Abstract:

With the rapid development of connected vehicle technology, the complexity of in-vehicle systems has surged, and the hazards posed by security vulnerabilities (such as remote control, privacy breaches, and driving safety threats) have become increasingly severe. The verification and remediation of software vulnerabilities in connected vehicle have become a hot and challenging topic in security research both domestically and internationally. The validation and remediation of software security vulnerabilities heavily rely on proof-of-concept (PoC) exploit codes, but manual construction is inefficient and constrained by the unstructured deficiencies in vulnerability reports. Therefore, this article proposed an automated PoC exploit code generation and verification method based on large language models (LLMs). The innovation lied in combining large language models (LLMs) with static and dynamic analysis techniques for exploit generation, producing candidate PoC exploit codes and validating and refining them, enabling end-to-end automation from vulnerability descriptions to verifiable PoCs. This method can enhance the efficiency of vulnerability mining research in connected vehicle, reduce labor costs, provide targeted test cases for in-vehicle system security testing, and meet the urgent demand for automated attack-defense exercises in connected vehicle scenarios.

Key words: vehicle network security, proof of concept, vulnerability analysis, automatic exploit, large language model