Jun 2026· 2026 IEEE 2nd International Conference on Electronics, Energy Systems and Power Engineering (EESPE)· pp. 232-238· 0 citations· 15 references
Abstract
With the increasing complexity of the "cloud–pipe–end" architecture in intelligent connected vehicles (ICVs), the coexistence of multiple communication protocols such as automotive Ethernet, CAN bus, and V2X communication, coupled with the successive release of regulations and standards including UN R155, ISO/SAE 21434, and GB44495, the traditional manual approach to writing cybersecurity test cases faces severe challenges in terms of efficiency, coverage, and compliance. Large language models (LLMs), with their powerful semantic understanding and content generation capabilities, offer a new technical pathway for the automated generation of test cases. However, general-purpose LLMs lack domain-specific knowledge of automotive cybersecurity, and their direct application encounters challenges such as knowledge deficiency, insufficient scenario adaptation, and untrustworthy generated content. This paper proposes a methodological framework for automatic test case generation in ICV cybersecurity testing, named AutoCarSec. Centered on domain knowledge injection, the framework adopts a three-layer progressive architecture consisting of a knowledge enhancement layer, a scenario modeling and generation layer, and a multi-agent collaborative execution layer, systematically addressing the three core issues of knowledge acquisition, scenario modeling, and quality assurance for LLMs in the automotive cybersecurity testing domain. This paper elaborates on the detailed design of four key stages: structured construction of automotive cybersecurity domain knowledge, automatic test scenario modeling based on attack trees and TARA, LLM-driven hierarchical test case generation, and multi-agent collaborative verification with iterative optimization. It provides a logically sound and highly operable methodological reference for the intelligent transformation of cybersecurity testing for intelligent connected vehicles.
This work presents an end-to-end, deployment-aware testing pipeline for IoT-based automotive applications that combines requirement-driven test and code generation with large language model (LLM) and vision-language model (VLM) assistance, and human-in-the-loop curation to reduce manual effort and improve consistency.
Denesa Zyberaj, Roman Vintonyak, Pascal Hirmer et al.· 0 citations
The rapid evolution of Software-Defined Vehicles (SDVs) and autonomous driving technologies has significantly increased in-vehicle communication complexity and cybersecurity vulnerabilities. While traditional static Role-Based Access Control (RBAC) is incapable of reflecting dynamic driving contexts, independent Attribute-Based Access Control (ABAC) introduces unsustainable computational overhead within AutoSAR environments. To address international regulations such as UNECE WP. 29 R155/156, ISO/SAE 21434, and ISO 24089, this paper proposes a threestage hybrid access control architecture. This framework integrates Flexible Attribute-based RBAC (FA-RBAC) and an AI-based Intrusion Detection System (AI-IDPS) into the Identity and Access Management (IAM) of the AutoSAR Adaptive Platform. Simulations verifying core SDV scenarios—including driving mode transitions, Over-The-Air (OTA) updates, V2X, and diagnostics—were conducted using a SOME/IP bridge between ROS2 and Adaptive AUTOSAR. The proposed model satisfied real-time constraints with a maximum latency of 7.2ms. Quantitative results further demonstrate a 98.5% detection rate for contextual zero-day attacks and a 60% reduction in the number of written policy rules (WPN).
Young Jin Kim, Kyungmo Sung, Y. Park· International Conference on...· 0 citations
: Industrial systems are increasingly exposed to cyber threats, requiring stronger design methodologies to ensure resilience and security. In critical infrastructures, compliance with standards such as IEC 62443 is essential for ensuring security throughout the system lifecycle. This paper investigates a secure-by-design engineering process focusing on the initial architectural design and examines the role that AI-powered agents can play in supporting it, as well as the conditions required for their effective and reliable use. This study experiments with an open-source agentic framework to generate zone-and-conduit architectures from an initial system blueprint. A multi-agent workflow is implemented, including agents responsible for architecture generation, compliance verification against IEC 62443 requirements, and security stress testing using attack tree analysis. A drinking water utility case study, subject to NIS regulatory constraints, is used to compare AI-assisted and manually produced architectures. The results highlight both the benefits and limitations of AI-assisted design, leading to the identification of recommendations and open issues for further research, with potential applicability beyond the industrial domain.
C. Ponsard, Jean-François Daune· Proceedings of the 23rd Inte...· 0 citations
The convergence of Information Technology (IT) and Operational Technology (OT) in Industry 4.0 has intensified the need for timely, trustworthy, and explainable cyber threat intelligence (CTI) for Industrial Control Systems (ICS). However, existing AI-enabled and Large Language Model (LLM)-based CTI solutions are predominantly designed for conventional IT environments and do not adequately address the safety, latency, governance, and operational constraints of industrial settings. This paper presents an AI-assisted CTI framework tailored to ICS and Industry 4.0 environments, integrating multi-source data ingestion, a Retrieval-Augmented Generation (RAG) knowledge store, a modular chain-of-agents architecture, and an explicit human-in-the-loop verification gate. Following a Design Science Research approach, the framework was evaluated through expert assessment involving twelve cybersecurity practitioners with experience in industrial and Security Operations Centre (SOC) environments and complemented by a proof-of-concept artefact instantiation based on the APT41 DUST campaign. The prototype integrated five heterogeneous CTI evidence sources and executed the automated analytical workflow in approximately 25 s (25.29 s) while illustrating evidence-grounded retrieval, specialized agent orchestration, and human-supervised intelligence generation. Practitioner feedback indicated that AI-assisted contextual intelligence and agent-based reasoning were perceived as valuable, while successful adoption depends primarily on governance, explainability, trust, and alignment with existing operational workflows rather than algorithmic sophistication alone. The study contributes a design-science artefact that combines retrieval-augmented intelligence, modular AI agents, and human oversight, providing practical design guidance for trustworthy AI-assisted CTI deployment in safety-critical Industry 4.0 environments.
The evolution of automotive technologies brought into play the large amount of hardware and software devices, with their subsequent software frameworks and programming languages, as well as the adoption of Cloud environments for data storage, management and analysis. In this general context, specialists are faced with information overload and users have become more and more confused about the measures that should be taken in order to optimize the vehicle use, maintenance and repair. AI technologies could greatly help both users and specialists in their vehicular interactions. On the one hand, AI could give very good answers as long as the information on which the responses are based is correct and complete. On the other hand, the questions should be well formulated, clear and specific in order to maximize the accuracy and correctness of the answers. This paper aims at building an algorithm of combining ISO 15765-4 and SAE J1979 compliant professional scan tools technologies with Microsoft Copilot for evolving the automotive diagnosis process. The resulting algorithm consists of a set of procedures and steps that should be followed, for building an intelligent agent. This agent incorporates a knowledge base that includes maintenance and repair manuals, diagnosis tests results and previous experience. In this way, the vehicle maintenance and repair activities should gain a higher level of efficiency.
Cosmin Tomozei, I. Furdu, Bogdan Pătruț· INTERNATIONAL JOURNAL OF COM...· 0 citations
The widespread adoption of Internet of Things (IoT) and Operational Technology (OT) sys- tems in industrial environments has significantly in- creased cybersecurity exposure. Human error re- mains a leading cause of successful cyberattacks; how- ever, conventional Cybersecurity Awareness Training (CSAT) programs are typically static and poorly aligned with user roles, asset criticality, and evolving threats. This paper proposes an IoT-focused risk- adaptive CSAT framework that integrates MITRE ATT&CK-based threat modeling, CIA-aware impact analysis, machine learning-driven risk assessment, and Generative Artificial Intelligence (GenAI) for person- alized training delivery. The framework models cyber- security awareness as a continuous closed-loop process that constructs user-specific attack graphs, evaluates vulnerabilities through adaptive assessments, and com- putes local and global risk scores. Machine learning dynamically derives risk thresholds to guide training prioritization, while GenAI generates targeted training content aligned with real-world attack scenarios. Evaluation using representative industrial user profiles demonstrates consistent reductions in vulnerability and global risk levels following personalized training. The results indicate that the proposed framework has the potential to enhance human-centric security and im- prove the effectiveness of cybersecurity awareness pro- grams in industrial IoT environments.
Ahmed Mohamed Ahmed, Mohamed Mejri· 2026 6th International Confe...· 0 citations