Skip to content
Open access

AeroSec: a vertical domain large language model for air traffic management cybersecurity

Jun 2026 · Scientific Reports · Vol 16 · 0 citations · 24 references
Medicine

TL;DR

A prompt-engineering-based method for generating question–answer pairs for ATM cybersecurity is proposed, and a vertical domain LLM named “AeroSec” for ATM cybersecurity was constructed.

Abstract

With the development of smart civil aviation, the cybersecurity situation for air traffic management (ATM) continues to be critical. The increasingly exposed attack surface demands more advanced technologies and methods for protection. Large language models (LLMs) have been widely applied in cybersecurity, which has provided a novel paradigm for reconstructing ATM cybersecurity defense systems. However, existing vertical domain LLMs in ATM focus on providing passenger services and supporting daily operations, which do not concern cybersecurity. This neglect is a potential risk in the transition from security to safety. In this paper, a prompt-engineering-based method for generating question–answer pairs for ATM cybersecurity is proposed. Knowledge is extracted from multi-source heterogeneous primary sources and converted into uniformly formatted question–answer pairs, and an ATM cybersecurity fine-tuning dataset and benchmark are constructed. By fine-tuning the Deepseek-llm-7B-base model and DeepSeek-R1-Distill-Qwen-14B model using both instruction fine-tuning and reasoning fine-tuning methods, based on Low-Rank Adaptation (LoRA) and full-parameter fine-tuning technologies, a vertical domain LLM named “AeroSec” for ATM cybersecurity was constructed. By comparing the fine-tuned model with the base model, DeepSeek-V3 model, and DeepSeek-R1 model through the third-party model Qwen-Plus, the useful value of AeroSec in answering questions in specialized domains such as ATM network threat analysis and offensive-defensive techniques has been validated.

Read PDF

Similar papers

Review Open access Jul 2026

Local LLM-Based Cyber Incident Analysis in Air-Gapped Networks via Teacher–Student Knowledge Distillation and Agentic Orchestration

Recent cyber incidents have become increasingly sophisticated through Living-off-the-Land (LotL) techniques that exploit legitimate behavior and multi-stage attacks. This requires advanced reasoning capabilities to discern the attack contexts within fragmented large-scale logs. However, closed network environments with physical network separation (air-gapped), such as national critical infrastructures, restrict the use of high-performance cloud large language models (LLMs), thereby limiting the adoption of cutting-edge artificial intelligence (AI)-based analysis technologies. To overcome these constraints, this study proposes a Local LLM-based intrusion analysis framework that operates independently within closed networks. The proposed framework combines (i) an Offline Knowledge Distillation technique that transfers the analytical reasoning process of external high-performance models to the Local LLM after a security review, and (ii) an AI agent orchestration structure that controls the analysis procedure step-by-step and suppresses hallucinations. Experiments and validation using a public dataset (Atomic Red Team) demonstrated that the proposed model achieved a consistently higher detection accuracy (88.4%) and MITRE Adversarial Tactics, Techniques, and Common Knowledge mapping performance (0.91 F1-Score) than existing general-purpose Local LLMs. Furthermore, the proposed model suppressed hallucination rates to 6.2% through an automated verification mechanism and significantly improved analysis efficiency by refining large-scale logs to focus on core events. This study quantitatively demonstrated that AI-based intrusion incident analysis can be automated using a single graphics processing unit server under controlled evaluation conditions. The proposed framework provides a practical prototype for intelligent security monitoring in closed-network environments. However, the operational performance must be validated in real-world deployments.

S. Jang, MyoungRak Lee, Taeshik Shon · 0 citations
Preprint Jul 2026

A Cybersecurity MLPS Large Language Model with Multi-Path Retrieval Fusion

A large language model framework for MLPS that integrates multiple retrieval strategies that combines hierarchical retrieval, tree-based retrieval, and tokenization-based matching retrieval is proposed that helps maintain retrieval coverage while reducing the interference of irrelevant context in the reasoning process.

Qian Li, Zhenyan Qi, Liang Shen et al. · 0 citations
Conference Jul 2026

IoT-Specific Cybersecurity Awareness Training (CSAT) Framework

The widespread adoption of Internet of Things (IoT) and Operational Technology (OT) sys- tems in industrial environments has significantly in- creased cybersecurity exposure. Human error re- mains a leading cause of successful cyberattacks; how- ever, conventional Cybersecurity Awareness Training (CSAT) programs are typically static and poorly aligned with user roles, asset criticality, and evolving threats. This paper proposes an IoT-focused risk- adaptive CSAT framework that integrates MITRE ATT&CK-based threat modeling, CIA-aware impact analysis, machine learning-driven risk assessment, and Generative Artificial Intelligence (GenAI) for person- alized training delivery. The framework models cyber- security awareness as a continuous closed-loop process that constructs user-specific attack graphs, evaluates vulnerabilities through adaptive assessments, and com- putes local and global risk scores. Machine learning dynamically derives risk thresholds to guide training prioritization, while GenAI generates targeted training content aligned with real-world attack scenarios. Evaluation using representative industrial user profiles demonstrates consistent reductions in vulnerability and global risk levels following personalized training. The results indicate that the proposed framework has the potential to enhance human-centric security and im- prove the effectiveness of cybersecurity awareness pro- grams in industrial IoT environments.

Ahmed Mohamed Ahmed, Mohamed Mejri · 0 citations
Open access Aug 2026

GRAL: A GNN-RAG-LLM Framework for Intelligent Cybersecurity Alert Correlation and Analysis

This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation.

Deng Zhang, Juan Wang, Hanjun Gao et al. · 0 citations
Review Open access 2026

Large Language Model-Assisted Threat-Driven Testing System for Enhanced Cybersecurity Readiness

The proposed Large Language Model-Assisted Threat-Driven Testing System enables security teams, particularly resource-constrained organizations lacking dedicated red-team capabilities, to conduct high-fidelity threat simulation exercises aligned with current adversarial TTPs, without specialized AI expertise, thereby strengthening organizational cyber-readiness at significantly lower cost than traditional security testing approaches.

Praise Emeka Nze, A. Ademuwagun, Muktar Bello et al. · 0 citations