Pith. sign in

REVIEW 6 major objections 10 minor 1 cited by

A Large Language Model-Supported Threat Modeling Framework for Transportation Cyber-Physical Systems

T0 review · 6 major / 10 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims TraCR-TMF, an LLM-based framework, maps transportation CPS data flows to relevant MITRE ATT&CK attack techniques with 73% expert-validated precision and can predict attack paths that match the Colonial Pipeline ransomware…

desk verdict A sensible integration of known LLM and threat-modeling pieces, but the headline precision is built on circular expert validation and the reported recall is internally inconsistent. read the letter →

arxiv 2506.00831 v2 pith:USJD3TWH submitted 2025-06-01 cs.CR cs.AI

M Sabbir Salek , Mashrur Chowdhury , Muhaimin Bin Munir , Yuchen Cai , Mohammad Imtiaz Hasan , Jean-Michel Tine , Latifur Khan , Mizanur Rahman This is my paper · ORCID
classification cs.CRcs.AI
keywords threatmodelingtransportationcyber-physicalsystemslargelanguagemodelsMITREATT&CKSTRIDEretrieval-augmentedgenerationsupervisedfine-tuningransomwareattackpath
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TraCR-TMF is a multi-stage threat modeling framework for transportation cyber-physical systems that lets large language models do the technique-mapping work normally reserved for cybersecurity experts. The paper's central claim is that a supervised fine-tuned LLM can identify the MITRE ATT&CK attack techniques relevant to a given transportation data flow with 73% precision once experts validate what the model adds beyond an incomplete ground truth. Three alternative strategies trade expert involvement against accuracy: retrieval-augmented generation needs no expert but scores lowest, in-context learning needs a few examples, and supervised fine-tuning performs best but needs labeled data. The same framework produces asset-centric attack paths, and on the Colonial Pipeline case it predicted lateral movement, data exfiltration, and encryption for ransom consistent with the public record. If these results hold, transportation agencies can shift from manual threat analysis to LLM-assisted screening and reprioritize mitigations by known exploited vulnerability severity.

What carries the argument

The load-bearing mechanism is the 'basic input' representation of a data flow, bundled with a STRIDE threat report, and a supervised multi-label classifier over the MITRE ATT&CK technique catalogue. ModernBERT, an encoder-only transformer that handles long inputs, is fine-tuned with binary cross-entropy loss and five-fold cross-validation; a per-label operating-point selection algorithm (Algorithm 1) chooses the threshold that maximizes F1 on validation folds. The same basic input is run through a retrieval-augmented pipeline that vectorizes MITRE ATT&CK descriptions and retrieves candidate techniques, or through a few-shot in-context prompt. The asset-centric stage uses a customized GPT with an engineered prompt that takes a table of initiators, acceptors, and their associated techniques and chains them into attack paths ending at a specified asset.

What would settle it

Have a fresh set of cybersecurity experts build a complete ground truth for a random sample of transportation CPS data flows by reviewing every ATT&CK technique for every flow, then compare the fine-tuned model's predictions against that independent label set; if precision drops materially below 0.73 or false negatives still concentrate on techniques like T1098, the reported accuracy was inflated by incomplete ground truth. For the attack-path claim, pre-register the framework's predicted paths before a future publicly documented transportation-CPS ransomware incident and compare each step against the official report.

Watch

Extended reading notes

Core claim

The paper argues that threat modeling for transportation CPS can be decomposed into a pipeline that starts from the system's data flow diagram and ends with prioritized countermeasures. Stage 1 uses the SDL threat modeling tool to generate a STRIDE threat report from an ARC-IT reference architecture. Stage 2 turns each data flow into a 'basic input' containing the flow's definition, initiator and acceptor, functional objects, security attributes, and STRIDE threats; three LLM approaches then map that input to specific MITRE ATT&CK techniques. Stage 3 feeds the identified techniques, organized by initiator and acceptor, into a customized GPT that predicts multi-step attack paths to a specified critical asset, annotating each step with techniques. Stage 4 maps the techniques to known exploited CVEs and ranks the associated vulnerabilities by CVSS base score. In the ARC-IT evaluation the supervised ModernBERT approach achieved 0.70 precision, 0.75 recall, and 0.72 F1; on 50 randomly selected data flows, expert validation of model-flagged techniques outside the original ground truth raised precision from 0.64 to 0.73. In the Colonial Pipeline evaluation, the predicted attack paths included T1020 (Automated Exfiltration) and T1486 (Data Encrypted for Impact), matching the incident's known data exfiltration and ransomware encryption.

Load-bearing premise

The accuracy numbers depend on two cybersecurity experts' ground-truth list being correct and complete, even though they could not review all 200+ techniques for each of the 433 data flows; the 73% figure comes only after the same experts accepted model-flagged techniques that were missing from that list.

Editorial extensions

If this is right

  • With moderate expert involvement, supervised fine-tuning outperforms both the no-intervention RAG approach (0.33 precision, 0.20 recall) and the best few-shot ICL approach (0.47 precision, 0.48 recall) on the same data-flow mapping task.
  • The 73% expert-validated precision implies that roughly three of every four model-flagged techniques are correct, so security teams would screen the remaining quarter manually.
  • The Colonial Pipeline evaluation indicates that a model fine-tuned on ARC-IT planning-level applications can transfer to a real ICS environment without retraining.
  • Because the supervised model found relevant techniques such as Create Account (T1136) outside the experts' incomplete ground truth, the framework can surface threat candidates that a fixed training list would miss.
  • Mapping ATT&CK techniques to known exploited CVEs and ranking by CVSS scores yields a severity-ordered mitigation list, with vendor-applicability filtering left to human judgment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper does not run would apply the RAG variant to the ICS ATT&CK matrix, where newly published techniques appear often; that would isolate whether retrieval freshness can compensate for its lower precision on the enterprise matrix.
  • The paper leaves implicit that the local, privacy-preserving ModernBERT path cannot pull in brand-new ATT&CK techniques without rebuilding the retrieval index, so organizations with strict data policies may have to weigh freshness against data residency.
  • The false-negative pattern on T1098 (Account Manipulation) suggests per-label thresholds tuned on one transportation mode may not transfer to another mode; recalibration on mode-specific data flows would be a natural next test.
  • Beyond transportation, the same pipeline could be re-run against energy or water sector reference architectures, which share the CPS structure but have different data flows and a different mix of relevant techniques.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 10 minor

Summary. The paper introduces TraCR-TMF, a multi-stage threat modeling framework for transportation cyber-physical systems that combines the Microsoft SDL threat modeling tool, the MITRE ATT&CK matrix, CVE/KEV/CVSS, and three LLM-based strategies (RAG, in-context learning, and supervised fine-tuning) for identifying attack techniques. A fourth stage performs asset-centric attack path identification using a customized GPT, and a fifth stage prioritizes mitigations by CVSS scores. The framework is evaluated on 433 data flows from 26 ARC-IT transportation applications, with the supervised fine-tuning approach reported to achieve 73% precision on 50 randomly selected data flows after a second-stage expert validation, and on the Colonial Pipeline ransomware incident for attack path identification. The authors claim that TraCR-TMF reduces the need for extensive cybersecurity expert involvement while matching expert judgment in threat identification.

Significance. If the reported accuracy were independently confirmed, TraCR-TMF would be a practically valuable contribution: it automates the mapping of STRIDE threats to ATT&CK techniques, provides mitigation prioritization via CVSS, and includes open-source code and a detailed threshold-selection algorithm, all of which support reproducibility. The framework addresses a real gap in transportation CPS threat modeling, where existing work is often mode-specific and largely manual. However, the central quantitative claim rests on an evaluation protocol that is not yet sufficiently independent or internally consistent, so the significance is contingent on the evaluation being brought up to the standard of the framework's design.

major comments (6)
  1. [Section VI.B, Table V] The headline precision of 0.73 is derived from a protocol in which the same two cybersecurity experts who created the incomplete ground-truth list were, on a subset of 50 data flows, shown the supervised model's out-of-ground-truth predictions and asked to validate them, with validated items then added to the ground truth. Because the experts never independently enumerated all relevant ATT&CK techniques for these data flows, the expanded ground truth remains incomplete in a way that is biased toward the model's predictions, and the measured precision is not an unbiased estimate of the model's true precision. Please provide an independent, blind validation by experts not involved in the original labeling, or re-report the 73% as a conditional figure with this limitation explicitly stated.
  2. [Section VI.A, Eqs. (5)-(6)] The text states that micro precision and recall are used, but Eqs. (5) and (6) define per-instance (macro) averages over data flows, which are not micro metrics. The tables do not specify which averaging is used. This ambiguity affects the interpretation of every precision, recall, and F1 value in the paper, including the headline numbers. Please correct the definitions to match the metrics actually used, or report both clearly.
  3. [Section VI.B, Table V] The recall reported for the supervised model decreases from 0.67 to 0.66 after the ground-truth list is expanded with validated true positives. With unchanged model predictions, adding a true positive to the ground truth increases TP and leaves FN unchanged, so recall cannot decrease. This suggests an error in the calculation or in the reported values; please recompute the metrics and correct Table V.
  4. [Section V-B and Table IV] The three LLM-based approaches are not comparable as a controlled comparison because each uses a different base model: GPT-4o for RAG, gpt-4o-mini for ICL, and ModernBERT for supervised fine-tuning. The conclusion that supervised fine-tuning outperforms the others is therefore confounded by the choice of base model. Please either evaluate all three approaches with the same base model, or explicitly discuss this confound and temper the corresponding claims.
  5. [Section VI.B] The evaluation lacks any comparison with existing threat modeling methods or with a manual expert baseline. The abstract's claim that the framework shows 'efficacy' and reduces expert involvement is not contextualized against the state of the art. A comparison on a subset of data flows (e.g., expert-only mapping, or an existing automated mapping tool) would be needed to support the practical-advantage claim.
  6. [Section VI.C] The Colonial Pipeline evaluation conflates two different components: the fine-tuned ModernBERT identifies ATT&CK techniques, while attack path generation is performed by a separate customized GPT-4o-based model. The paper's statement that 'TraCR-TMF successfully predicted exploitations' attributes to the framework a capability that was not evaluated for the fine-tuned model. Moreover, the validation of the predicted attack paths relies on the same experts and is acknowledged to be unverifiable against the actual incident. Please clarify which component is being credited and present this case as an illustration rather than as evidence of predictive accuracy.
minor comments (10)
  1. [Abstract] The 73% figure is presented without the caveat that it applies only to the supervised fine-tuning approach on 50 of 433 data flows, and not to the RAG or ICL approaches.
  2. [Section V-B-1] The RAG similarity cutoff of 0.6 is justified qualitatively; please provide a sensitivity analysis or ablation to support the choice.
  3. [Section V-B-2] The choice of eight examples for few-shot learning is reported as optimal, but no results for the tested range of 2-9 examples are shown.
  4. [Section V-B-3] The learning rate, weight decay, and batch size are said to be 'empirically tuned,' but no search ranges or validation curves are reported.
  5. [Section VI.A] The notation in Eqs. (5) and (6) is ambiguous about whether P_i and G_i are sets of techniques for a single data flow or aggregated across data flows; please clarify.
  6. [Section VI.B] The random selection of 50 data flows is not reproducible without a random seed; please report the seed or state that results are from one random draw.
  7. [Section VII.B] The robustness evaluation uses the zero-shot approach with F1 scores around 0.2-0.3 and heavily overlapping confidence intervals; the conclusion that the framework is robust to textual errors is overstated.
  8. [Appendix A] The pseudocode contains typos ('SELCT_THRESHOLD' and 'fp r_list,APPEND'); please correct them.
  9. [Section VII.A] 'oLLaMA' should be 'Llama' or another correct model name.
  10. [Section VI.C] The assumption that Colonial Pipeline's network follows the Purdue Model is stated without justification; please add a supporting reference or a sensitivity discussion.

Circularity Check

1 steps flagged · score 4.0 of 10

The reported 73% precision is partly self-referential: the supervised LLM's own out-of-ground-truth predictions were shown to the same experts and then added to the ground truth before re-scoring, so independent blind validation is needed to confirm the headline number.

  1. fitted input called prediction [Section VI.B, Table V (second-stage validation on 50 randomly selected data flows)]
    "we randomly selected 50 data flows out of the 433 data flows used in this evaluation and again consulted with the cybersecurity experts to evaluate each LLM-predicted attack technique that was not present in our ground-truth list of relevant attack techniques. ... once we updated the ground-truth list with the help of the cybersecurity experts, considering all the attack techniques identified by the supervised LLM, the precision improved from 0.64 to 0.73"

    The supervised LLM is scored against a ground-truth list that the paper itself states is incomplete, since the experts could not review all 200+ ATT&CK techniques for each of the 433 data flows. For the 50-flow subset, the ground truth is expanded by taking the supervised LLM's out-of-list predictions to the same experts and adding the accepted ones. The improved precision therefore largely measures the rate at which the model's own prompted suggestions were accepted by the labelers, rather than an independent measurement of correctness; the model helped define the label set on which it is then judged, making the 0.73 figure partially self-referential.

full rationale

The paper is an empirical evaluation rather than a derivation, so there is no equation-level circularity in the framework itself: the STRIDE threats come from the MS SDL tool, the ATT&CK mapping comes from LLM prompts and fine-tuning, and the attack-path stage is a separate LLM query. The central claim is the supervised LLM's 0.73 precision on 50 data flows (Table V). That number is weakened by a self-referential evaluation protocol: the ground truth was updated using the supervised LLM's own predictions after those predictions were shown to the same two experts who built the original incomplete label set. This makes the precision improvement partly a measure of expert acceptance of model suggestions, not an independent confirmation. A separate arithmetic inconsistency in Table V (recall falls from 0.67 to 0.66 after adding validated true positives, which cannot happen if predictions are unchanged) further cautions against treating 0.73 as stable, though that is a correctness concern rather than circularity. Self-citations such as reference [39] appear only in related work and do not carry the central claim, so they do not raise the score. Independent blind labeling of the 50 flows by experts who have not seen the model's outputs would resolve the circularity concern; until then, the headline accuracy is partially self-referential.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several free parameters (similarity cutoff, few-shot count, per-label thresholds, and training hyperparameters) and on domain assumptions about the completeness of ATT&CK and ARC-IT, the accuracy of expert labels, the reliability of proprietary LLMs, and the Purdue Model assumption for the incident evaluation. No new physical or conceptual entities are introduced.

free parameters (6)
  • RAG similarity cutoff = 0.6
    Chosen as a trade-off between precision and recall in candidate retrieval; no independent validation is reported.
  • Few-shot example count = 8
    Selected because it outperformed two to nine examples on the evaluation set, with no separate validation set reported.
  • Per-label classification thresholds = Optimized per fold and label on validation sets
    Algorithm 1 selects thresholds that maximize validation F1, making these values fit to data.
  • Learning rate = 0.00002
    Empirically tuned for ModernBERT fine-tuning.
  • Weight decay = 0.01
    Empirically tuned as part of the fine-tuning procedure.
  • Early stopping parameters = Tolerance 5 epochs, minimum improvement 0.001
    Chosen to prevent overfitting; standard practice but still a modeling choice that affects results.
assumptions (5)
  • domain assumption The MITRE ATT&CK matrix is a complete and correct catalogue of attack techniques.
    The framework maps all identified threats to ATT&CK techniques and uses the matrix as a reference for relevance; if the matrix omits transportation-specific attacks, the mapping is incomplete.
  • domain assumption ARC-IT reference architectures accurately represent deployed transportation CPS applications.
    The main evaluation uses 26 ARC-IT service packages and 433 data flows extracted from them; if these architectures differ from real systems, the measured performance may not transfer.
  • ad hoc to paper The Colonial Pipeline ICS network follows the Purdue Model.
    Section VI.C.2 states this assumption because the actual pipeline architecture is confidential; the entire incident evaluation depends on this assumed network topology.
  • domain assumption Cybersecurity expert labels for relevant ATT&CK techniques are correct and sufficient.
    The ground truth for training and evaluation comes from two experts, whose judgments are not independently verified and may be incomplete or biased.
  • domain assumption GPT-4o and the customized GPT provide reliable security analysis.
    The framework relies on proprietary LLMs whose behavior is not deterministic, fully auditable, or reproducible; the paper provides no formal guarantees about their outputs.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Large Language Model-Supported Threat Modeling Framework for Transportation Cyber-Physical Systems." pith.science (2026). https://pith.science/paper/USJD3TWH

@misc{pith2026250600831,
  author       = {Pith},
  title        = {Pith review of: A Large Language Model-Supported Threat Modeling Framework for Transportation Cyber-Physical Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/USJD3TWH}},
  note         = {Machine review of arXiv:2506.00831}
}
read the original abstract

Existing threat modeling frameworks related to transportation cyber-physical systems (CPS) are often narrow in scope, labor-intensive, and require substantial cybersecurity expertise. To this end, we introduce the Transportation Cybersecurity and Resiliency Threat Modeling Framework (TraCR-TMF), a large language model (LLM)-based threat modeling framework for transportation CPS that requires limited cybersecurity expert intervention. TraCR-TMF identifies threats, potential attack techniques, and relevant countermeasures for transportation CPS. Three LLM-based approaches support these identifications: (i) a retrieval-augmented generation approach requiring no cybersecurity expert intervention, (ii) an in-context learning approach with low expert intervention, and (iii) a supervised fine-tuning approach with moderate expert intervention. TraCR-TMF offers LLM-based attack path identification for critical assets based on vulnerabilities across transportation CPS entities. Additionally, it incorporates the Common Vulnerability Scoring System (CVSS) scores of known exploited vulnerabilities to prioritize threat mitigations. The framework was evaluated through two cases. First, the framework identified relevant attack techniques for various transportation CPS applications, 73% of which were validated by cybersecurity experts as correct. Second, the framework was used to identify attack paths for a target asset in a real-world cyberattack incident. TraCR-TMF successfully predicted exploitations, like lateral movement of adversaries, data exfiltration, and data encryption for ransomware, as reported in the incident. These findings show the efficacy of TraCR-TMF in transportation CPS threat modeling, while reducing the need for extensive involvement of cybersecurity experts. To facilitate real-world adoptions, all our codes are shared via an open-source repository.

Figures

Figures reproduced from arXiv: 2506.00831 by the authors.

Figure 1
Figure 1. FIGURE 1 [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. FIGURE 2 [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. FIGURE 3 [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: illustrates the ICL prompt given to the LLM. The prompt is designed to ensure that the LLM receives adequate context to perform the requested task. Since the ICL-based approach includes a few worked-out examples verified by cybersecurity experts, this approach is consi…
Figure 5
Figure 5. Figure 5: FIGURE 5 [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: FIGURE 6 [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: FIGURE 7 [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: presents two bar charts showing the top 50% of the MITRE ATT&CK techniques identified as false positives (in Fig. 8a) and false negatives(in Fig. 8b) across the 50 randomly selected data flows. Here, false positives indicate cases where the supervised LLM correctly pre…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Rectified Schr\"odinger Bridge Matching for Few-Step Visual Navigation

    cs.RO 2026-04 unverdicted novelty 7.0 of 10

    RSBM exploits velocity field invariance across regularization levels to achieve over 94% cosine similarity and 92% success in visual navigation using only 3 integration steps.

Reference graph

Works this paper leans on

95 extracted references · 59 canonical work pages · cited by 1 Pith paper

  1. [1]

    A survey on intelligent transportation systems,

    K. N. Qureshi and A. H. Abdullah, “A survey on intelligent transportation systems,” Middle-East Journal of Scientific Research, vol. 15, no. 5, pp. 629–642, 2013

    2013

  2. [2]

    A Survey on the Current Security Landscape of Intelligent Transportation Systems,

    A. Lamssaggad, N. Benamar, A. S. Hafid, and M. Msahli, “A Survey on the Current Security Landscape of Intelligent Transportation Systems,” IEEE Access, vol. 9, pp. 9180–9208, 2021, doi: 10.1109/ACCESS.2021.3050038

    arXiv 2021

  3. [3]

    Security and Privacy Issues in Intelligent Transportation Systems: Classification and Challenges,

    D. Hahn, A. Munir, and V. Behzadan, “Security and Privacy Issues in Intelligent Transportation Systems: Classification and Challenges,” IEEE Intelligent Transportation Systems Magazine, vol. 13, no. 1, pp. 181–196, 2021, doi: 10.1109/MITS.2019.2898973

    work page arXiv 2021

  4. [4]

    Under Attack: Trucking industry increasingly at risk of cyberattacks,

    “Under Attack: Trucking industry increasingly at risk of cyberattacks,” Truck News. Accessed: Mar. 25, 2025. [Online]. VOLUME XX, 2017 Available: https://www.trucknews.com/features/under-attack- trucking-industry-increasingly-at-risk-of-cyberattacks/

    2025

  5. [5]

    Aviation is facing a rising wave of cyber-attacks in the wake of COVID

    “Aviation is facing a rising wave of cyber-attacks in the wake of COVID.” Accessed: Mar. 25, 2025. [Online]. Available: https://www.stephensonharwood.com/insights/aviation-is-facing-a- rising-wave-of-cyber-attacks-in-the-wake-of- covid?06082024160610&26032025015047

    2025

  6. [6]

    IAPH Cybersecurity Guidelines for Ports and Port Facilities,

    “IAPH Cybersecurity Guidelines for Ports and Port Facilities,” International Association of Ports and Harbors. Accessed: Mar. 25,

  7. [7]

    Threat modeling – A systematic literature review,

    W. Xiong and R. Lagerström, “Threat modeling – A systematic literature review,” Computers & Security, vol. 84, pp. 53–69, Jul. 2019, doi: 10.1016/j.cose.2019.03.010

    doi:10.1016/j.cose.2019.03.010 2019

  8. [8]

    Swiderski and W

    F. Swiderski and W. Snyder, Threat modeling. Microsoft Press, 2004

    2004

Show all 95 references
  1. [9]

    DNS Rebinding Threat Modeling and Security Analysis for Local Area Network of Maritime Transportation Systems,

    X. He et al., “DNS Rebinding Threat Modeling and Security Analysis for Local Area Network of Maritime Transportation Systems,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 2, pp. 2643–2655, Feb. 2023, doi: 10.1109/TITS.2021.3135197

    2023

  2. [10]

    Threat Modeling and Attack Simulations of Connected Vehicles: Proof of Concept,

    W. Xiong, F. Krantz, and R. Lagerström, “Threat Modeling and Attack Simulations of Connected Vehicles: Proof of Concept,” in Information Systems Security and Privacy, P. Mori, S. Furnell, and O. Camp, Eds., Cham: Springer International Publishing, 2020, pp. 272–287. doi: 10.10...

    2020 doi

  3. [11]

    ASATM: Automated security assistant of threat models in intelligent transportation systems,

    M. A. Ramazanzadeh, B. Barzegar, and H. Motameni, “ASATM: Automated security assistant of threat models in intelligent transportation systems,” IET Computers & Digital Techniques, vol. 16, no. 5–6, pp. 141–158, 2022, doi: 10.1049/cdt2.12045

    2022 doi

  4. [12]

    Threat Modeling - Perhaps It’s Time,

    J. Steven, “Threat Modeling - Perhaps It’s Time,” IEEE Security & Privacy, vol. 8, no. 3, pp. 83–86, May 2010, doi: 10.1109/MSP.2010.110

    2010 doi

  5. [13]

    MITRE ATT&CK®

    “MITRE ATT&CK®.” Accessed: Mar. 22, 2025. [Online]. Available: https://attack.mitre.org/

    2025

  6. [14]

    CVE: Common Vulnerabilities and Exposures

    “CVE: Common Vulnerabilities and Exposures.” Accessed: Jul. 11,

  7. [15]

    Known Exploited Vulnerabilities Catalog | CISA

    “Known Exploited Vulnerabilities Catalog | CISA.” Accessed: Jul. 11, 2025. [Online]. Available: https://www.cisa.gov/known- exploited-vulnerabilities-catalog

    2025

  8. [16]

    Available: https://www.cve.org/

    [Online]. Available: https://www.cve.org/

  9. [17]

    Threat modeling of industrial control systems: A systematic literature review,

    S. M. Khalil, H. Bahsi, and T. Korõtko, “Threat modeling of industrial control systems: A systematic literature review,” Computers & Security, vol. 136, p. 103543, Jan. 2024, doi: 10.1016/j.cose.2023.103543

    2024

  10. [18]

    CVSS v3.1 Specification Document,

    “CVSS v3.1 Specification Document,” FIRST — Forum of Incident Response and Security Teams. Accessed: Jul. 11, 2025. [Online]. Available: https://www.first.org/cvss/v3-1/specification-document

    2025

  11. [19]

    Systematic literature review of threat modeling and risk assessment in ship cybersecurity,

    M. Erbas, S. M. Khalil, and L. Tsiopoulos, “Systematic literature review of threat modeling and risk assessment in ship cybersecurity,” Ocean Engineering, vol. 306, p. 118059, Aug. 2024, doi: 10.1016/j.oceaneng.2024.118059

    2024

  12. [20]

    Threat Modeling and Assessment Methods in the Healthcare-IT System: A Critical Review and Systematic Evaluation,

    M. Aijaz, M. Nazir, and M. N. A. Mohammad, “Threat Modeling and Assessment Methods in the Healthcare-IT System: A Critical Review and Systematic Evaluation,” SN COMPUT. SCI., vol. 4, no. 6, p. 714, Sep. 2023, doi: 10.1007/s42979-023-02221-1

    2023 doi

  13. [21]

    Extensive Review of Threat Models for DevSecOps,

    S. Nagasundari, P. Manja, P. Mathur, and P. B. Honnavalli, “Extensive Review of Threat Models for DevSecOps,” IEEE Access, vol. 13, pp. 45252–45271, 2025, doi: 10.1109/ACCESS.2025.3547932

    2025

  14. [22]

    Threat Modeling for the Defense Industry: Past, Present, and Future,

    H. Cho and S. Kim, “Threat Modeling for the Defense Industry: Past, Present, and Future,” IEEE Access, vol. 13, pp. 53276–53304, 2025, doi: 10.1109/ACCESS.2025.3550337

    2025

  15. [23]

    Threat Modeling in Cloud Computing - A Literature Review,

    M. Kharma and A. Taweel, “Threat Modeling in Cloud Computing - A Literature Review,” in Ubiquitous Security, G. Wang, K.-K. R. Choo, J. Wu, and E. Damiani, Eds., Singapore: Springer Nature, 2023, pp. 279–291. doi: 10.1007/978-981-99-0272-9_19

    2023 doi

  16. [24]

    Machine-Generated Text: A Comprehensive Survey of Threat Models and Detection Methods,

    E. N. Crothers, N. Japkowicz, and H. L. Viktor, “Machine-Generated Text: A Comprehensive Survey of Threat Models and Detection Methods,” IEEE Access, vol. 11, pp. 70977–71002, 2023, doi: 10.1109/ACCESS.2023.3294090

    2023

  17. [25]

    Threat modeling for aviation computer security,

    A. O. Baquero, A. Kornecki, and J. Zalewski, “Threat modeling for aviation computer security,” crosstalk, vol. 28, no. 6, pp. 21–27, 2015. Algorithm 1 Single-Fold F1-Optimal Operating Points Selector Require: 𝑚𝑜𝑑𝑒𝑙_𝑜𝑢𝑡𝑝𝑢𝑡𝑠. 𝑝𝑟𝑜𝑏𝑠: 𝑁 × 𝑀 matrix of predicted probabilities from t...

    2015

  18. [26]

    An extensible pattern-based library and taxonomy of security threats for distributed systems,

    A. V. Uzunov and E. B. Fernandez, “An extensible pattern-based library and taxonomy of security threats for distributed systems,” Computer Standards & Interfaces, vol. 36, no. 4, pp. 734–747, Jun. 2014, doi: 10.1016/j.csi.2013.12.008

    2014 doi

  19. [27]

    On security development lifecycle: conceptual description of vulnerabilities, risks, and threats,

    S. Al-Fedaghi and A. Alkandari, “On security development lifecycle: conceptual description of vulnerabilities, risks, and threats,” International Journal of Digital Content Technology and its Applications, vol. 5, no. 5, pp. 296–306, 2011

    2011

  20. [28]

    Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix,

    W. Xiong, E. Legrand, O. Åberg, and R. Lagerström, “Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix,” Softw Syst Model, vol. 21, no. 1, pp. 157–177, Feb. 2022, doi: 10.1007/s10270-021-00898-7

    2022 doi

  21. [29]

    Threat Analysis and Risk Assessment for Connected Vehicles: A Survey,

    F. Luo, Y. Jiang, Z. Zhang, Y. Ren, and S. Hou, “Threat Analysis and Risk Assessment for Connected Vehicles: A Survey,” Security and Communication Networks, vol. 2021, no. 1, p. 1263820, 2021, doi: 10.1155/2021/1263820

    2021 doi

  22. [30]

    Demystifying the threat modeling process,

    P. Torr, “Demystifying the threat modeling process,” IEEE Security & Privacy, vol. 3, no. 5, pp. 66–70, Sep. 2005, doi: 10.1109/MSP.2005.119

    2005 doi

  23. [31]

    Microsoft Threat Modeling Tool overview - Azure

    “Microsoft Threat Modeling Tool overview - Azure.” Accessed: Mar. 18, 2025. [Online]. Available: https://learn.microsoft.com/en- us/azure/security/develop/threat-modeling-tool

    2025

  24. [32]

    Introduction to the OCTAVE® Approach,

    C. Alberts, A. Dorofee, J. Stevens, and C. Woody, “Introduction to the OCTAVE® Approach,” Carnegie Mellon Software Engineering Institute, Aug. 2003. Accessed: Apr. 03, 2025. [Online]. Available: https://insights.sei.cmu.edu/documents/16/2003_012_001_51556.pdf

    2003

  25. [33]

    UcedaVelez and M

    T. UcedaVelez and M. M. Morana, Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis | Wiley. Wiley,

  26. [34]

    A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements,

    M. Deng, K. Wuyts, R. Scandariato, B. Preneel, and W. Joosen, “A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements,” Requirements Eng, vol. 16, no. 1, pp. 3–32, Mar. 2011, doi: 10.1007/s00766-010-0115-7

    2011 doi

  27. [35]

    Attack trees,

    B. Schneier, “Attack trees,” Dr. Dobb’s journal, vol. 24, no. 12, pp. 21–29, 1999

    1999

  28. [36]

    DLTIF: Deep Learning-Driven Cyber Threat Intelligence Modeling and Identification Framework in IoT-Enabled Maritime Transportation Systems,

    P. Kumar, G. P. Gupta, R. Tripathi, S. Garg, and M. M. Hassan, “DLTIF: Deep Learning-Driven Cyber Threat Intelligence Modeling and Identification Framework in IoT-Enabled Maritime Transportation Systems,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 2,...

    2023

  29. [37]

    Threat modeling using attack trees,

    V. Saini, Q. Duan, and V. Paruchuri, “Threat modeling using attack trees,” Journal of Computing Sciences in Colleges, vol. 23, no. 4, pp. 124–131, 2008

    2008

  30. [38]

    Towards comprehensive threat modeling for vehicles,

    M. Hamad, M. Nolte, and V. Prevelakis, “Towards comprehensive threat modeling for vehicles,” presented at the the 1st Workshop on Security and Dependability of Critical Embedded Real-Time Systems, 2016, p. 31

    2016

  31. [39]

    Leveraging Multimodal Retrieval-Augmented Generation for Cyber Attack Detection in Transit Systems,

    M. B. Munir, Y. Cai, L. Khan, and B. Thuraisingham, “Leveraging Multimodal Retrieval-Augmented Generation for Cyber Attack Detection in Transit Systems,” in 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)...

    2024

  32. [40]

    Threat Modeling and Attack Simulation of Charging Infrastructures in Electric Vehicles,

    A. K. Subran, S. Sankaran, P. Sutraye, and A. K. Nishad, “Threat Modeling and Attack Simulation of Charging Infrastructures in Electric Vehicles,” in 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT), Jun. 2024, pp. 1–7. doi: 10...

    2024 arXiv

  33. [41]

    Automated Mapping of Common Vulnerabilities and Exposures to MITRE ATT&CK Tactics,

    I. Branescu, O. Grigorescu, and M. Dascalu, “Automated Mapping of Common Vulnerabilities and Exposures to MITRE ATT&CK Tactics,” Information, vol. 15, no. 4, Art. no. 4, Apr. 2024, doi: 10.3390/info15040214

    2024 doi

  34. [42]

    Labeling Network Intrusion Detection System (NIDS) Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language Models,

    D. Nir et al., “Labeling Network Intrusion Detection System (NIDS) Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language Models,” Big Data and Cognitive Computing, vol. 9, no. 2, p. 23, 2025, doi: 10.3390/bdcc9020023

    2025 doi

  35. [43]

    Using Natural Language Processing Tools to Infer Adversary Techniques and Tactics Under the Mitre ATT&CK Framework,

    R. Gabrys, M. Bilinski, S. Fugate, and D. Silva, “Using Natural Language Processing Tools to Infer Adversary Techniques and Tactics Under the Mitre ATT&CK Framework,” in 2024 IEEE 14th Annual Computing and Communication Workshop and Conference (CCWC), Jan. 2024, pp. 0541–0547....

    2024

  36. [44]

    Experiences Threat Modeling at Microsoft.,

    A. Shostack, “Experiences Threat Modeling at Microsoft.,” MODSEC@ MoDELS, vol. 2008, p. 35, 2008

    2008

  37. [45]

    Architecture Reference for Cooperative and Intelligent Transportation

    “Architecture Reference for Cooperative and Intelligent Transportation.” Accessed: Mar. 22, 2025. [Online]. Available: https://www.arc-it.net/index.html

    2025

  38. [46]

    Threats - Microsoft Threat Modeling Tool - Azure

    “Threats - Microsoft Threat Modeling Tool - Azure.” Accessed: Mar. 19, 2025. [Online]. Available: https://learn.microsoft.com/en- us/azure/security/develop/threat-modeling-tool-threats

    2025

  39. [47]

    Retrieval-Augmented Generation for Knowledge- Intensive NLP Tasks,

    P. Lewis et al., “Retrieval-Augmented Generation for Knowledge- Intensive NLP Tasks,” in Advances in Neural Information Processing Systems, Curran Associates, Inc., 2020, pp. 9459–9474. Accessed: Mar. 21, 2025. [Online]. Available: https://proceedings.neurips.cc/paper/2020/has...

    2020

  40. [48]

    GPT-4o System Card,

    OpenAI et al., “GPT-4o System Card,” Oct. 25, 2024, arXiv: arXiv:2410.21276. doi: 10.48550/arXiv.2410.21276

    2024 doi arXiv

  41. [49]

    NVD - Vulnerability Metrics

    “NVD - Vulnerability Metrics.” Accessed: Jul. 11, 2025. [Online]. Available: https://nvd.nist.gov/vuln-metrics/cvss

    2025

  42. [50]

    Simple Directory Reader - LlamaIndex v0.10.10

    “Simple Directory Reader - LlamaIndex v0.10.10.” Accessed: Mar. 26, 2025. [Online]. Available: https://llamaindexxx.readthedocs.io/en/latest/examples/data_connect ors/simple_directory_reader.html

    2025

  43. [51]

    Vector embeddings - OpenAI API

    “Vector embeddings - OpenAI API.” Accessed: Mar. 22, 2025. [Online]. Available: https://platform.openai.com

    2025

  44. [52]

    GPT-4 Technical Report,

    J. Achiam et al., “GPT-4 Technical Report,” Mar. 04, 2024, arXiv: arXiv:2303.08774. doi: 10.48550/arXiv.2303.08774

    2024 doi arXiv

  45. [53]

    VectorIndexRetriever,

    “VectorIndexRetriever,” LlamaIndex.TS. Accessed: Apr. 09, 2025. [Online]. Available: https://ts.llamaindex.ai/docs/api/classes/VectorIndexRetriever

    2025

  46. [54]

    Node Postprocessor Modules

    “Node Postprocessor Modules.” Accessed: Mar. 26, 2025. [Online]. Available: https://docs.llamaindex.ai/en/stable/module_guides/querying/node_p ostprocessors/node_postprocessors/

    2025

  47. [55]

    New embedding models and API updates

    “New embedding models and API updates.” Accessed: Mar. 25,

  48. [56]

    Available: https://openai.com/index/new-embedding- models-and-api-updates/

    [Online]. Available: https://openai.com/index/new-embedding- models-and-api-updates/

  49. [57]

    Creating a GPT | OpenAI Help Center

    “Creating a GPT | OpenAI Help Center.” Accessed: Mar. 23, 2025. [Online]. Available: https://help.openai.com/en/articles/8554397- creating-a-gpt

    2025

  50. [58]

    Prioritize Known Exploited Vulnerabilities,

    C. for T.-I. Defense, “Prioritize Known Exploited Vulnerabilities,” Center for Threat-Informed Defense. Accessed: Jul. 10, 2025. [Online]. Available: https://ctid.mitre.org/projects/prioritize-known- exploited-vulnerabilties/

    2025

  51. [59]

    Smarter, Better, Faster, Longer: A Modern Bidirectional Encoder for Fast, Memory Efficient, and Long Context Finetuning and Inference,

    B. Warner et al., “Smarter, Better, Faster, Longer: A Modern Bidirectional Encoder for Fast, Memory Efficient, and Long Context Finetuning and Inference,” Dec. 19, 2024, arXiv: arXiv:2412.13663. doi: 10.48550/arXiv.2412.13663

    2024 doi arXiv

  52. [60]

    Transformers

    “Transformers.” Accessed: Jul. 15, 2025. [Online]. Available: https://huggingface.co/docs/transformers/en/index

    2025

  53. [61]

    Electronic Clearance

    “Electronic Clearance.” Accessed: Mar. 24, 2025. [Online]. Available: https://www.arc- it.net/html/servicepackages/sp168.html#tab-3

    2025

  54. [62]

    Large Language Models Outperform Expert Coders and Supervised Classifiers at Annotating Political Social Media Messages,

    P. Törnberg, “Large Language Models Outperform Expert Coders and Supervised Classifiers at Annotating Political Social Media Messages,” Social Science Computer Review, p. 08944393241286471, Sep. 2024, doi: 10.1177/08944393241286471

    2024 doi

  55. [63]

    CVE Mapping Methodology - Mappings Explorer,

    “CVE Mapping Methodology - Mappings Explorer,” Mappings Explorer | The Center for Threat-Informed Defense. Accessed: Jul. 11, 2025. [Online]. Available: https://center-for-threat-informed- defense.github.io/mappings-explorer/

    2025

  56. [64]

    Known Exploited Vulnerabilities Landing - Mappings Explorer,

    “Known Exploited Vulnerabilities Landing - Mappings Explorer,” Mappings Explorer | The Center for Threat-Informed Defense. Accessed: Jul. 11, 2025. [Online]. Available: https://center-for- threat-informed-defense.github.io/mappings-explorer/

    2025

  57. [65]

    Hallucinations in LLMs: Understanding and Addressing Challenges,

    G. Perković, A. Drobnjak, and I. Botički, “Hallucinations in LLMs: Understanding and Addressing Challenges,” in 2024 47th MIPRO ICT and Electronics Convention (MIPRO), May 2024, pp. 2084–

    2024

  58. [66]

    Create Account, Technique T1136 - Enterprise | MITRE ATT&CK®

    “Create Account, Technique T1136 - Enterprise | MITRE ATT&CK®.” Accessed: Jul. 21, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1136/

    2025

  59. [67]

    Reproducibility — PyTorch 2.7 documentation

    “Reproducibility — PyTorch 2.7 documentation.” Accessed: Jul. 21,

  60. [68]

    Available: https://docs.pytorch.org/docs/stable/notes/randomness.html

    [Online]. Available: https://docs.pytorch.org/docs/stable/notes/randomness.html

  61. [69]

    TraCR-National-UTC, TraCR-TMF. (Jul. 21, 2025). Jupyter Notebook. Accessed: Jul. 21, 2025. [Online]. Available: https://github.com/TraCR-National-UTC/TraCR-TMF VOLUME XX, 2017

    2025

  62. [70]

    NVD - CVE-2021-44228

    “NVD - CVE-2021-44228.” Accessed: Jul. 11, 2025. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

    2021

  63. [71]

    DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks | CISA

    “DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks | CISA.” Accessed: Mar. 21,

  64. [72]

    Colonial Pipeline: The DarkSide Strikes,

    J. Chris and P. W. Parfomak, “Colonial Pipeline: The DarkSide Strikes,” Congressional Research Service, legislation, May 2011. Accessed: Mar. 21, 2025. [Online]. Available: https://www.congress.gov/crs-product/IN11667

    2011

  65. [73]

    Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®

    “Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®.” Accessed: Jul. 21, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1098/

    2025

  66. [74]

    Reversible Lane Management

    “Reversible Lane Management.” Accessed: Jul. 11, 2025. [Online]. Available: https://www.arc- it.net/html/servicepackages/sp134.html#tab-3

    2025

  67. [75]

    Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®

    “Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®.” Accessed: Jul. 11, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1190/

    2025

  68. [76]

    Unsecured Credentials, Technique T1552 - Enterprise | MITRE ATT&CK®

    “Unsecured Credentials, Technique T1552 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1552/

    2025

  69. [77]

    Command and Scripting Interpreter, Technique T1059 - Enterprise | MITRE ATT&CK®

    “Command and Scripting Interpreter, Technique T1059 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1059/

    2025

  70. [78]

    Available: https://www.cisa.gov/news- events/cybersecurity-advisories/aa21-131a

    [Online]. Available: https://www.cisa.gov/news- events/cybersecurity-advisories/aa21-131a

  71. [79]

    Network Sniffing, Technique T1040 - Enterprise | MITRE ATT&CK®

    “Network Sniffing, Technique T1040 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1040/

    2025

  72. [80]

    A Review of Colonial Pipeline Ransomware Attack,

    J. Beerman, D. Berent, Z. Falter, and S. Bhunia, “A Review of Colonial Pipeline Ransomware Attack,” in 2023 IEEE/ACM 23rd International Symposium on Cluster, Cloud and Internet Computing Workshops (CCGridW), May 2023, pp. 8–15. doi: 10.1109/CCGridW59191.2023.00017

    2023

  73. [81]

    Back to Basics: A Deeper Look at the Colonial Pipeline Hack,

    “Back to Basics: A Deeper Look at the Colonial Pipeline Hack,” GovTech. Accessed: Apr. 07, 2025. [Online]. Available: https://www.govtech.com/sponsored/back-to-basics-a-deeper-look- at-the-colonial-pipeline-hack

    2025

  74. [82]

    Purdue model framework for industrial control systems & cybersecurity segmentation,

    D. Garton, “Purdue model framework for industrial control systems & cybersecurity segmentation,” US Department of Energy, vol. 14, pp. 2022–10, 2022

    2022

  75. [83]

    Firmware Corruption, Technique T1495 - Enterprise | MITRE ATT&CK®

    “Firmware Corruption, Technique T1495 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1495/

    2025

  76. [84]

    Abuse Elevation Control Mechanism, Technique T1548 - Enterprise | MITRE ATT&CK®

    “Abuse Elevation Control Mechanism, Technique T1548 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1548/

    2025

  77. [85]

    Ingress Tool Transfer, Technique T1105 - Enterprise | MITRE ATT&CK®

    “Ingress Tool Transfer, Technique T1105 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1105/

    2025

  78. [86]

    The Rules of Redaction: Identify, Protect, Review (and Repeat),

    E. Bier, R. Chow, P. Golle, T. H. King, and J. Staddon, “The Rules of Redaction: Identify, Protect, Review (and Repeat),” IEEE Security & Privacy, vol. 7, no. 6, pp. 46–53, Nov. 2009, doi: 10.1109/MSP.2009.183

    2009 doi

  79. [87]

    Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK®

    “Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1557/

    2025

  80. [88]

    #StopRansomware: ALPHV Blackcat | CISA

    “#StopRansomware: ALPHV Blackcat | CISA.” Accessed: Apr. 07,

  81. [89]

    Available: https://www.cisa.gov/news- events/cybersecurity-advisories/aa23-353a

    [Online]. Available: https://www.cisa.gov/news- events/cybersecurity-advisories/aa23-353a

  82. [90]

    Data Manipulation, Technique T1565 - Enterprise | MITRE ATT&CK®

    “Data Manipulation, Technique T1565 - Enterprise | MITRE ATT&CK®.” Accessed: Apr. 07, 2025. [Online]. Available: https://attack.mitre.org/techniques/T1565/

    2025

  83. [93]

    Anonymization Techniques for Privacy Preserving Data Publishing: A Comprehensive Survey,

    A. Majeed and S. Lee, “Anonymization Techniques for Privacy Preserving Data Publishing: A Comprehensive Survey,” IEEE Access, vol. 9, pp. 8512–8545, 2021, doi: 10.1109/ACCESS.2020.3045700

    2021

  84. [95]

    Ma, makcedward/nlpaug

    E. Ma, makcedward/nlpaug. (Jul. 17, 2025). Jupyter Notebook. Accessed: Jul. 21, 2025. [Online]. Available: https://github.com/makcedward/nlpaug M Sabbir Salek (Member, IEEE) received his Ph.D. and M.S. in civil engineering from Clemson University, Clemson, SC, USA, in 2023 and...

    2025

  85. [2015]

    07, 2025

    Accessed: Apr. 07, 2025. [Online]. Available: https://www.wiley.com/en- us/Risk+Centric+Threat+Modeling%3A+Process+for+Attack+Simul ation+and+Threat+Analysis-p-9780470500965

    2025

  86. [2025]

    Available: https://sustainableworldports.org/wp- content/uploads/IAPH-Cybersecurity-Guidelines-version-1_0.pdf

    [Online]. Available: https://sustainableworldports.org/wp- content/uploads/IAPH-Cybersecurity-Guidelines-version-1_0.pdf

  87. [2088]

    doi: 10.1109/MIPRO60963.2024.10569238

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.