Cyber-physical systems (CPSs) integrate cyber and physical components and enable them to interact with each other to meet user needs. The needs for CPSs span rich application domains such as healthcare and medicine, smart home, smart building, etc. This indicates that CPSs are all about solving real-world problems. With the increasing abundance of sensing devices and effectors, the problems wanted to solve with CPSs are becoming more and more complex. It is also becoming increasingly difficult to extract and express CPS requirements accurately. Problem frame approach aims to shape real-world problems by capturing the characteristics and interconnections of components, where the problem diagram is central to expressing the requirements. CPSs requirements are generally presented in domain-specific documents that are normally expressed in natural language. There is currently no effective way to extract problem diagrams from natural language documents. CPSs requirements extraction and modeling are generally done manually, which is time-consuming, labor-intensive, and error-prone. Large language models (LLMs) have shown excellent performance in natural language understanding. It can be interesting to explore the abilities of LLMs to understand domain-specific documents and identify modeling elements, which this paper is working on. To achieve this goal, we first formulate two tasks (i.e., entity recognition and interaction extraction) and propose a benchmark called CPSBench. Based on this benchmark, extensive experiments are conducted to evaluate the abilities and limitations of seven advanced LLMs. We find some interesting insights. Finally, we establish a taxonomy of LLMs hallucinations in CPSs requirements modeling using problem diagrams. These results will inspire research on the use of LLMs for automated CPSs requirements modeling.
SmartValidator: A Framework for Automatic Identification and Classification of Cyber Threat Data
安全运营中心（SOC）使用各种网络威胁信息（CTI）来验证安全事件和警报。安全专家根据CTI手动定义不同类型的规则和脚本来执行验证任务。这些规则和脚本需要不断更新，因为不断变化的威胁，不断变化的SOC的要求和CTI的动态性质。更新规则和脚本的手动过程会延迟对攻击的响应。为了减轻人类专家的负担并加快响应速度，我们提出了一种新的基于人工智能（AI）的框架SmartValidator。SmartValidator利用机器学习（ML）技术实现警报的自动验证。它由三层组成，执行数据汇集、模型构建和警报验证任务。它将验证任务投影为分类问题。而不是建立和保存模型的所有可能的要求，我们建议自动构建验证模型的基础上SOC的要求和CTI。我们构建了一个概念验证（Proof of Concept，简称PMM）系统，其中包含8种ML算法、2种特征工程技术和18项需求，以研究SmartValidator的有效性和效率。评估结果表明，当自动构建预测模型用于对网络威胁数据进行分类时，75%的模型的F1得分高于0.8，这表明该模型具有足够的性能，可用于现实世界的组织。结果进一步表明，预测模型的动态构建所需的模型比所有可能要求的预构建模型少99%。该框架可以被各个行业遵循，以根据其CTI和SOC的偏好加速和自动化警报和事件的验证。
Leveraging Large Language Models for Cybersecurity Risk Assessment -- A Case from Forestry Cyber-Physical Systems
Chalmers University of Technology（楚德斯技术大学）；University of Gothenburg（哥德堡大学）；Carnegie Mellon University（卡内基梅隆大学）；RISE Research Institutes of Sweden（瑞典RISE研究机构）
