From Incomplete Architecture to Quantified Risk: Multimodal LLM-Driven Security Assessment for Cyber-Physical Systems
This paper introduces ASTRAL, a multimodal LLM-driven tool that reconstructs fragmented cyber-physical system architectures to enable adaptive threat identification and quantitative risk assessment, thereby supporting informed security decisions even when documentation is incomplete or outdated.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are a security guard hired to protect a massive, complex factory. But there's a catch: the factory is so old, and the blueprints are so messy, that you don't actually know where the walls are, which doors lead where, or what machines are connected to what. You only have a few torn-up sketches and some vague memories from the original builders.
Trying to figure out how a thief could break in is nearly impossible without a clear map. If you guess wrong, you might lock the wrong door or leave a window wide open.
This is exactly the problem ASTRAL solves.
The Problem: The "Missing Map" Dilemma
In the world of Cyber-Physical Systems (CPS)—which are things like smart power grids, hospital robots, or self-driving cars—the software and the physical machinery are deeply linked. To keep them safe, security experts need a perfect "map" of the system.
But in reality, these maps are often:
- Lost: The original architects retired, and the files vanished.
- Outdated: The system was upgraded 10 times, but the drawings weren't.
- Incomplete: The drawings only show the "big picture" and miss the tiny, dangerous details.
Without a complete map, security experts are flying blind. They can't calculate the real risk because they don't know the full layout.
The Solution: ASTRAL (The AI Detective)
The researchers built a tool called ASTRAL. Think of ASTRAL as a super-smart AI Detective who is an expert in both architecture and security.
Here is how ASTRAL works, using a simple analogy:
Phase 1: The "Sherlock Holmes" Reconstruction
You hand the AI detective a few torn-up photos of the factory floor and a messy notebook.
- What it does: Instead of just reading the text, the AI looks at the pictures (diagrams) and the text together. It uses its massive knowledge of how factories usually work to fill in the blanks.
- The Magic: If the drawing shows a "Control Room" but doesn't show the "Firewall," the AI knows that in a real factory, there must be a firewall there. It uses strict rules (like a building code) to guess the missing pieces logically, rather than just making things up.
- The Result: It builds a complete, coherent "Digital Twin" (a perfect virtual map) of the system, even though you only gave it scraps of paper.
Phase 2: The "Thief Simulation"
Now that the AI has a complete map, it puts on a different hat. It becomes a Master Thief.
- What it does: It looks at the new map and asks, "If I wanted to break in, how would I do it?" It simulates thousands of attack paths. It finds the weak spots, like an unlocked window or a door with a weak lock.
- The Output: It draws a "Tree of Evil," showing every possible way a hacker could move from the outside to the most critical machine inside.
Phase 3: The "Risk Calculator"
Finally, the AI puts on the hat of a Mathematician.
- What it does: It doesn't just say, "It's dangerous." It calculates the exact odds. "There is a 34% chance a hacker can break in, and if they do, there is a 62% chance the whole factory stops working."
- The Result: You get a clear, numbered score of your risk. This helps you decide exactly where to spend your money to fix the most dangerous holes first.
Why This Matters (The "So What?")
Before ASTRAL, if a factory had missing blueprints, security experts would have to guess or spend months manually digging through old files. They often gave up or made bad guesses.
ASTRAL changes the game by:
- Filling the Gaps: It turns "I don't know" into "Here is the most likely scenario."
- Speed: It does in minutes what used to take weeks.
- Clarity: It gives a clear number (a risk score) so bosses can make smart decisions.
The Human Verdict
The researchers tested this tool with 14 real-world security experts (including top bosses called CISOs).
- The Reaction: The experts loved it. They said it was incredibly useful and saved them a ton of time.
- The Caveat: They noted that the AI is only as good as the clues you give it. If you give it a very blurry photo, the map won't be perfect. Also, they want the AI to explain why it made certain guesses, so they can trust it even more.
The Bottom Line
ASTRAL is like giving a security guard a magic flashlight that can see through walls and reconstruct missing parts of a building instantly. It turns a confusing, incomplete mess of old documents into a clear, actionable plan to keep our critical systems (like power grids and hospitals) safe from hackers. It bridges the gap between "we don't know what we have" and "we know exactly how to protect it."
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.