💻 computer science

Towards the Development of an LLM-Based Methodology for Automated Security Profiling in Compliance with Ukrainian Cybersecurity Regulations

This paper proposes a methodology that leverages Retrieval-Augmented Generation (RAG) with Large Language Models to automate the creation of security profiles, ensuring alignment between technical controls and Ukrainian cybersecurity regulations while integrating international standards like ISO/IEC 27001 and NIST.

Original authors: Daniil Shafranskyi, Iryna Stopochkina, Mykola Ilin

Published 2026-04-09

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Daniil Shafranskyi, Iryna Stopochkina, Mykola Ilin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the captain of a ship (your company's computer system). You need to make sure your ship is safe from pirates, storms, and leaks. But there's a catch: you have to follow a massive, complicated rulebook written by the government (Ukraine's cybersecurity laws) that is constantly being updated.

In the past, hiring a team of expert navigators to read every page of that rulebook, figure out which rules apply to your specific ship, and write a safety plan took weeks, cost a fortune, and was prone to human error.

This paper proposes a smart, AI-powered assistant to do the heavy lifting for you. Here is the breakdown of their idea in simple terms:

1. The Problem: The "Rulebook" is Too Big

Ukraine has updated its cybersecurity laws to be more modern and risk-based. Instead of a "one-size-fits-all" approach, they now say: "If you handle sensitive data, you need Level A protection. If you handle public data, you need Level B."

However, translating these complex laws into a specific safety plan for your unique system is like trying to build a custom suit of armor by reading a dictionary of metal types. It's slow, confusing, and easy to get wrong.

2. The Solution: The "Smart Librarian" (RAG + LLM)

The authors built a system using Large Language Models (LLMs)—the same technology behind chatbots like me—but with a special twist called RAG (Retrieval-Augmented Generation).

Think of a standard AI as a student who memorized a textbook years ago. If the textbook has new pages added today, the student doesn't know about them and might give you outdated advice.

The RAG system is like a super-smart librarian:

The Library: They feed the AI a digital library containing all of Ukraine's current cybersecurity laws, regulations, and best practices.
The Process: When you ask the AI, "How do I protect my new cloud system?", the librarian doesn't just guess. It instantly searches the library, finds the exact pages about cloud security, and then writes the answer based only on those pages.
The Benefit: This stops the AI from "hallucinating" (making things up) and ensures every piece of advice is backed by a specific law.

3. How It Works: The "Safety Profile" Recipe

The paper describes a step-by-step recipe for creating a Target Security Profile (your custom safety plan):

The Input (The System Passport): You tell the AI about your ship (your system). What data does it hold? Who uses it? Is it on the cloud?
The Baseline (The Starter Kit): The AI looks at your description and picks a "Base Profile." This is like a standard safety kit for a boat of your size.
The Customization (The Tailoring): The AI compares your specific ship against the rulebook.
- Example: The rulebook says, "Change passwords every 90 days."
- The AI's Job: It looks at your system and says, "Wait, this system handles high-value secrets. The law says we need to change them every 30 days for high-risk systems."
The Output: It generates a draft safety plan with specific instructions, citing exactly which law requires each step.

4. The "Human-in-the-Loop" (The Captain's Final Say)

This is the most important part. The AI is not the boss. It is a draftsman.

The AI writes the first draft of the safety plan.
A human expert (the Captain) reviews it.
The human says, "Yes, this looks good," or "No, change this part."
Why? Because while the AI is great at reading rules, it can't fully understand the unique culture or hidden risks of a specific company. The human makes the final call to ensure accountability.

5. The Experiment: Did It Work?

The researchers tested this system with three different AI models (like Claude, Gemini, and ChatGPT) using a fake company scenario.

The Result: The AI was surprisingly good. It got about 75% to 80% of the decisions right compared to human experts.
The Speed: It did in minutes what would take a human team days.
The Catch: If you gave the AI vague information (like a blurry map of your ship), it made more mistakes. This proves that you still need to provide good details for the AI to work well.

The Big Picture

This paper isn't just about writing code; it's about survival in a dangerous world. With cyberattacks happening faster than ever, companies need to adapt their defenses instantly.

This methodology is like giving every company a personalized, instant legal and security consultant that knows the Ukrainian law by heart, ensuring they are compliant, safe, and ready for whatever comes next, without needing to hire a team of 50 lawyers and security experts.

1. Problem Statement

The paper addresses the critical gap between Ukraine's evolving, risk-oriented cybersecurity regulatory framework and the practical, manual processes used to implement it.

Context: Ukraine has adopted new normative documents (specifically ND TPI 3.6-006-24) that align with international standards like NIST SP 800-53 and ISO/IEC 27001. These regulations require organizations to derive a Target Security Profile (TSP) from a mandatory Base Security Profile based on specific system risks and contexts.
The Challenge: The transition from a generic baseline to a system-specific target profile is complex, time-consuming, and prone to human error. It requires deep expertise in both the regulatory catalog and the specific information system's architecture.
The Gap: There is currently no automated, reproducible, or explainable workflow to assist security experts in tailoring these profiles. Existing AI solutions often lack regulatory traceability or are too resource-intensive (multi-agent systems) for widespread adoption.

2. Proposed Methodology

The authors propose a structured methodology using Large Language Models (LLMs) enhanced by Retrieval-Augmented Generation (RAG) to automate the derivation of Target Security Profiles.

Core Architecture

The system operates on a Human-in-the-Loop principle, where the AI acts as a decision-support tool, and a human expert retains final approval authority.

Input: A structured "System Passport" (describing architecture, data categories, user roles, and risks) and the regulatory corpus (ND TPI 3.6-006-24).
RAG Engine:
- Data Ingestion: Regulatory documents are cleaned, chunked (using optimized semantic splitting), embedded, and stored in a vector database.
- Retrieval: When a query is made, the system retrieves relevant regulatory controls and implementation guidance specific to the system's context.
LLM Processing: The model receives the system context + retrieved regulatory chunks to generate draft decisions for each control.

Formalized Workflow

The derivation process is modeled as a constrained decision-support function $P(S, Q, B, R) \rightarrow T$ :

System Formalization: Converting the system passport into a structured model ( $S$ ) covering architecture, data, and deployment.
Baseline Selection: Automatically selecting the appropriate Base Profile ( $B$ ) based on the system's impact category (Low, Moderate, High).
Contextual Analysis: For each baseline control, the system calculates:
- Relevance Score ( $\rho$ ): How applicable is the control to this specific system?
- Adequacy Assessment ( $\alpha$ ): Are the baseline parameters sufficient, insufficient, or unknown?
Decision Logic: The LLM assigns a decision to each control from a set: Keep, Refine, Enhance, Add, or Compensate.
- Refine: Adjust parameters (e.g., changing "end of day" to "8 hours").
- Enhance: Add specific NIST enhancements (e.g., MFA requirements).
- Compensate: Propose alternative controls if the original is infeasible.
Output Generation: A structured draft TSP containing specific parameters, rationale, assigned owners, and verification artifacts.
Expert Review: A human expert validates the draft, correcting any hallucinations or logical gaps before final approval.

3. Key Contributions

Regulatory-Specific Methodology: A formalized workflow for deriving Target Security Profiles specifically aligned with Ukraine's ND TPI 3.6-006-24, bridging the gap between national law and international NIST standards.
RAG-Enhanced LLM Architecture: A single-model architecture (avoiding complex multi-agent supply chain risks) that uses RAG to ensure traceability. Every generated decision is grounded in retrieved regulatory text, reducing hallucinations.
Structured Decision Framework: The introduction of a specific decision logic (Keep/Refine/Enhance/Compensate) that transforms generic controls into auditable, parameterized rules.
Experimental Validation: A comparative assessment of three leading LLMs (Claude Sonnet 4.6, Gemini 3.1 Pro, and ChatGPT Thinking 5.4) in a real-world compliance scenario.

4. Experimental Results

The authors tested the methodology using synthetic but realistic system specifications against the three LLMs.

Performance Metrics:
- Claude Sonnet 4.6 Extended: Performed best. It generated a comprehensive 60-page report in under 4 minutes.
  - 75% of decisions matched expert judgment directly.
  - Only 15% of controls required minor edits.
  - 10% hallucination rate when system data was incomplete.
- ChatGPT Thinking 5.4: Produced a detailed report in ~18 minutes but was more conservative, frequently flagging controls for clarification.
  - 65% match rate with experts.
  - 25% hallucination rate with incomplete data.
- Gemini 3.1 Pro: Provided fragmented analysis (segments of 9–11 controls) rather than a cohesive report.
  - 60% match rate.
  - 43% hallucination rate when data was missing (highest among the three).
Key Findings:
- The quality of the output is directly correlated with the completeness of the input "System Passport." Incomplete data leads to higher hallucination rates.
- The methodology successfully automates the analytical burden, allowing experts to focus on validation rather than manual drafting.
- Compensation modeling (handling infeasible controls) remains a complex area requiring further refinement.

5. Significance and Impact

Operational Efficiency: The methodology transforms a weeks-long manual compliance process into a matter of hours, significantly reducing the time-to-compliance for Ukrainian organizations.
Scalability: It enables small and medium-sized enterprises (SMEs) to implement complex risk-based security profiles without needing large teams of specialized compliance officers.
Resilience: By integrating automated profiling into the system lifecycle, organizations can dynamically adapt to high-intensity hybrid threats and evolving regulations.
Trust & Safety: The "Human-in-the-Loop" design ensures that while AI handles the data processing, the final accountability and legal responsibility remain with human experts, mitigating the risks of AI-driven errors in critical infrastructure.

In conclusion, the paper demonstrates that RAG-enhanced LLMs are a viable, efficient, and accurate tool for automating cybersecurity compliance in complex regulatory environments, provided that the input data is rigorous and human oversight is maintained.