mobility data plausibility, Proceedings of the ninth ACM international workshop on Vehicular inter-networking, systems, and applications, pp.73-82, 2012.

B. Blakeley, Introduction to Security Design Patterns. Open Group, 2004.

B. Blanchet, Automatic verification of correspondences for security protocols, Journal of Computer Security, vol.17, issue.4, pp.363-434, 2009.

B. Blanchet, Proverif automatic cryptographic protocol verifier user manual, CNRS, Département d'Informatique École Normale Supérieure, 2010.
DOI : 10.1109/csfw.2001.930138
URL : http://www.mpi-sb.mpg.de/~blanchet/publications/./BlanchetCSFW01.ps.gz

M. Blaze, W. Diffie, R. L. Rivest, B. Schneier, and T. Shimomura, Minimal key lengths for symmetric ciphers to provide adequate commercial security. a report by an ad hoc group of cryptographers and computer scientists, 1996.
DOI : 10.21236/ada385264
URL : http://www.dtic.mil/dtic/tr/fulltext/u2/a385264.pdf

H. Blom, D. Chen, H. Kaijser, H. Lönn, Y. Papadopoulos et al., EAST-ADL: An Architecture Description Language for Automotive Software-intensive Systems in the Light of Recent use and Research, International Journal of System Dynamics Applications (IJSDA), vol.5, issue.3, pp.1-20, 2016.
URL : https://hal.archives-ouvertes.fr/cea-01810034

W. Barry and . Boehm, A spiral model of software development and enhancement, Computer, vol.21, issue.5, pp.61-72, 1988.

M. Boisson, E. Arbaretier, and A. Bracquemond, Architecture sûre du véhicule autonome sans chauffeur, Congrès Lambda Mu 20, 2016.
DOI : 10.4267/2042/61690
URL : http://documents.irevues.inist.fr/bitstream/2042/61690/1/lm20_com_2A_2_181_Boisson.pdf

C. Bolton, S. Rampazzi, C. Li, A. Kwong, W. Xu et al., Blue Note: How intentional acoustic interference damages availability and integrity in hard disk drives and operating systems, Proceedings of the 39th Annual IEEE Symposium on Security and Privacy, 2018.
DOI : 10.1109/sp.2018.00050

J. Peter-bowen, Formal specification and documentation using Z: A case study approach, vol.66, 1996.

L. Brisolara, L. Becker, L. Carro, F. Wagner, C. E. Pereira et al., Comparing high-level modeling approaches for embedded system design, Proceedings of the 2005 Asia and South Pacific Design Automation Conference, pp.986-989, 2005.
DOI : 10.1109/aspdac.2005.1466505

, Report on the Accident to Boeing 737-400 G-OBME Near Kegworth, 1989.

R. Brooks, The big problem with self-driving cars is people

R. Brooks, Symantec anomaly detection for automotive

R. R. Brooks, J. Sander, J. Deng, and . Taiber, Automobile security concerns, IEEE Vehicular Technology Magazine, vol.4, issue.2, 2009.

. Frederick-p-brooks, The Mythical Man-Month: Essays on Software Engineering, Anniversary Edition, 2/E. Pearson Education India, 1995.

J. Brunel and D. Chemouil, Safety and security assessment of behavioral properties using alloy, Computer Safety, Reliability, and Security, pp.251-263, 2015.
URL : https://hal.archives-ouvertes.fr/hal-01206638

J. Brunel, D. Chemouil, L. Rioux, M. Bakkali, and F. Vallée, A viewpoint-based approach for formal safety & security assessment of system architectures, 11th Workshop on Model-Driven Engineering, vol.1235, pp.39-48, 2014.
URL : https://hal.archives-ouvertes.fr/hal-01070960

S. Burton, J. Likkei, P. Vembar, and M. Wolf, Automotive functional safety = safety + security, Proceedings of the First International Conference on Security of Internet of Things, SecurIT '12, pp.150-159, 2012.

G. Calandriello, P. Papadimitratos, J. Hubaux, and A. Lioy, Efficient and Robust Pseudonymous Authentication in VANET, Proceedings of the Fourth ACM International Workshop on Vehicular Ad Hoc Networks, VANET '07, pp.19-28, 2007.

C. R. Nave, Stopping Distance for Auto

N. Carlini and D. Wagner, ROP is Still Dangerous: Breaking Modern Defenses, USENIX Security Symposium, pp.385-399, 2014.

M. Cebe, E. Erdin, K. Akkaya, H. Aksu, and S. Uluagac, An integrated lightweight blockchain framework for forensics applications of connected vehicles, vol.4, 2018.

I. Cervesato, The Dolev-Yao intruder is the most powerful attacker, 16th Annual Symposium on Logic in Computer Science-LICS, vol.1, 2001.

J. Chang, C. Liu, and J. Gaudiot, Hardware acceleration for cryptography algorithms by hotspot detection, International Conference on Grid and Pervasive Computing, pp.472-481, 2013.

B. Chen and R. Morris, Certifying program execution with secure processors, HotOS, pp.133-138, 2003.

D. Chen, R. Johansson, H. Lönn, H. Blom, M. Walker et al., Integrated safety and architecture modeling for automotive embedded systems. e & i Elektrotechnik und Informationstechnik, vol.128, pp.196-202, 2011.

S. Christiaens, J. Ogrzewalla, and S. Pischinger, Functional safety for hybrid and electric vehicles, 2012.

D. Clark, S. Hunt, and P. Malacaria, Quantitative analysis of the leakage of confidential data, Electronic Notes in Theoretical Computer Science, vol.59, issue.3, pp.238-251, 2002.

E. Clarke, O. Grumberg, S. Jha, Y. Lu, and H. Veith, Progress on the state explosion problem in model checking, Informatics, pp.176-194, 2001.

L. Pat and . Clemens, Fault tree analysis, JE Jacobs Severdurup, 2002.

S. Cogliani, -. Diana, D. Maimu¸tmaimu¸t, R. Naccache, R. Portella-do-canto et al., OMD: a compression function mode of operation for authenticated encryption, International Workshop on Selected Areas in Cryptography, pp.112-128, 2014.
URL : https://hal.archives-ouvertes.fr/hal-01098397

M. Colnari?, D. Verber, and W. A. Halang, Real-time characteristics and safety of embedded systems. Distributed Embedded Control Systems: Improving Dependability with Coherent Design, pp.3-28, 2008.

H. Comon and V. Shmatikov, Is it possible to decide whether a cryptographic protocol is secure or not?, Journal of Telecommunications and Information Technology, pp.5-15, 2002.

J. Condliffe, The reason we won't have autonomous cars any time soon

L. Constantin, Researchers hack Tesla Model S with remote attack

M. Conti, S. Crane, L. Davi, M. Franz, P. Larsen et al., Losing control: On the effectiveness of control-flow integrity under stack attacks, Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security, CCS '15, pp.952-963, 2015.

V. Costan and S. Devadas, Intel SGX Explained. IACR Cryptology ePrint Archive, p.86, 2016.

P. Cotret, G. Gogniat, and M. Flórez, Protection of heterogeneous architectures on FPGAs: An approach based on hardware firewalls. Microprocessors and Microsystems, vol.42, pp.127-141, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01450746

C. Cowan, S. Beattie, R. F. Day, C. Pu, P. Wagle et al., Protecting systems from stack smashing attacks with stackguard, Linux Expo, 1999.

A. Scott, D. S. Crosby, and . Wallach, Denial of service via algorithmic complexity attacks, USENIX Security Symposium, pp.29-44, 2003.

. Crypto++, , 2017.

. Crypto++, Advanced encryption standard, 2018.

P. Cuenot, P. Frey, R. Johansson, H. Lönn, Y. Papadopoulos et al., 11 The EAST-ADL Architecture Description Language for Automotive Embedded Software, pp.297-307, 2010.

, Most companies suffer reputation damage after security incidents, 2018.

T. Davenport and J. Lucker, Running on data: Activity trackers and the internet of things, 2015.

J. Dawkins and J. Hale, A systematic approach to multi-stage network attack analysis, Information Assurance Workshop, pp.48-56, 2004.

R. Debouk, B. Czerny, J. .-d'ambrosio, and J. J. Joyce, Safety strategy for autonomous systems, International Systems Safety Conference. System Safety Society, vol.3, 2011.

L. Delligatti, SysML distilled: A brief guide to the systems modeling language, 2013.

S. Denning, Agile: The world's most popular innovation engine

H. Mamadou, J. Diallo, S. E. Romero-mariona, T. A. Sim, D. J. Alspaugh et al., A comparative evaluation of three approaches to specifying security requirements, 12th Working Conference on Requirements Engineering: Foundation for Software Quality, 2006.

. Steven-x-ding, Model-based fault diagnosis techniques: design schemes, algorithms, and tools, 2008.

, Defense System Software Development, 1983.

D. Dolev and A. C. Yao, On the security of public key protocols, IEEE trans. on Information Theory, vol.29, pp.198-208, 1983.

D. Dominic, S. Chhawri, R. M. Eustice, D. Ma, and A. Weimerskirch, Risk assessment for cooperative automated driving, Proceedings of the 2Nd ACM Workshop on CyberPhysical Systems Security and Privacy, CPS-SPC '16, pp.47-58, 2016.

D. Bruce-powel, Real-time design patterns: robust scalable architecture for real-time systems, vol.1, 2003.

T. Dunlap, The 5 worst examples of IoT hacking and vulnerabilities in recorded history, 2017.

M. Eby, J. Werner, G. Karsai, and A. Ledeczi, Integrating security modeling into embedded system design, 14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems (ECBS'07), pp.221-228, 2007.

, The long, winding road for driverless cars, Economist, 2017.

S. Edwards, L. Lavagno, E. A. Lee, and A. Sangiovanni-vincentelli, Design of embedded systems: formal models, validation, and synthesis, Proceedings of the IEEE, vol.85, issue.3, pp.366-390, 1997.

F. Eisele, Introducing Hardware Security Modules to Embedded Systems

M. Ekstedt, P. Johnson, R. Lagerström, D. Gorton, J. Nydrén et al., Securi CAD by Foreseeti: A CAD Tool for Enterprise Cyber Security Management, 2015 IEEE 19th International Enterprise Distributed Object Computing Workshop, pp.152-155, 2015.

A. Enrici, L. Li, L. Apvrille, and D. Blouin, A Tutorial on

, TTool/DIPLODOCUS: an Open-source Toolkit for the Design of Data-flow Embedded Systems, 2018.

C. Erbas, S. Cerav-erbas, and A. D. Pimentel, Multiobjective optimization and evolutionary algorithms for the application mapping problem in multiprocessor system-on-chip design, IEEE Transactions on Evolutionary Computation, vol.10, issue.3, pp.358-374, 2006.

. Ericsson, Ericsson mobility report: On the pulse of the netwroked society

I. Evans, F. Long, U. Otgonbaatar, H. Shrobe, and M. Rinard, Control jujutsu: On the weaknesses of fine-grained control flow integrity, Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security, CCS '15, pp.901-913, 2015.

S. Evans and J. Wallner, Risk-based security engineering through the eyes of the adversary, Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop, pp.158-165, 2005.

, Issues in Real-time System Design, 2017.

E. and E. Vehicle,

J. Daniel, K. Fagnant, and . Kockelman, Preparing a nation for autonomous vehicles: opportunities, barriers and policy recommendations, Transportation Research Part A: Policy and Practice, vol.77, pp.167-181, 2015.

T. Farkas, E. Meiseki, C. Neumann, K. Okano, A. Hinnerichs et al., Integration of UML with Simulink into embedded software engineering, ICCAS-SICE, pp.474-479, 2009.

M. Fazouane, H. Kopp, W. Rens, D. L. Van-der-heijden, F. Métayer et al., Formal verification of privacy properties in electric vehicle charging, International Symposium on Engineering Secure Software and Systems, pp.17-33, 2015.

H. Peter, B. A. Feiler, S. Lewis, E. Vestal, and . Colbert, An overview of the SAE architecture analysis & design language (AADL) standard: A basis for model-based architecturedriven embedded systems engineering, IFIP, vol.176, pp.3-15, 2004.

C. David, P. R. Feldmeier, and . Karn, Unix password security-ten years later, Advances in Cryptology-CRYPTO' 89 Proceedings, pp.44-63, 1990.

. Ana-m-fernández-sáez, M. Michel-rv-chaudron, and . Genero, Exploring Costs and Benefits of Using UML on Maintenance: Preliminary Findings of a Case Study in a Large IT Department, EESSMOD@ MoDELS, pp.33-42, 2013.

A. Fiessler, S. Hager, B. Scheuermann, and A. Moore, HyPaFilter-A versatile hybrid FPGA packet filter, Architectures for Networking and Communications Systems

, ACM/IEEE Symposium on, pp.25-36, 2016.

J. Fossen, How long to crack a password spreadsheet, 2009.

D. Ian, A. Foster, K. Prudhomme, S. Koscher, and . Savage, Fast and vulnerable: A story of telematic failures, WOOT, 2015.

M. Fowler, UML distilled: a brief guide to the standard object modeling language, 2004.

B. Friedrich, The effect of autonomous vehicles on traffic, Autonomous Driving, pp.317-334, 2016.

L. Fuentes, -. , and A. Vallecillo-moreno, An introduction to UML profiles, UML and Model Engineering, vol.2, 2004.

S. Daniel-d-gajski, A. Abdi, G. Gerstlauer, and . Schirner, Embedded system design: modeling, synthesis and verification, 2009.

O. Wilbert and . Galitz, The essential guide to user interface design: an introduction to GUI design principles and techniques, 2007.

A. Gamatié, L. Sébastien, É. Beux, R. Piel, A. Ben-atitallah et al., A model-driven design framework for massively parallel embedded systems, ACM Trans. Embedded Comput. Syst, vol.10, issue.4, p.39, 2011.

B. Gassend, G. E. Suh, D. Clarke, M. Van-dijk, and S. Devadas, Caches and hash trees for efficient memory integrity verification, The Ninth International Symposium on High-Performance Computer Architecture, 2003. HPCA-9 2003. Proceedings, pp.295-306, 2003.

M. Ge, J. B. Hong, W. Guttmann, and D. Kim, A framework for automating security analysis of the internet of things, Journal of Network and Computer Applications, vol.83, pp.12-27, 2017.

D. Genius, L. W. Li, and L. Apvrille, Model-Driven Performance Evaluation and Formal Verification for Multi-level Embedded System Design, Conference on Model-Driven Engineering and Software Development (Modelsward'2017), 2017.
URL : https://hal.archives-ouvertes.fr/hal-01447148

D. Genius, W. Letitia, L. Li, T. Apvrille, and . Tanzi, Multi-level latency evaluation with an mde approach, 6th International Conference on Model-Driven Rngineering and Software Development (MODELSWARD 2018), 2018.
URL : https://hal.archives-ouvertes.fr/hal-01670546

P. George, Have new technologies made cars less safe?, 2010.

J. M. Germain, Can software kill you?, 2004.

D. Gershgorn, Instead of hacking self-driving cars, researchers are trying to hack the world they see, 2017.

R. L. Glass, Real-time: The "Lost World" of software debugging and testing, Commun. ACM, vol.23, issue.5, pp.264-271, 1980.

F. S. Gonçalves, D. Pereira, E. Tovar, and L. B. Becker, Formal Verification of AADL Models Using UPPAAL, 2017 VII Brazilian Symposium on Computing Systems Engineering (SBESC), pp.117-124, 2017.

B. Gras, K. Razavi, E. Bosman, H. Bos, and C. Giuffrida, ASLR on the Line: Practical Cache Attacks on the MMU. NDSS, p.2017, 2017.

F. Grazioli, E. Kusmenko, and A. Roth, Bernhard Rumpe, and Michael von Wenckstern. Simulation framework for executing component and connector models of self-driving vehicles, 20th International Conference on Model Driven Engineering Languages and Systems MODELS 2017, pp.109-115, 2017.

A. Greenberg, Car hack technique uses dealerships to spread malware

A. Greenberg, A deep flaw in your car lets hackers shut down safety features

B. Greene, Agile methods applied to embedded firmware development, Agile Development Conference, pp.71-77, 2004.

H. Grönninger, H. Krahn, B. Rumpe, M. Schindler, and S. Völkel, , 2014.

S. Gueron, S. Johnson, and J. Walker, Sha-512/256, Information Technology: New Generations (ITNG), pp.354-358, 2011.

D. Gvozdanovi´cgvozdanovi´c, S. De?i´cde?i´c, and D. Huljeni´chuljeni´c, UML Supported Software Design, International Conference on Software, Telecommunications and Computer Networks SoftCOM, 2001.

A. Habermaier, J. Leupolz, and W. Reif, Unified simulation, visualization, and formal analysis of safety-critical systems with s, Critical Systems: Formal Methods and Automated Verification, pp.150-167, 2016.

K. Hall-geisler, Even your connected car will need antivirus software

B. Hamid, J. Geisel, A. Ziani, J. Bruel, and J. Perez, Model-driven engineering for trusted embedded systems based on security and dependability patterns, International SDL Forum, pp.72-90, 2013.
URL : https://hal.archives-ouvertes.fr/hal-01240715

M. Hasan, S. Mohan, R. Pellizzoni, . Rakesh, and . Bobba, A design-space exploration for allocating security tasks in multicore real-time systems, 2017.

B. Haskins, J. Stecklein, B. Dick, G. Moroney, R. Lovell et al., 8.4.2 Error Cost Escalation Through the Project Life Cycle, INCOSE International Symposium, vol.14, pp.1723-1737, 2004.

D. Hatebur, M. Heisel, and H. Schmidt, Security engineering using problem frames, Emerging Trends in Information and Communication Security, pp.238-253, 2006.

K. Havelund, M. Lowry, S. Park, C. Pecheur, J. Penix et al., Formal analysis of the remote agent before and after flight, Proceedings of the 5th NASA Langley Formal Methods Workshop, vol.134, 2000.

J. Heffley and P. Meunier, Can source code auditing software identify common vulnerabilities and be used to evaluate software security?, 37th Annual Hawaii International Conference on System Sciences, vol.10, 2004.

J. Henkel and R. Ernst, The interplay of run-time estimation and granularity in hw/sw partitioning, Proceedings of the 4th International Workshop on Hardware/Software Co-Design, CODES '96, p.52, 1996.

O. Henniger, A. Ruddle, H. Seudié, B. Weyl, M. Wolf et al., Securing Vehicular On-Board IT Systems: The EVITA Project, VDI/VW Automotive Security Conference, 2009.

T. A. Henzinger and J. Sifakis, The discipline of embedded systems design, Computer, vol.40, issue.10, pp.32-40, 2007.

A. Thomas and . Henzinger, Two challenges in embedded systems design: predictability and robustness, Philosophical Transactions of the Royal Society of London A: Mathematical, Physical and Engineering Sciences, vol.366, pp.3727-3736, 1881.

A. Thomas, J. Henzinger, and . Sifakis, The embedded systems design challenge, International Symposium on Formal Methods, pp.1-15, 2006.

N. Hillary, Measuring performance for real-time systems, Freescale Semiconductor, 2005.

H. Holm, K. Shahzad, M. Buschle, and M. Ekstedt, P 2 cysemol: Predictive, probabilistic cyber security modeling language, IEEE Transactions on Dependable and Secure Computing, vol.12, issue.6, pp.626-639, 2015.

B. Jin, D. Hong, and . Kim, Assessing the effectiveness of moving target defenses using security models, IEEE Transactions on Dependable and Secure Computing, vol.13, issue.2, pp.163-177, 2016.

T. E. Humphreys, B. M. Ledvina, M. L. Psiaki, B. W. O'hanlon, and P. M. Kintner, Assessing the spoofing threat: Development of a portable gps civilian spoofer, Proceedings of the ION GNSS international technical meeting of the satellite division, vol.55, p.56, 2008.

T. Hunt, Controlling vehicle features of Nissan LEAFs across the globe via vulnerable APIs, 2016.

D. David, P. Hwang, K. Schaumont, I. Tiri, and . Verbauwhede, Securing embedded systems, IEEE Security & Privacy, vol.4, issue.2, pp.40-49, 2006.

, Icon Labs. Floodgate IoT security toolkit, 2018.

I. , Hospira Lifecare PCA Infusion System Vulnerabilities, Advisory (icsa-15-125-01b, 2015.

I. Technologies and A. G. , Aurix security hardware, 2018.

. Terrance-r-ingoldsby, Understanding risks through attack tree analysis, Computer Security Journal, vol.20, issue.2, pp.33-59, 2004.

I. Mines-telecom, No autonomous cars without cybersecurity

, Best practices for embedded software testing of safety compliant systems, 2016.

P. Isaias and T. Issa, Information System Development Life Cycle Models, pp.21-40, 2015.

R. Miller-ishtiaq-rouf, H. Mustafa, S. Taylor, W. Xu, M. Gruteser et al., Security and privacy vulnerabilities of in-car wireless networks: A tire pressure monitoring system case study, 19th USENIX Security Symposium, pp.11-13, 2010.

, Road vehicles-Functional safety, 2011.

J. A. Cook, Automatic code generation, 2008.

C. Jaber, High-level SOC Modeling and Performance Estimation: Application To A Multi-core Implementation Of LTE EnodeB Physical Layer, 2011.
URL : https://hal.archives-ouvertes.fr/pastel-00673731

C. Jaber, A. Kanstein, L. Apvrille, A. Baghdadi, P. L. Moenner et al., High-Level System Modeling for Rapid HW/SW Architecture Exploration, Proc. of the 20th IEEE/IFIP International Symposium on Rapid System Prototyping (RSP'2009), 2009.
URL : https://hal.archives-ouvertes.fr/hal-02124754

M. Jackson, Problem frames-analyzing and structuring software development problems, vol.390, 2001.

Y. Jang, S. Lee, and T. Kim, Breaking Kernel Address Space Layout Randomization with Intel TSX, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS '16, pp.380-392, 2016.

K. Jiang, P. Eles, and Z. Peng, Co-design techniques for distributed real-time embedded systems with communication security constraints, 2012 Design, Automation Test in Europe Conference Exhibition (DATE), pp.947-952, 2012.

A. Joshi and . Mats, Model-based safety analysis of Simulink models using SCADE design verifier, International Conference on Computer Safety, Reliability, and Security, pp.122-135, 2005.

J. Jürjens, UMLsec: Extending UML for Secure Systems Development, Proceedings of the 5th International Conference on The Unified Modeling Language, UML '02, pp.412-425, 2002.

G. Kahn, The semantics of a simple language for parallel programming, Information Processing '74: Proceedings of the IFIP Congress, pp.471-475, 1974.

T. Kangas, P. Kukkala, H. Orsila, E. Salminen, M. Hännikäinen et al., UML-based Multiprocessor SoC Design Framework, ACM Trans. Embed. Comput. Syst, vol.5, issue.2, pp.281-320, 2006.

F. Kargl and N. Bissmeyer, PRESERVE Project, 2015.

D. Kawamoto, IoT security incidents rampant and costly

M. Kelly, With the rise of autonomous vehicles, hackers pose a serious new threat, 2017.

S. Kelly, Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec, 2007.

K. Keutzer, A. R. Newton, J. M. Rabaey, and A. Sangiovanni-vincentelli, System-level design: orthogonalization of concerns and platform-based design, IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol.19, issue.12, pp.1523-1543, 2000.

A. Kharpal, After Samsung's Note 7, here's 10 of the biggest tech recalls ever

B. Kienhuis, E. F. Deprettere, P. Van-der-wolf, and K. A. Vissers, A Methodology to Design Programmable Embedded Systems: The Y-Chart Approach, Embedded Processor Design Challenges, pp.18-37, 2002.

. Trevor-a-kletz, HAZOP and HAZAN: identifying and assessing process industry hazards, 1999.

J. Kloos, T. Hussain, and R. Eschbach, Risk-based testing of safety-critical embedded systems driven by fault tree analysis, 2011 IEEE Fourth International Conference on Software Testing, Verification and Validation Workshops, pp.26-33, 2011.

W. Knight, Tesla Crash Will Shape the Future of Automated Cars

D. Knorreck, UML-based Design Space Exploration, Fast Simulation and Static Analysis, 2011.
URL : https://hal.archives-ouvertes.fr/pastel-00662744

D. Knorreck, L. Apvrille, and R. Pacalet, Fast simulation techniques for design space exploration, Objects, Components, Models and Patterns, vol.33, pp.308-327, 2009.

. Woo-hyun, B. Ko, P. R. Satchidanandan, and . Kumar, Theory and implementation of dynamic watermarking for cybersecurity of advanced transportation systems, 2016 IEEE Conference on Communications and Network Security (CNS), pp.416-420, 2016.

P. Kocher, R. Lee, G. Mcgraw, and A. Raghunathan, Security as a new dimension in embedded system design, Proceedings of the 41st Annual Design Automation Conference, DAC '04, pp.753-760, 2004.

S. Konrad, B. H. Cheng, and L. A. Campbell, Object analysis patterns for embedded systems, IEEE Transactions on Software Engineering, vol.30, issue.12, pp.970-992, 2004.

P. Koopman, Secrecy vs. integrity and why encryption might be the wrong choice

B. Kordy, P. Kordy, S. Mauw, and P. Schweitzer, ADTool: Security Analysis with Attack-Defense Trees, Quantitative Evaluation of Systems, vol.8054, pp.173-176, 2013.

K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno et al., Experimental security analysis of a modern automobile, Proceedings of the 2010 IEEE Symposium on Security and Privacy, SP '10, pp.447-462, 2010.

M. Krotofil, J. Larsen, and D. Gollmann, The process matters: Ensuring data veracity in cyber-physical systems, Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, ASIA CCS '15, pp.133-144, 2015.

J. H. Lala and R. E. Harper, Architectural principles for safety-critical real-time applications. Proceedings of the IEEE, vol.82, pp.25-40, 1994.

G. Lasnier, B. Zalila, L. Pautet, and J. Hugues, Ocarina: An environment for AADL models analysis and automatic code generation for high integrity applications, International Conference on Reliable Software Technologies, pp.237-250, 2009.

. Edward-a-lee, Cyber physical systems: Design challenges, Object oriented real-time distributed computing (isorc), pp.363-369, 2008.

T. Leinmüller, L. Buttyan, J. Hubaux, F. Kargl, and R. Kroh, Panagiotis Papadimitratos, Maxim Raya, and Elmar Schoch. Sevecom-secure vehicle communication, IST Mobile and Wireless Communication Summit, 2006.

L. Lemaire, J. Lapon, B. D. Decker, and V. Naessens, A SysML extension for security analysis of industrial control systems, 2nd International Symposium for ICS & SCADA Cyber Security Research, pp.1-9, 2014.

K. Arjen, E. R. Lenstra, and . Verheul, Selecting cryptographic key sizes, Journal of cryptology, vol.14, issue.4, pp.255-293, 2001.

N. G. Leveson, Software Safety in Embedded Computer Systems, Commun. ACM, vol.34, issue.2, pp.34-46, 1991.

G. Nancy, C. Leveson, and . Turner, An investigation of the Therac-25 accidents, Computer, vol.26, issue.7, pp.18-41, 1993.

D. Levin, Here are some of worst car scandals in history, 2015.

L. W. Li, L. Apvrille, and A. Bracquemond, Design and Verification of Secure Autonomous Vehicles, Intelligent Transportation Systems 2017), 2017.

L. W. Li, F. Lugou, and L. Apvrille, Security-Aware Modeling and Analysis for HW/SW Partitioning, Conference on Model-Driven Engineering and Software Development (Modelsward'2017), 2017.

L. W. Li, F. Lugou, and L. Apvrille, Security modeling for embedded system design, International Workshop on Graphical Models for Security, pp.99-106, 2017.

L. W. Li, F. Lugou, and L. Apvrille, Evolving attacker perspectives for secure embedded system design, 6th International Conference on Model-Driven Rngineering and Software Development (MODELSWARD 2018), 2018.

D. Lie, C. Thekkath, M. Mitchell, P. Lincoln, D. Boneh et al., Architectural support for copy and tamper resistant software, ACM SIGPLAN Notices, vol.35, issue.11, pp.168-177, 2000.

C. Lin, B. Zheng, Q. Zhu, and A. Sangiovanni-vincentelli, Security-Aware Design Methodology and Optimization for Automotive Systems, ACM Transactions on Design Automation of Electronic Systems (TODAES), vol.21, p.18, 2015.

T. Lodderstedt, D. A. Basin, and J. Doser, SecureUML: A UML-Based Modeling Language for Model-Driven Security, Proceedings of the 5th International Conference on The Unified Modeling Language, UML'02, pp.426-441, 2002.

G. Lu, D. Zeng, and B. Tang, Anti-jamming filtering for drfm repeat jammer based on stretch processing, 2010 2nd International Conference on Signal Processing Systems, vol.1, pp.1-78, 2010.

F. Lugou, Environments for Analyzing the Security of Smart Objects, 2018.

F. Lugou, L. W. Li, L. Apvrille, and R. Ameur-boulifa, SysML Models and Model Transformation for Security, Conference on Model-Driven Engineering and Software Development (Modelsward'2016), 2016.

G. Macher, A. Höller, H. Sporer, E. Armengaud, and C. Kreiner, A combined safety-hazards and security-threat analysis method for automotive systems, Computer Safety, Reliability, and Security, pp.237-250, 2015.

B. B. Madan, K. Go?eva-popstojanova, K. Vaidyanathan, and K. S. Trivedi, A method for modeling and quantifying the security attributes of intrusion tolerant systems, Dependable Systems and Networks-Performance and Dependability Symposium (DSN-PDS, vol.56, pp.167-186, 2002.

S. Malik, M. Martonosi, and Y. Li, Static timing analysis of embedded software, Proceedings of the 34th Annual Design Automation Conference, DAC '97, pp.147-152, 1997.

S. Maoz, F. Mehlan, J. Oliver-ringert, and B. Rumpe, and Michael von Wenckstern. OCL framework to verify extra-functional properties in component and connector models, 20th International Conference on Model Driven Engineering Languages and Systems MODELS 2017, pp.24-30, 2017.

E. Marin, D. Singelée, D. Flavio, T. Garcia, R. Chothia et al., On the (in) security of the latest generation implantable cardiac defibrillators and how to secure them, Proceedings of the 32nd Annual Conference on Computer Security Applications, pp.226-236, 2016.

R. Marinescu, H. Kaijser, M. Miku?ionis, C. Seceleanu, H. Lönn et al., Analyzing industrial architectural models by simulation and model-checking, International Workshop on Formal Techniques for Safety-Critical Systems, pp.189-205

. Springer, , 2014.

J. Markoff, A guide to challenges facing self-driving car technologists

P. Marwedel, Embedded and cyber-physical systems in a nutshell, DAC. COM Knowledge Center Article, vol.20, issue.10, 2010.

P. Marwedel and G. Goossens, Code generation for embedded processors, vol.317, 2013.

D. Maynor, SCADA Security and Terrorism: We're Not Crying Wolf! In Invited presentation at BlackHat BH, 2006.

T. Mens and P. Van-gorp, A taxonomy of model transformation, Electronic Notes in Theoretical Computer Science, vol.152, pp.125-142, 2006.

. Microsoft, The STRIDE Threat Model, 2005.

. Microsoft, What is the Security Development Lifecycle, 2018.

C. Miller and C. Valasek, Remote exploitation of an unaltered passenger vehicle, 2015.

P. Modesti, Anbx: Automatic generation and verification of security protocols implementations, International Symposium on Foundations and Practice of Security, pp.156-173, 2015.

N. Moebius, K. Stenzel, H. Grandy, and W. Reif, SecureMDD: A Model-Driven Development Method for Secure Smart Card Applications, 2009 International Conference on Availability, Reliability and Security, pp.841-846, 2009.

S. Mohanty, K. Viktor, S. Prasanna, J. Neema, and . Davis, Rapid design space exploration of heterogeneous embedded systems using symbolic search and multi-granular simulation, ACM SIGPLAN Notices, vol.37, issue.7, pp.18-27, 2002.

T. G. Moreira, M. A. Wehrmeister, C. E. Pereira, J. F. Pétin, and E. Levrat, Automatic code generation for embedded systems: From UML specifications to VHDL code, 8th IEEE International Conference on Industrial Informatics, pp.1085-1090, 2010.

M. Moser, The PRESERVE V2X Security Subsystem, 2015.

D. Muoio, 6 scenarios self-driving cars still can't handle

M. Musuvathi, Y. W. David, A. Park, D. R. Chou, D. L. Engler et al., Cmc: A pragmatic approach to model checking real code, SIGOPS Oper. Syst. Rev, vol.36, issue.SI, pp.75-88, 2002.

A. Naumenko and A. Wegmann, A metamodel for the Unified Modeling Language: critical analysis and solution, 2002.

, NBC. Hyundai Recalls 41K SUVs Over Software Glitch

L. Newman, The Botnet That Broke the Internet Isn't Going Away

S. Nie, L. Liu, and Y. Du, Free-Fall: Hacking Tesla from Wireless to CAN Bus, 2017.

. , Choosing the right modeling tool, 2018.

T. Noergaard, Embedded systems architecture: a comprehensive guide for engineers and programmers, 2012.

B. Nuseibeh, Weaving together requirements and architectures, Computer, vol.34, issue.3, pp.115-119, 2001.

B. Nuseibeh and S. Easterbrook, Requirements engineering: a roadmap, Proceedings of the Conference on the Future of Software Engineering, pp.35-46, 2000.

P. Nuzzo, J. B. Finn, A. Iannopollo, and A. L. Sangiovanni-vincentelli, Contract-based design of control protocols for safety-critical cyber-physical systems, 2014 Design, Automation Test in Europe Conference Exhibition (DATE), pp.1-4, 2014.

R. Oates, F. Thom, and G. Herries, Security-aware, model-based systems engineering with sysml, Proceedings of the 1st International Symposium on ICS & SCADA Cyber Security Research, pp.78-87, 2013.

M. Obst, L. Hobert, and P. Reisdorf, Multi-sensor data fusion for checking plausibility of V2V communications by vision-based multiple-object tracking, Vehicular Networking Conference (VNC), pp.143-150, 2014.

, Object Management Group OMG. SysML, 2011.

S. Jonathan and . Ostroff, Formal methods for the specification and design of real-time safety critical systems, Journal of Systems and Software, vol.18, issue.1, pp.33-60, 1992.

, Open Vehicular Secure Platform, 2010.

M. Pajic, J. Weimer, N. Bezzo, O. Sokolsky, J. George et al., Design and implementation of attack-resilient cyberphysical systems: With a focus on attack-resilient state estimators, IEEE Control Systems, vol.37, issue.2, pp.66-81, 2017.

A. Palanca, E. Evenchick, F. Maggi, and S. Zanero, A stealth, selective, linklayer denial-of-service attack against automotive networks, Detection of Intrusions and Malware, and Vulnerability Assessment, pp.185-206, 2017.

P. Papadimitratos, L. Buttyan, T. Holczer, E. Schoch, J. Freudiger et al., Secure vehicular communication systems: design and architecture, IEEE Communications Magazine, vol.46, issue.11, 2008.

P. Papadimitratos, L. Buttyan, J. Hubaux, F. Kargl, A. Kung et al., Architecture for secure and private vehicular communications, Telecommunications, 2007. ITST'07. 7th International Conference on ITS, pp.1-6, 2007.

C. S. and W. Visser, Verification of Java Programs Using Symbolic Execution and Invariant Generation, Model Checking Software, pp.164-181, 2004.

P. Ohmart, How Much Data Can You Encrypt With RSA Keys?, 2011.

G. Pedroza, L. Apvrille, and D. Knorreck, AVATAR: A SysML Environment for the Formal Verification of Safety and Security Properties, 11th Annual International Conference on New Technologies of Distributed Systems, pp.1-10, 2011.

D. Mert, K. Pesé, H. Schmidt, and . Zweck, Hardware/Software Co-Design of an Automotive Embedded Firewall, 2017.

J. Petit and S. E. Shladover, Potential cyberattacks on automated vehicles, IEEE Transactions on Intelligent Transportation Systems, vol.16, issue.2, pp.546-556, 2015.

J. Petit, B. Stottelaar, M. Feiri, and F. Kargl, Remote attacks on automated vehicles sensors: Experiments on camera and lidar, vol.11, 2015.

L. Piètre, -. , and M. Bouissou, Modeling safety and security interdependencies with BDMP (Boolean logic Driven Markov Processes), Systems Man and Cybernetics (SMC), 2010 IEEE International Conference on, pp.2852-2861, 2010.

A. D. Pimentel, C. Erbas, and S. Polstra, A systematic approach to exploring embedded system architectures at multiple abstraction levels, IEEE Transactions on Computers, vol.55, issue.2, pp.99-112, 2006.

A. D. Pimentel, L. O. Hertzberger, P. Lieverse, P. Van-der-wolf, and E. F. Deprettere, Exploring embedded-systems architectures with Artemis, IEEE Computer, vol.34, issue.11, pp.57-63, 2001.

. Polarsys, ARCADIA/CAPELLA (webpage), 2008.

P. Institute and L. , The impact of data breaches on reputation & share value

S. Prajna and A. Jadbabaie, Safety verification of hybrid systems using barrier certificates, Hybrid Systems: Computation and Control, pp.477-492, 2004.

N. Priggouris, A. Silva, M. Shawky, M. Persson, V. Ibanez et al., The system design life cycle, CESAR-Cost-efficient Methods and Processes for Safety-relevant Embedded Systems, pp.15-67, 2013.

, Can A Connected Refrigerator Anchor The IoT Household?, 2017.

C. Raspotnig, P. Karpati, and A. L. Opdahl, Combined Assessment of Software Safety and Security Requirements: An Industrial Evaluation of the CHASSIS Method, Journal of Cases on Information Technology (JCIT), vol.20, issue.1, pp.46-69, 2018.

C. Raspotnig, V. Katta, P. Karpati, and A. L. Opdahl, Enhancing CHASSIS: a method for combining safety and security, Availability, Reliability and Security, p.2013

, Eighth International Conference on, pp.766-773, 2013.

D. R. Raymond and S. F. Midkiff, Denial-of-service in wireless sensor networks: Attacks and defenses, IEEE Pervasive Computing, vol.7, issue.1, pp.74-81, 2008.

L. Ricci and L. Mcginness, Embedded system security. white paper, 2004.

N. Rodday, Hacking a Professional Drone. Slides at www.blackhat.com/docs/asia16/materials/asia-16-Rodday-Hacking-A-Professional-Drone.pdf, 2016.

J. Ronkainen and P. Abrahamsson, Software development under stringent hardware constraints: Do agile methods have a chance, International Conference on Extreme Programming and Agile Processes in Software Engineering, pp.73-79, 2003.

P. Rook, Controlling software projects, Software Engineering Journal, vol.1, issue.1, pp.7-16, 1986.

R. Rosales, M. Glass, J. Teich, B. Wang, Y. Xu et al., MAESTRO-Holistic Actor-Oriented Modeling of Nonfunctional Properties and Firmware Behavior for MPSoCs, ACM Trans. Des. Autom. Electron. Syst, vol.19, issue.3, p.26, 2014.

B. Ross, C. Galli, S. Zimmermann, C. Park, and P. Madden, BMW recalls 1 million vehicles for fire risk, 2017.

. Winston-w-royce, Managing the development of large software systems: concepts and techniques, Proceedings of the 9th international conference on Software Engineering, pp.328-338, 1987.

A. Ruddle, D. Ward, B. Weyl, S. Idrees, Y. Roudier et al., Security requirements for automotive on-board networks based on dark-side scenarios, 2009.

J. Fran-ruiz, R. Harjani, A. Mana, V. Desnitsky, I. Kotenko et al., A methodology for the analysis and modeling of security threats and attacks for systems of embedded components, Parallel, Distributed and Network-Based Processing (PDP), pp.261-268, 2012.

S. Sadvandi, N. Chapon, and L. Piètre-cambacédès, Safety and Security Interdependencies in Complex Systems and SoS: Challenges and Perspectives, Complex Systems Design & Management, pp.229-241, 2012.

. Safety, The top 40 best wearable tech products for kids and families

A. Sangiovanni-vincentelli and G. Martin, Platform-based design and software design methodology for embedded systems, IEEE Design Test of Computers, vol.18, issue.6, pp.23-33, 2001.

T. Saxena and G. Karsai, MDE-Based Approach for Generalizing Design Space Exploration, pp.46-60, 2010.

E. Schlaepfer, Comparison of internal and external watchdog timers

C. Schleiffer, M. Wolf, A. Weimerskirch, and L. Wolleschensky, Secure key management-a key feature for modern vehicle electronics, 2013.

B. Schlich and S. Kowalewski, Model checking c source code for embedded systems, International Journal on Software Tools for Technology Transfer, vol.11, issue.3, pp.187-202, 2009.

C. Douglas and . Schmidt, Model-driven engineering, COMPUTER-IEEE COMPUTER SOCIETY, vol.39, issue.2, p.25, 2006.

H. Schmidt, Pattern-based confidentiality-preserving refinement, International Symposium on Engineering Secure Software and Systems, pp.43-59, 2009.

C. Schmittner, T. Gruber, P. Puschner, and E. Schoitsch, Security Application of Failure Mode and Effect Analysis (FMEA), Computer Safety, Reliability, and Security, pp.310-325, 2014.

, Bruce Schneier. Attack trees. Dr. Dobb's journal, vol.24, issue.12, pp.21-29, 1999.

E. Schoitsch, Design for safety and security of complex embedded systems: A unified approach, Proceedings of the NATO Advanced Research Workshop on Cyberspace Security and Defense: Research Issues, pp.161-174, 2005.

H. Schweppe, Y. Roudier, B. Weyl, L. Apvrille, and D. Scheuermann, Car2X Communication: Securing the Last Meter-A Cost-Effective Approach for Ensuring Trust in Car2X Applications Using In-Vehicle Symmetric Cryptography, 2011 IEEE Vehicular Technology Conference (VTC Fall), pp.1-5, 2011.

H. Schweppe, Security and privacy in automotive on-board networks, 2012.
URL : https://hal.archives-ouvertes.fr/tel-01157229

B. Selic, The pragmatics of model-driven development, IEEE Software, vol.20, issue.5, pp.19-25, 2003.

S. Sendall and W. Kozaczynski, Model transformation: the heart and soul of model-driven software development, IEEE Software, vol.20, issue.5, pp.42-45, 2003.

H. Seudié, J. Shokrollahi, B. Weyl, A. Keil, M. Wolf et al., Secure on-board architecture specification, 2010.

H. Seudié, Vehicular on-board security: Evita project, 2009.

H. Shin, D. Kim, Y. Kwon, and Y. Kim, Illusion and dazzle: Adversarial optical channel exploits against lidars for automotive applications, Cryptographic Hardware and Embedded Systems-CHES 2017, pp.445-467, 2017.

T. Simonite, Self-driving cars' spinning-laser problem

G. Sindre and A. L. Opdahl, Eliciting security requirements with misuse cases, Requirements Engineering, vol.10, issue.1, pp.34-44, 2005.

. Soclib, The SoCLib project: An integrated system-on-chip modelling and simulation platform, 2003.

J. Sparapani, Driverless cars not a 'solved problem,' says MIT professor

M. Steiner and P. Liggesmeyer, Combination of safety and security analysis-finding security problems that threaten the safety of a system, SAFECOMP 2013-Workshop DECS (ERCIM/EWICS Workshop on Dependable Embedded and Cyber-physical Systems) of the 32nd International Conference on Computer Safety, Reliability and Security, 2013.
URL : https://hal.archives-ouvertes.fr/hal-00848604

J. Stewart, Tesla's Autopilot Was Involved in Another Deadly Car Crash

L. Swartz, Overwhelmed by technology: How did user interface failures on board the USS Vincennes lead to 290 dead, Eri¸simEri¸sim tarihi, vol.25, 2001.

. Synopsys, Architecture Risk Analysis, 2018.

. Synopsys, Scalable SoC Verification, 2018.

. Synopsys, Security Control Design Analysis (SCDA), 2018.

. Synopsys and . Ssdlc, What is the secure software development life cycle?, vol.101, 2018.

. Synopsys-editorial-team, Infographic: A lack of software security training puts companies at risk, 2018.

T. Szemethy and G. Karsai, Platform modeling and model transformations for analysis, Journal of Universal Computer Science, vol.10, issue.10, pp.1383-1407, 2004.

A. Taylor, N. Japkowicz, and S. Leblanc, Frequency-based anomaly detection for the automotive can bus, 2015 World Congress on Industrial Control Systems Security (WCICSS), pp.45-49, 2015.

A. Taylor, S. P. Leblanc, and N. Japkowicz, Probing the limits of anomaly detectors for automobiles with a cyber attack framework, IEEE Intelligent Systems, issue.99, pp.1-1, 2018.

P. Tessier, S. Gerard, C. Mraidha, F. Terrier, and J. M. Geib, A component-based methodology for embedded system prototyping, 14th IEEE International Workshop on Rapid Systems Prototyping, 2003. Proceedings, pp.9-15, 2003.

L. Thiele and . Ernesto, Performance analysis of distributed embedded systems, In International Conference on Embedded Computer Systems: Architectures, Modeling, and Simulation (ICSAMOS. Citeseer, 2011.

V. L. Thing and J. Wu, Autonomous vehicle security: A taxonomy of attacks and defences, 2016 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), pp.164-170, 2016.

E. Donald, J. K. Thomas, H. Adams, and . Schmit, A model and methodology for hardwaresoftware codesign, IEEE Design & test of computers, vol.10, issue.3, pp.6-15, 1993.

C. Thompson, As healthcare costs rise and patients demand better care, 2016.

S. Tlili, X. Yang, R. Hadjidj, and M. Debbabi, Verification of CERT Secure Coding Rules: Case Studies, On the Move to Meaningful Internet Systems: OTM 2009, pp.913-930, 2009.

M. J. Juha-pekka-tolvanen, D. Luoma, and . Chen, Reaping the benefits of architectural modeling in embedded design, 2014.

A. Troina, A. Aldini, and R. Gorrieri, A probabilistic formulation of imperfect cryptography, Proc. of 1st Int. Workshop on Issues in Security and Petri Nets, vol.3, 2003.

, Trusted Computing Group. Trusted Platform Module (TPM) Summary, 2008.

K. Tsipenyuk, B. Chess, and G. Mcgraw, Seven pernicious kingdoms: A taxonomy of software security errors, IEEE Security & Privacy, vol.3, issue.6, pp.81-84, 2005.

D. I. Urbina, J. A. Giraldo, A. A. Cardenas, N. O. Tippenhauer, J. Valente et al., Limiting the impact of stealthy attacks on industrial control systems, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS '16, pp.1092-1105, 2016.

E. B. Anton-v-uzunov, K. Fernandez, and . Falkner, ASE: a Comprehensive PatternDriven Security Methodology for Distributed Systems, Computer Standards & Interfaces, vol.41, pp.112-137, 2015.

L. Vaas, Uber car software detected woman before fatal crash but failed to stop, 2018.

M. Vai, D. J. Whelihan, B. R. Nahill, D. M. Utin, S. R. O'melia et al., Secure embedded systems, 2016.

A. Van-lamsweerde, Elaborating Security Requirements by Construction of Intentional AntiModels, Proc. of the 26th International Conference on Software Engineering , ICSE '04, pp.148-157, 2004.

A. Van-lamsweerde, S. Brohez, R. D. Landtsheer, and D. Janssens, From system goals to intruder anti-goals: attack generation and resolution for security requirements engineering, Proc. of RHAS, vol.3, pp.49-56, 2003.

D. Varró, Automated formal verification of visual modeling languages by model checking. Software & Systems Modeling, vol.3, pp.85-113, 2004.

D. Varró, G. Varró, and A. Pataricza, Designing the automatic transformation of visual languages, Science of Computer Programming, vol.44, issue.2, pp.205-227, 2002.

M. Vasilevskaya and S. Nadjm-tehrani, Quantifying Risks to Data Assets Using Formal Metrics in Embedded System Design, pp.347-361, 2015.

F. F. William-e-vesely, . Goldberg, H. Norman, D. Roberts, and . Haasl, Fault tree handbook, 1981.

J. Vidal, G. Florent-de-lamotte, P. Gogniat, J. Soulard, and . Diguet, A co-design approach for embedded system modeling and code generation with UML and MARTE, Design, Automation and Test in Europe, pp.226-231, 2009.
URL : https://hal.archives-ouvertes.fr/hal-00369036

W. Visser, K. Havelund, G. Brat, S. Park, and F. Lerda, Model checking programs, Automated Software Engineering, vol.10, issue.2, pp.203-232, 2003.

B. Vlasic and N. Bunkley, Toyota will fix or replace 4 million gas pedals

M. Voelter, D. Ratiu, B. Kolb, and B. Schaetz, mbeddr: instantiating a language workbench in the embedded software domain, Automated Software Engineering, vol.20, issue.3, pp.339-390, 2013.

J. Wallen, Five nightmarish attacks that show the risks of IoT security

C. Wang, Z. Zhao, L. Gong, L. Zhu, Z. Liu et al., A Distributed Anomaly Detection System for In-Vehicle Network using HTM, IEEE Access, issue.99, pp.1-1, 2018.

E. Weise, Chinese group hacks a Tesla for the second year in a row

M. W. Whalen, A. Gacek, D. Cofer, A. Murugesan, M. P. Heimdahl et al., Your "what" is my "how": Iteration and hierarchy in system design, IEEE Software, vol.30, issue.2, pp.54-60, 2013.

E. Michael, H. Whitman, and . Mattord, Principles of information security, 2011.

A. Wijs and L. Engelen, Refiner: Towards formal verification of model transformations, NASA Formal Methods, pp.258-263, 2014.

J. Williams, A. Zolotas, N. Matragkas, . Louis-m-rose, S. Dimitios et al., What do metamodels really look like? 1078, vol.01, p.2013

M. Wolf and T. Gendrullis, Design, implementation, and evaluation of a vehicular hardware security module, International Conference on Information Security and Cryptology, pp.302-318, 2011.

S. Woo, H. J. Jo, and D. Lee, A practical wireless attack on the connected car and security protocol for in-vehicle CAN, IEEE Transactions on Intelligent Transportation Systems, vol.16, issue.2, pp.993-1006, 2015.

C. Yan, W. Xu, and J. Liu, Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle, DEF CON, p.24, 2016.

W. Young and N. G. Leveson, An Integrated Approach to Safety and Security Based on Systems Theory, Commun. ACM, vol.57, issue.2, pp.31-35, 2014.

T. Zhang, H. Antunes, and S. Aggarwal, Defending connected vehicles against malware: Challenges and a solution framework, IEEE Internet of Things Journal, vol.1, issue.1, pp.10-21, 2014.

Y. Zhou and D. Feng, Side-channel attacks: Ten years after its publication and the impacts on cryptographic module security testing, IACR Cryptology ePrint Archive, p.388, 2005.

R. Zunino and P. Degano, A note on the perfect encryption assumption in a process calculus, Foundations of Software Science and Computation Structures, pp.514-528, 2004.

W. Zuo, L. Pouchet, A. Ayupov, T. Kim, C. Lin et al., Accurate High-level Modeling and Automated Hardware/Software Co-design for Effective SoC Design Space Exploration, Proc. 54th Annual Design Automation Conference 2017, DAC '17, vol.78, pp.1-78, 2017.