PaperlayerView exact revision on arXiv

Source-linked AI summary

AttackLLM: LLM-based Attack Pattern Generation for an Industrial Control System

Chuadhry Mujeeb Ahmed

arXiv:2504.04187v1cs.CRcs.LG

TL;DR

ICS security research is constrained by the difficulty of collecting attack data and the limited availability of expert-designed examples. AttackLLM uses LLM agents to infer and validate control invariants and generate attack patterns from data and design information. In SWaT, it generated 159 attacks, 120 validated as legitimate, compared with 36 human-generated attacks.

  • Problem

    ICS security testing and intrusion detection depend on attack examples, but collecting them is difficult and available expert-designed data is limited.

    Source: §1 · p. 1

  • Method

    AttackLLM uses LLM agents to infer control invariants from operational data and design information, validate them, and generate attack patterns.

    Source: §1 · p. 1, §2.1 · p. 2, §2.4 · p. 3

  • Results

    AttackLLM generated 159 attacks across SWaT’s six stages, with 120 empirically validated as legitimate, compared with 36 human-generated attacks; it replicated nine of ten human-designed attacks.

    Source: §3 · p. 4

  • Takeaways & Limitations

    The generated patterns are presented as resources for understanding potential threats and developing attack-detection strategies.

    Source: §1 · p. 1

    Some invariants could not be verified because the referenced states were absent from normal operational data.

    Source: §3 · p. 4

Abstract

from arXiv · show

Malicious examples are crucial for evaluating the robustness of machine learning algorithms under attack, particularly in Industrial Control Systems (ICS). However, collecting normal and attack data in ICS environments is challenging due to the scarcity of testbeds and the high cost of human expertise. Existing datasets are often limited by the domain expertise of practitioners, making the process costly and inefficient. The lack of comprehensive attack pattern data poses a significant problem for developing robust anomaly detection methods. In this paper, we propose a novel approach that combines data-centric and design-centric methodologies to generate attack patterns using large language models (LLMs). Our results demonstrate that the attack patterns generated by LLMs not only surpass the quality and quantity of those created by human experts but also offer a scalable solution that does not rely on expensive testbeds or pre-existing attack examples. This multi-agent based approach presents a promising avenue for enhancing the security and resilience of ICS environments.

1 Introduction

ICS security research depends on access to attack examples, but collecting them is difficult and expert-designed data is limited. AttackLLM combines data and design principles to generate attacks, producing more patterns than human experts in the SWaT case study.

1 Introduction

  • Attack examples are important to ICS security testing and intrusion detection, but collecting them is difficult and available attack data is limited.ICS operate critical infrastructure through computing and communication components, and attacks have increased research interest in prevention, mitigation, and response.Source: §1 · p. 1
  • The proposed approach uses data and design principles to generate attacks intended to drive an ICS into an anomalous state.LLMs analyze historical ICS data and expert-developed action sets to identify attack patterns and novel sequences.Source: §1 · p. 1
  • AttackLLM produced more attack patterns than human experts in the SWaT case study, where experts had designed 36 scenarios over five days.The authors validated generated patterns by checking normal patterns against design specifications, comparing attacks with expert-created attacks, and comparing two LLM agents.Source: §1 · p. 1

2 Background and System Description

The paper explores LLMs for extracting control invariants and uses a workflow that combines plant data, design documentation, invariant validation, and expert comparison. SWaT provides the water-treatment testbed context for this approach.

2.1 Large Language Models

  • LLM-driven systems use language models for reasoning and tool-assisted execution, and this paper investigates deriving physical invariants from operational documentation and sensor data.The stated aim is to replace labor-intensive manual extraction and uncover invariants analysts might overlook.Source: §2.1 · pp. 1–2

2.2 System Overview

  • Two LLM agents infer control invariants separately from sensor-and-actuator data and system documentation; a third validates them against observed behavior before attack generation.The resulting attacks are compared with domain-expert attacks to identify gaps and add new patterns to a knowledge base.Source: §2.2 · p. 2

2.3 SWaT Testbed and Dataset Description

  • SWaT is a six-stage water-treatment testbed that processes five gallons per minute using sensors, actuators, and two communication networks.Its stages include ultrafiltration, reverse osmosis, and chemical dosing; Level 0 connects sensors and actuators to PLCs, while Level 1 supports inter-PLC communication.Source: §2.3 · p. 2

Dataset Description

The paper uses SWaT data and design information to infer control invariants and generate attack examples. It evaluates invariant stability across dataset segments and compares generated attacks with human-designed patterns.

Dataset Description

  • The SWaT dataset contains one-per-second sensor and actuator readings alongside normal operation and human-designed attack scenarios.The authors select it for its adoption in ICS research and its expert-designed attacks, which support comparison of synthetically generated patterns.Source: Dataset Description · p. 2

2.4 Invariants in Industrial Control Systems

  • Manually defining invariant rules is time-consuming, error-prone, and may miss relevant relationships in complex ICS.The paper illustrates Stage 1 control logic involving a motorized valve, pumps, and a flow meter.Source: §2.4 · p. 3
  • Control invariants describe physical and control relationships that constrain normal plant behavior, while invariant violations can indicate faults or malicious attacks.The paper represents system dynamics in state-space form and defines state, input, output, system matrices, process noise, and measurement noise.Source: §2.4 · pp. 2–3
  • AttackLLM-generated patterns substantially overlap with human-generated attacks while also including new patterns.The paper compares the two pattern sets in Figure 2.Source: Figure 2 · p. 3

2.5 Physical Invariant Inference and Validation

  • LLMs infer control invariants from dataset and testbed documents, then validate them by checking whether relationship parameters remain stable across multiple training-data segments.Parameters from each segment are applied to the remaining segments; an invariant is confirmed only when the parameters remain stable across all segments.Source: §2.5 · p. 3

3 Results

AttackLLM generated many more attacks across SWaT’s six stages than the human baseline, while also reproducing known attacks and identifying novel and stealthy patterns. Most tested control invariants were valid, though some could not be verified because their referenced states were absent from operational data.

RQ1

  • Most generated control invariants were validated against operational data, but some referenced states absent from that data.The authors attribute these failures to dataset limitations rather than model inaccuracy.Source: §3 · pp. 3–4

RQ2–RQ3

  • The models generated known and novel attack vectors, including cross-stage dependencies; reported stealthy patterns included gradual changes and intermittent disruptions.Both models generated incremental sensor manipulations, including a 1 mm perturbation per time instance, consistent with the expert-designed A3 pattern.Source: §3 · p. 4

RQ4

  • AttackLLM replicated nine of ten human-designed attacks and generated 20 novel Stage 1 patterns.It also proposed stealthy strategies to evade detection mechanisms.Source: §3 · p. 4
  • 159 attacks were generated across six SWaT stages, with 120 validated as legitimate, compared with 36 human-generated attacks.Figure 2 summarizes the six-stage results; the paper notes that only Stage 1 attack tables are included.Source: §3 · p. 4

4 Related Work

Prior synthetic-data work has focused largely on network traffic, GANs, and IoT, while ICS attack-pattern generation remains less explored. The paper positions LLMs combined with data-driven analysis and design insights as an ICS-focused approach to that gap.

Research gap

  • Existing ICS datasets are constrained by limited attack-scenario scope and reliance on pre-existing examples, while testbed access and human expertise can make data collection costly.The EPIC smart-grid testbed could not collect attack examples because of risks to a live system.Source: §4 · p. 5

This work

  • The paper combines LLMs with data-centric and design-centric methods to generate ICS attack patterns, presenting this as a domain-specific approach.LLMs’ use in ICS remains underexplored, despite their demonstrated pattern-generation capabilities in cybersecurity.Source: §4 · p. 5

Prior work

  • Prior synthetic-data studies emphasize GAN-based adversarial examples, network-layer traffic, and IoT datasets, with limited ICS coverage.The survey [6] compares synthetic network-traffic generation approaches and highlights the value of high-quality synthetic data for cybersecurity machine learning.Source: §4 · p. 5

5 Conclusions

AttackLLM uses LLM-driven agents to infer and validate control invariants and generate attack patterns from ICS information. In the SWaT study it produced novel and stealthy attacks at scale, although operational-data limitations constrained invariant validation.

Results

  • AttackLLM identified 159 total attacks across all six SWaT stages, including 20 novel Stage 1 patterns, a multi-fold increase over prior human efforts.Source: §5 · p. 5

Approach

  • LLM-driven agents synthesized process data, system documentation, and control logic to generate and validate ICS attack patterns.The system inferred sensor-actuator relationships and inter-stage dependencies in SWaT.Source: §5 · p. 5

Implications

  • AttackLLM generated stealthy strategies including incremental perturbations and intermittent disruptions, and identified cross-stage attack dependencies.The paper presents these capabilities as useful for stress-testing anomaly detectors and identifying previously unknown attack surfaces.Source: §5 · p. 5

Limitations and future work

  • Operational datasets restricted invariant validation in edge-case scenarios.The paper proposes extending the approach to other ICS domains, including power grids, and exploring hybrid human-AI frameworks.Source: §5 · p. 5

A Tables for Attack Patterns

The appendix identifies two Copilot-generated SWaT Stage 1 tables: one for attack patterns and one for stealthy attack patterns.

Publication record

Attack patterns

  • Table 5 covers attack patterns generated by Copilot for SWaT Stage 1.Source: Table 5 · p. 8

Stealthy attack patterns

  • Table 6 covers stealthy attack patterns generated by Copilot for SWaT Stage 1.Source: Table 6 · p. 9
Loading 2504.04187v1…