## 2 Related Work  
Due to the importance of penetration testing for ICVs, researchers have carried out a large number of related studies. The vehicle-based penetration testing method primarily focuses on in-vehicle systems. [PERSON] et al. [16] introduced penetration testing to the in-vehicle ECU, considering it as an embedded system and adapting the existing penetration testing method for embedded systems. However, with the increasing intelligence of vehicles, certain ECUs such as in-vehicle infotainment systems have become highly complex. Traditional embedded system penetration testing methods may not be fully applicable to new in-vehicle ECUs. [PERSON] et al. proposed a penetration testing scheme for the automotive CAN bus [17]. The researchers conducted an analysis of the cybersecurity threats faced by the CAN bus and evaluated its resilience against data monitoring attacks, injection attacks, replay attacks, and tampering attacks. However, it is worth noting that their experimental environment was limited to simulation settings which may not fully reflect the real-world performance of penetration testing on actual vehicles. [PERSON] et al. focused on conducting penetration testing, specifically targeting in-vehicle infotainment systems [18]. They employed threat analysis results to guide gray-box penetration testing and divided the process into 10 distinct steps. Nevertheless, this study lacks detailed information regarding both threat analysis and penetration testing methodologies employed by the researchers. Furthermore, no specific procedures or standards were established for performing these analyses and tests. The threat-based penetration testing method integrates threat analysis with penetration testing, utilizing the results of the threat analysis to formulate a tailored penetration testing scheme for ICVs [19; 20; 21]. [PERSON] et al. demonstrated the effectiveness of this method by applying it to the airbag control ECU [19]. However, limited research has been conducted on formulating a standardized penetration testing scheme. [PERSON] et al. introduced the fundamental steps of threat-based penetration testing for ICVs [20] yet a standardized process has not been established, which hinders effective guidance for testers in conducting standardized penetration tests. [PERSON] et al. employed this method to systematically assess and test the security of an on-board OTA system [21] but failed to consider comprehensive vehicle-wide penetration testing. The model-based penetration testing method automatically generates test cases by utilizing the TOT [22]. This approach employs a formal language to represent automotive networks and bus systems [23], enabling testers to construct attack models using the same formal language. As a result of leveraging these attack models, researchers can generate cybersecurity test cases for in-vehicle networks and bus systems. However, despite providing a logical description method for constructing attack models and generating test cases, the model-based penetration testing method lacks tools that can automatically generate executable code for the generated test cases based on formal attack models. To address this limitation, [PERSON] et al. proposed a penetration testing method specifically designed for in-vehicle over-the-air (OTA) systems [24]. Their approach utilizes an attack tree model to represent OTA system threats and automates the generation of corresponding test cases, resulting in significant time saving. Nevertheless, the test cases generated automatically are not complete and accurate, and it remains unclear how well this penetration testing method performs when applied to other in-vehicle systems. In addition to the security research on vehicles and subsystems, some researchers have proposed cybersecurity testing and evaluation frameworks for different in-vehicle systems. [PERSON] et al. proposed a security evaluation framework for in-vehicle infotainment systems based on threat analyses and penetration tests [25].