Connected and Autonomous Vehicles (CAVs) depend on interconnected software and hardware components such as sensors, Electronic Control Units, in-vehicle infotainment systems, and telematics units, where vulnerabilities can compromise assets, users, and vehicle operations. While these vulnerabilities are commonly documented in the Common Vulnerabilities and Exposures (CVE) database as plain text, security practitioners require structured information about affected assets, types of weaknesses, and attack behaviors to effectively mitigate risks.
To address this, we evaluate open-weight Large Language Models (LLMs) for generating Structured Threat Information Expression (STIX), a recognized format for representing threat information related to CAV-related CVEs. We constructed a dataset named CAV-STIXGen that maps CAV vulnerability descriptions to STIX domain objects (SDO), STIX relationship objects (SRO), Common Weakness Enumeration (CWE), and MITRE ATT&CK techniques mappings.
Using this dataset, we evaluated 11 open-weight LLMs (ranging from 4B to 120B parameters) across various prompting strategies and temperatures. Single-model configurations achieved F1 scores of 0.94 for SDO, 0.63 for SRO, and 0.99 for CWE mapping, while complete MITRE ATT&CK mapping remains challenging. In a multi-agent setup, Gemma-4-31B and Codestral-22B achieved F1 scores of 0.91 for SDOs and 0.43 for SROs, respectively.
Finally, we analyze CWE and MITRE ATT&CK co-occurrences to identify recurring threat patterns in the CAV domain, demonstrating how AI-assisted vulnerability-to-STIX translation can automate threat intelligence and prioritize defense in transportation security.
Blogger's Review: This paper provides crucial insights into the security of autonomous vehicles, particularly in leveraging open-weight LLMs to generate structured threat information. By constructing the CAV-STIXGen dataset, the researchers offer a powerful tool for threat detection and response, and future research can further optimize model performance to tackle more complex security challenges.