Search papers, labs, and topics across Lattice.
This paper addresses the misalignment between public CVE descriptions and the Auto-ISAC Automotive Threat Matrix by introducing a confidence-aware framework for automotive CVE-to-ATM mapping. The method employs hierarchical in-context learning to generate candidate mappings and integrates self-consistency and LLM-based evidence verification to produce calibrated confidence scores. The results demonstrate a significant improvement in mapping precision, achieving a precision of 0.878 in the AUTO tier, which is more than double the baseline performance, thereby enhancing threat interpretation and mitigation prioritization in safety-critical environments.
A confidence-aware framework for automotive CVE-to-ATM mapping boosts precision to 87.8%, effectively filtering out uncertain mappings that could compromise safety.
Public CVE descriptions report the technical conditions and impact of vulnerabilities, whereas the Auto-ISAC Automotive Threat Matrix (ATM) expresses an adversary's tactics and techniques. Because the two representations are not directly aligned, incorrect automated mappings in safety-critical environments may distort threat interpretation and mitigation prioritization, motivating a confidence-aware approach that distinguishes auto-confirmable mappings from uncertain cases. This paper reformulates automotive CVE-to-ATM mapping as a selective automation problem. The proposed framework generates candidate mappings via hierarchical in-context learning, then fuses self-consistency and LLM-based evidence verification signals into a calibrated meta-model. The resulting calibrated confidence score routes each candidate into AUTO, REVIEW, or HOLD. On the evaluation set, the proposed system substantially improved candidate-set precision at matched recall over a Flat zero-shot GPT-5.2 baseline. In the High-Confidence operating mode, the AUTO tier achieved a precision of 0.878, more than double the candidate-set base rate, and the calibrated confidence score achieved an AUROC of 0.868 in distinguishing correct from incorrect candidates. These results show that the framework can support selective automation by isolating auto-confirmable mappings from those requiring analyst review.
