BRIDG-ICS: AI-Grounded Knowledge Graphs for Intelligent Threat Analytics in Industry~5.0 Cyber-Physical Systems

2025-12-12

AI Summary

Under Industry 5.0, deep integration of IT and OT significantly expands the cyber-physical attack surface of industrial control systems (ICS), rendering traditional siloed defenses inadequate for cross-domain threat perception. To address this, we propose an AI-augmented industrial security knowledge graph (KG) framework. Our method innovatively embeds domain-specific large language models (LLMs) into the KG construction pipeline to enable automated mapping from natural-language threat descriptions to structured subject–predicate–object triples. It fuses heterogeneous multi-source IT/OT data to support joint modeling of assets, vulnerabilities, and attack behaviors, as well as multi-stage attack path simulation. Furthermore, probabilistic risk metrics are introduced to enable causal-aware, multi-hop threat reasoning. Experimental results demonstrate that our approach substantially enhances attack chain visibility, reduces the system’s attack surface, and strengthens ICS cyber resilience and collaborative defense capabilities.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Knowledge Representation and Reasoning: Ontologies
• Intelligent Robots: Multimodal Perception & Sensor Fusion

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Industry 5.0's increasing integration of IT and OT systems is transforming industrial operations but also expanding the cyber-physical attack surface. Industrial Control Systems (ICS) face escalating security challenges as traditional siloed defences fail to provide coherent, cross-domain threat insights. We present BRIDG-ICS (BRIDge for Industrial Control Systems), an AI-driven Knowledge Graph (KG) framework for context-aware threat analysis and quantitative assessment of cyber resilience in smart manufacturing environments. BRIDG-ICS fuses heterogeneous industrial and cybersecurity data into an integrated Industrial Security Knowledge Graph linking assets, vulnerabilities, and adversarial behaviours with probabilistic risk metrics (e.g. exploit likelihood, attack cost). This unified graph representation enables multi-stage attack path simulation using graph-analytic techniques. To enrich the graph's semantic depth, the framework leverages Large Language Models (LLMs): domain-specific LLMs extract cybersecurity entities, predict relationships, and translate natural-language threat descriptions into structured graph triples, thereby populating the knowledge graph with missing associations and latent risk indicators. This unified AI-enriched KG supports multi-hop, causality-aware threat reasoning, improving visibility into complex attack chains and guiding data-driven mitigation. In simulated industrial scenarios, BRIDG-ICS scales well, reduces potential attack exposure, and can enhance cyber-physical system resilience in Industry 5.0 settings.

Problem

• Addresses escalating security challenges in Industry 5.0 cyber-physical systems.
• Enables context-aware threat analysis and quantitative cyber resilience assessment.
• Fuses heterogeneous data into a unified AI-driven knowledge graph for threat reasoning.

Innovation

• AI-driven Knowledge Graph framework for threat analysis
• Fuses heterogeneous data into integrated security graph
• Uses LLMs to extract entities and enrich graph semantics