Abstract: To address the privacy leakage risks existing in the application of Internet of Vehicles (IoV) devices, this paper systematically summarizes 359 types of IoV device privacy information classified into four categories by analyzing relevant IoV technical documents and academic papers, and constructs a corresponding privacy information classification system. Based on this classification system, this paper proposes a large language model (LLM)-based Vehicular Data-flow Privacy Compliance Analyzer (VDPAnalyzer) to conduct privacy compliance analysis on vehicular data streams. Based on the syntactic and semantic parsing of vehicular network traffic, the system integrates pattern matching and LLM technologies with prompt engineering and model fine-tuning strategies, so as to effectively detect privacy leakage problems and identify compliance risks in vehicular data streams. In this paper, network traffic data of 11 real-world IoV devices including on-board diagnostics (OBD) devices, vehicle-mounted cameras and in-vehicle infotainment systems are collected for experimental verification. The experimental results show that the fine-tuned LLM improves the precision of identifying privacy information in IoV traffic from 71.2% to 88.0%, and the recall rate from 85.7% to 86.3%. Among the 88 detected privacy leakage items, 32 items (accounting for 36.4%) are not stated in the devices privacy policies. More seriously, some IoV devices transmit captured video thumbnails and audio-to-text transcription results in unencrypted plaintext, causing severe risks of user personal privacy leakage.

Key words: internet of vehicles, large language models, privacy compliance, traffic analysis, privacy information identification

摘要： 针对车联网设备使用过程中存在的隐私泄露风险，本文通过梳理分析车联网相关技术文档与学术文献，系统归纳整理出四类、共计359种车联网设备隐私信息类型，并构建对应的隐私信息分类体系。基于该分类体系，本文提出一种基于大语言模型的车辆数据流隐私合规分析系统（Vehicular Data-flow based Privacy Compliance Analyzer，VDPAnalyzer），用于实现车辆数据流的隐私合规性检测与分析。该系统以车辆网络流量的句法与语义解析为基础，融合模式匹配方法与大语言模型技术，结合提示工程与模型微调策略，可有效检测车辆数据流中的隐私泄露问题、识别相关合规风险。本文基于OBD汽车故障检测仪、车载摄像头、车载信息娱乐系统三类设备，采集11款真实车联网设备的网络流量数据开展对照实验。实验结果表明，经过微调优化后的大语言模型，对车联网流量隐私信息的识别精确率由71.2%提升至88%，召回率由85.7%提升至86.3%。在检测出的88项隐私泄露项中，有32项（占比36.4%）未在设备隐私政策中进行相关声明。更为突出的是，部分车联网设备会以明文未加密形式传输拍摄的视频缩略图、语音录音转文字结果，存在严重的用户个人隐私泄露隐患。

关键词: 车联网, 大语言模型, 隐私合规, 流量分析, 隐私信息识别