METHOD FOR SYNTHESIZING AND PRIORITIZING CYBER INCIDENT SCENARIOS IN CRITICAL INFRASTRUCTURE USING LLM AND AHP

Abstract

The paper deals with the problem of linking each stage of a multi-stage cyberattack on critical infrastructure to the assets, accounts and operational control systems involved. Existing methods based on attack trees require a predefined system model, while approaches based on large language models (LLMs) do not check the organizational support of each generated attack step. This study aims to develop and experimentally evaluate an LLM-assisted decision-support method for the automated synthesis and multi-criteria prioritization of cyber incident scenarios. The proposed method is based on asymmetric generation: the organization in its initial operational state is decomposed hierarchically into assets, and causal event sequences are generated backward from a given incident. Structures generated by an LLM are validated against a JSON schema and checked for graph consistency, while the analyst identifies missing elements for local refinement. Complete scenarios are prioritized using the analytic hierarchy process (AHP). An event sequence is accepted only when every supporting object belongs to the organization’s hierarchy. Experimental evaluation used a modeled case of unauthorized switching that de-energizes substations of a regional electricity distribution operator in Ukraine. Four rounds of refinement recovered all events of the reference model with their causal relationships and object-event connections and produced five complete variants of attack scenarios. Four of these variants depended on a single relationship between the shared control service and the organizational hierarchy. Personnel credential compromise ranks first in the prioritization with a score of 0.816, ahead of the shorter dispatcher session takeover, and retains first place in all runs of the sensitivity analysis. These experimental results show that combining LLMs with formal graph checks detects attack steps that lack supporting organizational objects. In practice, security operations centers (SOCs) can use the approach to find critical dependencies of attacks and to decide which credentials and operational procedures to protect first.