🤖 AI Summary
This work addresses the inefficiency and manual effort inherent in threat modeling for cyber-physical systems (CPS) by proposing SMSI, an automated framework that integrates neural and symbolic methods. SMSI enables the first-ever automatic mapping from SysML architectural models to NIST SP 800-53 security controls through an end-to-end reasoning chain linking CVE, MITRE ATT&CK, and NIST frameworks. The approach combines a deterministic parser, a fine-tuned SecureBERT+ classifier, a dense retrieval encoder, and the Gemma-26B large language model for zero-shot inference to generate prioritized security control recommendations. Evaluation on a medical IoT gateway case study demonstrates that SecureBERT achieves superior performance in recommending NIST controls from ATT&CK tactics, confirming that dense embeddings effectively support automated security modeling for CPS.
📝 Abstract
Threat modeling for cyber-physical systems (CPS) remains a largely manual exercise. This project presents SMSI (System Model Security Inference), a hybrid neuro-symbolic pipeline that starts from a SysML architecture model and produces a prioritized list of NIST 800-53 security controls. The prototype has three main stages: a deterministic parser mapping system components to vulnerabilities via the NVD; a family of retrieval and classification models linking vulnerabilities to MITRE ATT&CK techniques; and a control recommender. We explore three approaches for CVE-to-ATT&CK mapping: a supervised classifier using fine-tuned SecureBERT+, retrieval-based dense encoders, and a zero-shot LLM approach using Gemma-4 26B. We validate the pipeline on a healthcare IoT gateway with nine software components. For the ATT&CK-to-NIST stage, pretrained SecureBERT achieves the highest control retrieval scores, demonstrating that dense embeddings provide a strong basis for automated control recommendation.