Jun 2026· Scientific Reports· Vol 16· 0 citations· 24 references
Medicine
TL;DR
A prompt-engineering-based method for generating question–answer pairs for ATM cybersecurity is proposed, and a vertical domain LLM named “AeroSec” for ATM cybersecurity was constructed.
Abstract
With the development of smart civil aviation, the cybersecurity situation for air traffic management (ATM) continues to be critical. The increasingly exposed attack surface demands more advanced technologies and methods for protection. Large language models (LLMs) have been widely applied in cybersecurity, which has provided a novel paradigm for reconstructing ATM cybersecurity defense systems. However, existing vertical domain LLMs in ATM focus on providing passenger services and supporting daily operations, which do not concern cybersecurity. This neglect is a potential risk in the transition from security to safety. In this paper, a prompt-engineering-based method for generating question–answer pairs for ATM cybersecurity is proposed. Knowledge is extracted from multi-source heterogeneous primary sources and converted into uniformly formatted question–answer pairs, and an ATM cybersecurity fine-tuning dataset and benchmark are constructed. By fine-tuning the Deepseek-llm-7B-base model and DeepSeek-R1-Distill-Qwen-14B model using both instruction fine-tuning and reasoning fine-tuning methods, based on Low-Rank Adaptation (LoRA) and full-parameter fine-tuning technologies, a vertical domain LLM named “AeroSec” for ATM cybersecurity was constructed. By comparing the fine-tuned model with the base model, DeepSeek-V3 model, and DeepSeek-R1 model through the third-party model Qwen-Plus, the useful value of AeroSec in answering questions in specialized domains such as ATM network threat analysis and offensive-defensive techniques has been validated.
Recent cyber incidents have become increasingly sophisticated through Living-off-the-Land (LotL) techniques that exploit legitimate behavior and multi-stage attacks. This requires advanced reasoning capabilities to discern the attack contexts within fragmented large-scale logs. However, closed network environments with physical network separation (air-gapped), such as national critical infrastructures, restrict the use of high-performance cloud large language models (LLMs), thereby limiting the adoption of cutting-edge artificial intelligence (AI)-based analysis technologies. To overcome these constraints, this study proposes a Local LLM-based intrusion analysis framework that operates independently within closed networks. The proposed framework combines (i) an Offline Knowledge Distillation technique that transfers the analytical reasoning process of external high-performance models to the Local LLM after a security review, and (ii) an AI agent orchestration structure that controls the analysis procedure step-by-step and suppresses hallucinations. Experiments and validation using a public dataset (Atomic Red Team) demonstrated that the proposed model achieved a consistently higher detection accuracy (88.4%) and MITRE Adversarial Tactics, Techniques, and Common Knowledge mapping performance (0.91 F1-Score) than existing general-purpose Local LLMs. Furthermore, the proposed model suppressed hallucination rates to 6.2% through an automated verification mechanism and significantly improved analysis efficiency by refining large-scale logs to focus on core events. This study quantitatively demonstrated that AI-based intrusion incident analysis can be automated using a single graphics processing unit server under controlled evaluation conditions. The proposed framework provides a practical prototype for intelligent security monitoring in closed-network environments. However, the operational performance must be validated in real-world deployments.
S. Jang, MyoungRak Lee, Taeshik Shon· Electronics· 0 citations
A large language model framework for MLPS that integrates multiple retrieval strategies that combines hierarchical retrieval, tree-based retrieval, and tokenization-based matching retrieval is proposed that helps maintain retrieval coverage while reducing the interference of irrelevant context in the reasoning process.
Qian Li, Zhenyan Qi, Liang Shen et al.· 0 citations
The widespread adoption of Internet of Things (IoT) and Operational Technology (OT) sys- tems in industrial environments has significantly in- creased cybersecurity exposure. Human error re- mains a leading cause of successful cyberattacks; how- ever, conventional Cybersecurity Awareness Training (CSAT) programs are typically static and poorly aligned with user roles, asset criticality, and evolving threats. This paper proposes an IoT-focused risk- adaptive CSAT framework that integrates MITRE ATT&CK-based threat modeling, CIA-aware impact analysis, machine learning-driven risk assessment, and Generative Artificial Intelligence (GenAI) for person- alized training delivery. The framework models cyber- security awareness as a continuous closed-loop process that constructs user-specific attack graphs, evaluates vulnerabilities through adaptive assessments, and com- putes local and global risk scores. Machine learning dynamically derives risk thresholds to guide training prioritization, while GenAI generates targeted training content aligned with real-world attack scenarios. Evaluation using representative industrial user profiles demonstrates consistent reductions in vulnerability and global risk levels following personalized training. The results indicate that the proposed framework has the potential to enhance human-centric security and im- prove the effectiveness of cybersecurity awareness pro- grams in industrial IoT environments.
Ahmed Mohamed Ahmed, Mohamed Mejri· 2026 6th International Confe...· 0 citations
This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation.
Deng Zhang, Juan Wang, Hanjun Gao et al.· Symmetry· 0 citations
CyberFactory is introduced, a unified open-source framework that connects data construction, trajectory synthesis, and model training across proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA).
Jian Yang, Haau-Sing Li, Shawn Guo et al.· 0 citations
The proposed Large Language Model-Assisted Threat-Driven Testing System enables security teams, particularly resource-constrained organizations lacking dedicated red-team capabilities, to conduct high-fidelity threat simulation exercises aligned with current adversarial TTPs, without specialized AI expertise, thereby strengthening organizational cyber-readiness at significantly lower cost than traditional security testing approaches.
Praise Emeka Nze, A. Ademuwagun, Muktar Bello et al.· Journal of Cyber Security· 0 citations