Efficient Curation of ICS Cybersecurity Information Using Large Language Models - Matsuda, Wataru; Watanabe, Kenji; Mitsunaga, Takuho; Fujimoto, Mariko (Journal of Information Processing, 2025)
In recent years, control systems have rapidly advanced and increasingly tend to be connected to IT networks and the Internet. In environments where IT and Industrial Control Systems (ICS) are interconnected, there is a risk of intrusion via the IT network. Nowadays, IT technologies are integrated into ICS, so it is crucial to consider IT attack risks in ICS environments in addition to ICS-specific attacks. A vast amount of information on attack tools and cyberattack reports has been published.Security analysts must analyze or meticulously read this information to determine if the attacks are relevant to their organization and how they should be defended against, necessitating a curation process. However, understanding the content of all published attack methods and reports properly requires significant resources, including costs and skills based on experience. Therefore, this research investigates the practical use of Large Language Models (LLMs) for extracting information beneficial to an organization's security measures efficiently. Specifically, we examined whether it is possible to identify protocols and ports from public information that could be exploited in attacks.These information are helpful in preventing or monitoring these attacks using tools such as firewalls, even if timely security updates are difficult. This examination was conducted from the following two perspectives:・Extracting port numbers to be protected and monitored against attacks targeting IT networks, especially Windows environments, based on Proof of Concept (PoC) information on the Internet.・From the perspective of ICS networks, extracting exploited protocols, port numbers, and product names from past ICS-related reports.The goal of the research is to prepare for attacks in advance, identify exploitable products and protocols. The results obtained from the proposed method can be utilized for mitigation and enhanced monitoring. Furthermore, they can also be applied to risk assessment and penetration testing. Using the proposed method, we were able to extract port numbers with a potential for misuse in IT attacks with a 60.0% correct response rate. For ICS, we achieved an 81.8% correct response rate in extracting potentially exploited port numbers and protocol names, and a 72.7% correct response rate in identifying target products.