These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Existing threat modeling frameworks related to transportation cyber-physical
systems (CPS) are often narrow in scope, labor-intensive, and require
substantial cybersecurity expertise. To this end, we introduce the
Transportation Cybersecurity and Resiliency Threat Modeling Framework
(TraCR-TMF), a large language model (LLM)-based threat modeling framework for
transportation CPS that requires limited cybersecurity expert intervention.
TraCR-TMF identifies threats, potential attack techniques, and relevant
countermeasures for transportation CPS. Three LLM-based approaches support
these identifications: (i) a retrieval-augmented generation approach requiring
no cybersecurity expert intervention, (ii) an in-context learning approach with
low expert intervention, and (iii) a supervised fine-tuning approach with
moderate expert intervention. TraCR-TMF offers LLM-based attack path
identification for critical assets based on vulnerabilities across
transportation CPS entities. Additionally, it incorporates the Common
Vulnerability Scoring System (CVSS) scores of known exploited vulnerabilities
to prioritize threat mitigations. The framework was evaluated through two
cases. First, the framework identified relevant attack techniques for various
transportation CPS applications, 73% of which were validated by cybersecurity
experts as correct. Second, the framework was used to identify attack paths for
a target asset in a real-world cyberattack incident. TraCR-TMF successfully
predicted exploitations, like lateral movement of adversaries, data
exfiltration, and data encryption for ransomware, as reported in the incident.
These findings show the efficacy of TraCR-TMF in transportation CPS threat
modeling, while reducing the need for extensive involvement of cybersecurity
experts. To facilitate real-world adoptions, all our codes are shared via an
open-source repository.