Modern vehicle systems are increasingly exposed to cybersecurity threats due to growing connectivity, software complexity, and the integration of external services. While standards such as ISO/SAE 21434 provide guidance for threat analysis and risk assessment, constructing security models remains a predominantly manual activity that is difficult to scale and maintain. This challenge limits the systematic incorporation of cybersecurity concerns into model-based engineering processes and hinders early assessment of security risks. This paper explores the idea of automatically generating security models from structured cyber threat intelligence. We present a prototype approach that transforms publicly available attack knowledge from sources such as MITRE ATT&CK and MITRE EMB3D into instances of the Security Abstraction Model (SAM), a domain-specific security metamodel. Our vision is to establish an attack-driven modeling workflow that continuously integrates evolving threat knowledge into model-based engineering environments. As an initial proof of concept, we implemented a generator and applied it to publicly available attack datasets, resulting in the automatic creation of valid security model instances. These early results indicate the feasibility of extensive security model generation and suggest potential benefits for improving the efficiency of cybersecurity analyses. We discuss open challenges, including semantic enrichment, model integration, and outline future research directions toward continuous, data-driven cybersecurity engineering.
Alexander Fischer, Ramin Tavakoli Kolagari· Proceedings of the ACM/IEEE...· 0 citations
Large Language Models are increasingly used to generate structured engineering artifacts, yet the instruction artifacts that govern this generation are rarely treated as modeling artifacts in their own right. They typically appear as monolithic prompt blocks, schemas, or informal examples. When tools, metamodels, APIs, or domain vocabularies evolve, stable domain concepts, volatile tool details, validators, and examples drift together in a single prompt contract. This paper puts forward the thesis that prompt-level instruction artifacts should be understood as versioned modeling languages: explicit artifacts that define the LLM-facing structure required to obtain tool-consumable outputs. We realize this idea through Modular Meta-Language-defined Structure Instructions (MMLDSI), a modular architecture that decomposes structured instructions into versioned modules with explicit interfaces, profiles, adapters, validators, examples, and deterministic rule-deck resolution. Changes to tools or domain concepts can then be represented at the affected modules and profiles rather than hidden inside whole-prompt rewrites. The approach is demonstrated in VR scene generation and automotive security modeling. Across a balanced 320-artifact VR subset, required-key validity reaches 88.1%, while a stricter prompt-contract audit accepts 80.9% and exposes remaining tool-readiness gaps. An offline monolith-to-modular pilot maps 12 legacy feature families and resolves 343 case-specific decks without dependency gaps. Our contribution is not another prompting technique, but a model-management perspective on instruction artifacts for evolving LLM toolchains.
Louis Burk, Alexander Fischer, Christoph Scharnagl et al.· Proceedings of the ACM/IEEE...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
