Decoding BACnet Packets: A Large Language Model Approach for Packet Interpretation
Not on the map. Why?
Abstract (arXiv)
The Industrial Control System (ICS) environment encompasses a wide range of intricate communication protocols, posing substantial challenges for Security Operations Center (SOC) analysts tasked with monitoring, interpreting, and addressing network activities and security incidents. Conventional monitoring tools and techniques often struggle to provide a clear understanding of the nature and intent of ICS-specific communications. To enhance comprehension, we propose a software solution powered by a Large Language Model (LLM). This solution currently focused on BACnet protocol, processes a packet file data and extracts context by using a mapping database, and contemporary context retrieval methods for Retrieval Augmented Generation (RAG). The processed packet information, combined with the extracted context, serves as input to the LLM, which generates a concise packet file summary for the user. The software delivers a clear, coherent, and easily understandable summary of network activities, enabling SOC analysts to better assess the current state of the control system.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 15 of its 23 references that are in the map. First posted on arXiv 22 Jul 2024.
Builds on
15 of 23 references.
References · 15
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
- 2023A Comprehensive Overview of Large Language Modelscited by 639
- 2020CTRLsum: Towards Generic Controllable Text Summarizationcited by 98
- 2023Large Language Models are Not Yet Human-Level Evaluators for Abstractive Summarizationcited by 70
- 2024Large Language Models for Cyber Security: A Systematic Literature Reviewcited by 65
- 2022SecureBERT: A Domain-Specific Language Model for Cybersecuritycited by 60
- 2023Text Summarization Using Large Language Models: A Comparative Study of MPT-7b-instruct, Falcon-7b-instruct, and OpenAI Chat-GPT Modelscited by 35
- 2024Fine Tuning LLM for Enterprise: Practical Guidelines and Recommendationscited by 28
- 2023HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs)cited by 25
3 more
- 2023Can Large Language Models Provide Security & Privacy Advice? Measuring the Ability of LLMs to Refute Misconceptionscited by 20
- 2023LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testingcited by 16
- 2023On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptionscited by 10
Built on by
Citing papers per year: 2025: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2024Sentinels of the Stream: Unleashing Large Language Models for Dynamic Packet Classification in Software Defined Networks -- Position Paper
- 2023Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generation
- 2024Unleashing the Power of LLM to Infer State Machine from the Protocol Implementation
- 2025MultiFuzz: A Dense Retrieval-based Multi-Agent System for Network Protocol Fuzzing
- 2026PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis
- 2025Retrieval Augmented Generation Based LLM Evaluation For Protocol State Machine Inference With Chain-of-Thought Reasoning
- 2026RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines
- 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation