Distributed Honeypots as a Proactive Cyber Threat Detection Mechanism in Connected Vehicles: Analysis of the 2024-2025 Threat Landscape and Proposed Security Framework

The automotive industry faces an unprecedented cybersecurity crisis. In 2024, 409 security incidents affecting the automotive and smart mobility ecosystem were documented, representing a 39% increase compared to 2023. Massive-scale incidents, those impacting millions of vehicles, tripled from 5% to 19% of the total. The ransomware attack on CDK Global in June 2024 paralyzed 15,000 dealerships for three weeks, generating estimated losses of $1.02 billion. Automotive-related Common Vulnerabilities and Exposures (CVEs) grew from 24 in 2019 to 422 in 2024, reaching a cumulative total of 1,147 CVEs. This paper presents a comprehensive analysis of the current threat landscape based on verifiable data from primary sources, including Upstream Security's 2025 report, industry reports, and documented cases. The implementation of distributed honeypots as a proactive detection mechanism is proposed, founded on recent academic research demonstrating their technical viability in emerging vehicular architectures. The analysis reveals that 60% of incidents in 2024 were data and privacy-related, 35% involved vehicular system manipulation, and 92% of attacks were executed remotely. The UNECE R155 regulation, mandatory since July 2024 for all new vehicles in the EU, Japan, and South Korea, requires cyberattack detection and monitoring systems, creating a regulatory framework that justifies the adoption of advanced detection technologies such as vehicular honeypots. This work presents a conceptual framework and research findings.Specific implementations, algorithms and operational details are intentionally omitted and remain proprietary.