View in EDS

ICSThreatQA: A knowledge-graph enhanced question answering model for industrial control system threat intelligence.

Saved in:
Bibliographic Details
Title: ICSThreatQA: A knowledge-graph enhanced question answering model for industrial control system threat intelligence.
Authors: Rani, Ruby1 (AUTHOR) ruby.rani@newcastle.ac.uk, Kumar, Mahender1,2 (AUTHOR) mahender.kumar@warwick.ac.uk, Epiphaniou, Gregory2 (AUTHOR) gregory.epiphaniou@warwick.ac.uk, Maple, Carsten2 (AUTHOR) CM@warwick.ac.uk
Source: Expert Systems with Applications. Mar2026, Vol. 301, pN.PAG-N.PAG. 1p.
Subjects: Knowledge graphs, Question answering systems, Internet security, Industrial controls manufacturing
Abstract: • ICSThreatQA: QA system tailored for ICS cybersecurity. • Four QA models, including novel KG-RAG for knowledge-rich answers. • Builds and evaluates 620-pair QA dataset curated from MITRE ATT&CK ICS knowledgebase. • Improves threat detection and incident response in ICS environments. Industrial Control Systems (ICS) underpin critical infrastructure but remain vulnerable to sophisticated cyberattacks. Existing threat intelligence tools emphasise static knowledge bases and isolated indicators, offering limited support for analysts who must navigate complex adversarial tactics. To address this gap, we present ICSThreatQA, the first QA framework tailored to ICS threat intelligence. ICSThreatQA introduces four retrieval-augmented architectures - including a novel Knowledge Graph-enhanced RAG (KG-RAG) - designed to provide accurate, context-aware responses to natural-language security queries. We construct a curated dataset of 620 expert-validated QA pairs from the MITRE ATT&CK ICS knowledge base, encompassing factual, contrastive, inferential, and opinion-based queries. Through extensive evaluation, including automated metrics, human expert ratings, adversarial robustness, and multi-turn dialogues, ICSThreatQA demonstrates significant improvements over baseline RAG and large language models. Notably, KG-RAG achieves the highest answer relevance (0.968) and correctness (0.660), while the Hybrid model balances precision and faithfulness under few-shot settings. These results confirm ICSThreatQA's potential to transform static ICS threat knowledge into an interactive, analyst-ready intelligence system, reducing cognitive burden and accelerating incident response. [ABSTRACT FROM AUTHOR]
Copyright of Expert Systems with Applications is the property of Pergamon Press - An Imprint of Elsevier Science and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database: Engineering Source
FullText Text:
  Availability: 0
Header DbId: egs
DbLabel: Engineering Source
An: 190853243
AccessLevel: 6
PubType: Academic Journal
PubTypeId: academicJournal
PreciseRelevancyScore: 0
IllustrationInfo
Items – Name: Title
  Label: Title
  Group: Ti
  Data: ICSThreatQA: A knowledge-graph enhanced question answering model for industrial control system threat intelligence.
– Name: Author
  Label: Authors
  Group: Au
  Data: <searchLink fieldCode="AR" term="%22Rani%2C+Ruby%22">Rani, Ruby</searchLink><relatesTo>1</relatesTo> (AUTHOR)<i> ruby.rani@newcastle.ac.uk</i><br /><searchLink fieldCode="AR" term="%22Kumar%2C+Mahender%22">Kumar, Mahender</searchLink><relatesTo>1,2</relatesTo> (AUTHOR)<i> mahender.kumar@warwick.ac.uk</i><br /><searchLink fieldCode="AR" term="%22Epiphaniou%2C+Gregory%22">Epiphaniou, Gregory</searchLink><relatesTo>2</relatesTo> (AUTHOR)<i> gregory.epiphaniou@warwick.ac.uk</i><br /><searchLink fieldCode="AR" term="%22Maple%2C+Carsten%22">Maple, Carsten</searchLink><relatesTo>2</relatesTo> (AUTHOR)<i> CM@warwick.ac.uk</i>
– Name: TitleSource
  Label: Source
  Group: Src
  Data: <searchLink fieldCode="JN" term="%22Expert+Systems+with+Applications%22">Expert Systems with Applications</searchLink>. Mar2026, Vol. 301, pN.PAG-N.PAG. 1p.
– Name: Subject
  Label: Subjects
  Group: Su
  Data: <searchLink fieldCode="DE" term="%22Knowledge+graphs%22">Knowledge graphs</searchLink><br /><searchLink fieldCode="DE" term="%22Question+answering+systems%22">Question answering systems</searchLink><br /><searchLink fieldCode="DE" term="%22Internet+security%22">Internet security</searchLink><br /><searchLink fieldCode="DE" term="%22Industrial+controls+manufacturing%22">Industrial controls manufacturing</searchLink>
– Name: Abstract
  Label: Abstract
  Group: Ab
  Data: • ICSThreatQA: QA system tailored for ICS cybersecurity. • Four QA models, including novel KG-RAG for knowledge-rich answers. • Builds and evaluates 620-pair QA dataset curated from MITRE ATT&CK ICS knowledgebase. • Improves threat detection and incident response in ICS environments. Industrial Control Systems (ICS) underpin critical infrastructure but remain vulnerable to sophisticated cyberattacks. Existing threat intelligence tools emphasise static knowledge bases and isolated indicators, offering limited support for analysts who must navigate complex adversarial tactics. To address this gap, we present ICSThreatQA, the first QA framework tailored to ICS threat intelligence. ICSThreatQA introduces four retrieval-augmented architectures - including a novel Knowledge Graph-enhanced RAG (KG-RAG) - designed to provide accurate, context-aware responses to natural-language security queries. We construct a curated dataset of 620 expert-validated QA pairs from the MITRE ATT&CK ICS knowledge base, encompassing factual, contrastive, inferential, and opinion-based queries. Through extensive evaluation, including automated metrics, human expert ratings, adversarial robustness, and multi-turn dialogues, ICSThreatQA demonstrates significant improvements over baseline RAG and large language models. Notably, KG-RAG achieves the highest answer relevance (0.968) and correctness (0.660), while the Hybrid model balances precision and faithfulness under few-shot settings. These results confirm ICSThreatQA's potential to transform static ICS threat knowledge into an interactive, analyst-ready intelligence system, reducing cognitive burden and accelerating incident response. [ABSTRACT FROM AUTHOR]
– Name: AbstractSuppliedCopyright
  Label:
  Group: Ab
  Data: <i>Copyright of Expert Systems with Applications is the property of Pergamon Press - An Imprint of Elsevier Science and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.)
PLink https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=egs&AN=190853243
RecordInfo BibRecord:
  BibEntity:
    Identifiers:
      – Type: doi
        Value: 10.1016/j.eswa.2025.130180
    Languages:
      – Code: eng
        Text: English
    PhysicalDescription:
      Pagination:
        PageCount: 1
        StartPage: N.PAG
    Subjects:
      – SubjectFull: Knowledge graphs
        Type: general
      – SubjectFull: Question answering systems
        Type: general
      – SubjectFull: Internet security
        Type: general
      – SubjectFull: Industrial controls manufacturing
        Type: general
    Titles:
      – TitleFull: ICSThreatQA: A knowledge-graph enhanced question answering model for industrial control system threat intelligence.
        Type: main
  BibRelationships:
    HasContributorRelationships:
      – PersonEntity:
          Name:
            NameFull: Rani, Ruby
      – PersonEntity:
          Name:
            NameFull: Kumar, Mahender
      – PersonEntity:
          Name:
            NameFull: Epiphaniou, Gregory
      – PersonEntity:
          Name:
            NameFull: Maple, Carsten
    IsPartOfRelationships:
      – BibEntity:
          Dates:
            – D: 21
              M: 03
              Text: Mar2026
              Type: published
              Y: 2026
          Identifiers:
            – Type: issn-print
              Value: 09574174
          Numbering:
            – Type: volume
              Value: 301
          Titles:
            – TitleFull: Expert Systems with Applications
              Type: main
ResultId 1