一句话：首个大规模实证研究，基于649个真实可利用漏洞刻画智能网联汽车漏洞并修正现有分类。
智能网联汽车（ICV）安全直接关系用户安全，但现有研究多聚焦特定子组件，缺乏系统性理解，且常依赖问卷或访谈等主观分析，与现实攻击存在差距。本文开展首个大规模ICV漏洞实证研究：先梳理现有安全文献中的漏洞位置与类型分类法，再收集649个可利用漏洞，其中592个来自2023年1月至2024年4月八届Anonymous Cup竞赛、覆盖48款车辆，57个由研究者日常提交。基于该数据集评估既有分类覆盖度，发现分类缺口，新增1类漏洞位置和13种漏洞类型，并将漏洞归为6类威胁和4个风险等级，同时分析参赛者技能与涉及车辆类型。数据集已公开。
Intelligent Connected Vehicles (ICVs) are a core component of modern transportation systems, and their security is crucial as it directly relates to user safety. Despite prior research, most existing studies focus only on specific sub-components of ICVs due to their inherent complexity. As a result, there is a lack of systematic understanding of ICV vulnerabilities. Moreover, much of the current literature relies on human subjective analysis, such as surveys and interviews, which tends to be high-level and unvalidated, leaving a significant gap between theoretical findings and real-world attacks. To address this issue, we conducted the first large-scale empirical study on ICV vulnerabilities. We began by analyzing existing ICV security literature and summarizing the prevailing taxonomies in terms of vulnerability locations and types. To evaluate their real-world relevance, we collected a total of 649 exploitable vulnerabilities, including 592 from eight ICV vulnerability discovery competitions, Anonymous Cup, between January 2023 and April 2024, covering 48 different vehicles. The remaining 57 vulnerabilities were submitted daily by researchers. Based on this dataset, we assessed the coverage of existing taxonomies and identified several gaps, discovering one new vulnerability location and 13 new vulnerability types. We further categorized these vulnerabilities into 6 threat types (e.g., privacy data breach) and 4 risk levels (ranging from low to critical) and analyzed participants’ skills and the types of ICVs involved in the competitions. This study provides a comprehensive and data-driven analysis of ICV vulnerabilities, offering actionable insights for researchers, industry practitioners, and policymakers. To support future research, we have made our vulnerability dataset publicly available.
@inproceedings{abs-2601-00627,
title = {Towards Understanding and Characterizing Vulnerabilities in Intelligent Connected Vehicles through Real-World Exploits},
author = {Yuelin Wang and Yuqiao Ning and Yanbang Sun and Xiaofei Xie and Zhihua Xie and Yang Chen and Zhen Guo and Shihao Xue and Junjie Wang and Sen Chen},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773223}
}