LLM-driven autonomous and process aware industrial control system threat detection

Typical enterprise-grade Security Information and Event Management systems (SIEM) struggle with the operations technology insights required for securing Industrial Control Systems (ICS) against emerging cyber threats. Tier 1 Security Operating Center (SOC) analysts who often manage security alerts are inexperienced and are often run by novices or student interns with little experience in handling emerging cyber threats in an Operational Technology (OT) environment of an ICS. There is also a lack of cyber-physical reasoning when prioritising alerts in a SOC, because attacks appear benign in the IT domain, but may still pose a threat through violating physical-level attacker invariants that go undetected by a SIEM. Consequently, it is a challenge to build fully autonomous SIEM systems whilst unsafe automated decisions can have a catastrophic impact on the physical processes of an ICS. 

This talk shall provide a comprehensive presentation of a multi-agent framework that adopts graph theory for capturing the network and physical relationships of OT processes and also to provide a reasoning capability engine based on Large Language Models (LLMs).

As part of a demonstration, we shall provide a walk-through on the use of a localised LLM software agent ingesting with a simulated log feed (like a snippet from an ICS dataset), and a Neo4j backend database that automates comparison of threat feeds, to help gauge an ICS asset's physical dependencies, and to yield threat detection findings very accurately in human-readable format for a range of cyber threats.