Large Language Models for System Security Engineering Analysis

Large Language Models for System Security Engineering Analysis is sponsored by Department of Defense (DOD). Supports the development of large language models to identify vulnerabilities in weapon systems and other embedded systems.

Large Language Models for System Security Engineering Analysis – Army SBIR|STTR Program Artificial Intelligence/Machine Learning, Army SBIR, Phase I Large Language Models for System Security Engineering Analysis Application Due Date: 01/08/2025 The proposed topic will develop a Large Language Model (LLM) tailored to reduce the risk of traditional and emerging Artificial Intelligence (AI) and Machine Learning (ML) adversarial attacks on aviation and missile systems.

The proposed LLM will assist “blue” and adversarial assessment teams with vulnerability identification and exploitation modeling. Outputs from the LLM will be utilized as inputs to US Army DEVCOM AvMC “blue” team activities and inputs to designated DoD red teams. The LLM prototype will identify vulnerabilities and create proof-of-concept exploits in a threat intelligence-informed environment.

The primary problem this topic addresses is the growing complexity of traditional and AI/ML-based cybersecurity threats to DoD weapon systems, increasingly connected and automated weapon systems architectures, and the need for advanced tools to enhance development-phase cyber resiliency efforts and exploit modeling.

This topic is essential because it will improve US DoD aviation and missile platforms’ resilience, survivability, and lethality through the enhanced identification and exploitation modeling of system vulnerabilities during system development. This will achieve significant impact in the most cost-effective phase of the system lifecycle.

The proposed approach leverages state-of-the-art LLMs to develop a specialized tool for system security engineering risk reduction efforts (blue team and AAMCATs) and provides critical exploitation inputs to DoD-approved red team operations. This topic innovates on existing technology by fine-tuning a foundational LLM built to analyze complex weapon system codebases, identify vulnerabilities, and generate proof-of-concept exploits.

This approach combines natural language processing and code analysis capabilities, creating a powerful tool that surpasses current manual and automated analysis methods.

The proposed LLM will be trained on the large amounts of relevant data available to DEVCOM AvMC including code, network traffic, static and dynamic analysis results, external software code bases and malicious software examples, and threat intelligence from partner US Government organizations.

The LLM will be integrated with AvMC software and hardware integration labs to provide further tuning and address the issue of run-time analysis when software code is unavailable to the cyber resiliency team. This topic is only accepting Phase I proposals for a cost up to $250,000 for a 6-month period of performance.

Technical Feasibility Study of the proposed LLM including data and technical requirements, cost, and acquisition plans/schedule. The final Study whitepaper milestone is due six months after the start of the project. Interim milestones include Data Identification, Sufficiency, and Access (2 months), Weapon System Prototype Identification (3 months), Interim Model Selection/Strategy (4 months), and Resource Identification (5 months).

At the end of Phase I, the Army will require the company to provide a concept demonstration of their technology to demonstrate a high probability that continued design and development will result in a Phase II mature product.

Prototype-scale model training and deployment in a controlled environment that identifies defined vulnerabilities and generates representative proof of concept exploits of a selected aviation or missile weapon system (24 months).

Interim milestones will validate or inform the project development team to include a Concept Review in month 6 (design concept approval), a Preliminary Design Review (PDR) in month 10 (review of preliminary design and datasets), an Intermediate Design Review (IDR) in month 14 (approval to proceed to model development/training), a Training Review in month 19 (approval for full-scale training), and a Critical Design Review (CDR) at month 22 (review fully trained model/results).

Monthly status reports will inform progress toward milestone and objective achievement. Implementation of the developed LLM can be used as a resource to design systems and identify security flaws for commercial, academic, and research use cases. The model potentially scales when trained with commercial data.

Financial Services: As the biggest buyer of cybersecurity software and services, financial services and Wall Street will be a big market segment for these systems. eCommerce: Protect systems that use AI/ML, like Amazon, from malicious actors. Manufacturing: As digital engineering continues to proliferate, manufacturing will need AI/ML vector analysis.

Healthcare: Similar to the proliferation of AI in other sectors, healthcare contains very sensitive data that requires state-of-the-art AI/ML cybersecurity. Energy & Utilities: Again, similar to the above sectors, it requires AI/ML cybersecurity. For more information, and to submit your full proposal package, visit the DSIP Portal .

SBIR|STTR Help Desk: usarmy. sbirsttr@army. mil Meta, “Code Llama,” accessed September 5, 2024, https://llama.

meta. com/code-llama/ Richard Fang, Rohan Bindu, Akul Gupta, Daniel Kang, “LLM Agents can Autonomously Exploit One-day Vulnerabilities,” https://arxiv. org/pdf/2404.

08144 Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, Daniel Kang, “Teams of LLM Agents can Exploit Zero-Day Vulnerabilities,”, https://ar5iv. labs. arxiv.

org/html/2406. 01637v1 KEYWORDS: Large Language Model; Cyber Security; System Security Engineering; Embedded Systems; Retrieval Augmented Generation The proposed topic will develop a Large Language Model (LLM) tailored to reduce the risk of traditional and emerging Artificial Intelligence (AI) and Machine Learning (ML) adversarial attacks on aviation and missile systems.

The proposed LLM will assist “blue” and adversarial assessment teams with vulnerability identification and exploitation modeling. Outputs from the LLM will be utilized as inputs to US Army DEVCOM AvMC “blue” team activities and inputs to designated DoD red teams. The LLM prototype will identify vulnerabilities and create proof-of-concept exploits in a threat intelligence-informed environment.

The primary problem this topic addresses is the growing complexity of traditional and AI/ML-based cybersecurity threats to DoD weapon systems, increasingly connected and automated weapon systems architectures, and the need for advanced tools to enhance development-phase cyber resiliency efforts and exploit modeling.

This topic is essential because it will improve US DoD aviation and missile platforms’ resilience, survivability, and lethality through the enhanced identification and exploitation modeling of system vulnerabilities during system development. This will achieve significant impact in the most cost-effective phase of the system lifecycle.

The proposed approach leverages state-of-the-art LLMs to develop a specialized tool for system security engineering risk reduction efforts (blue team and AAMCATs) and provides critical exploitation inputs to DoD-approved red team operations. This topic innovates on existing technology by fine-tuning a foundational LLM built to analyze complex weapon system codebases, identify vulnerabilities, and generate proof-of-concept exploits.

This approach combines natural language processing and code analysis capabilities, creating a powerful tool that surpasses current manual and automated analysis methods.

The proposed LLM will be trained on the large amounts of relevant data available to DEVCOM AvMC including code, network traffic, static and dynamic analysis results, external software code bases and malicious software examples, and threat intelligence from partner US Government organizations.

The LLM will be integrated with AvMC software and hardware integration labs to provide further tuning and address the issue of run-time analysis when software code is unavailable to the cyber resiliency team. This topic is only accepting Phase I proposals for a cost up to $250,000 for a 6-month period of performance.

Technical Feasibility Study of the proposed LLM including data and technical requirements, cost, and acquisition plans/schedule. The final Study whitepaper milestone is due six months after the start of the project. Interim milestones include Data Identification, Sufficiency, and Access (2 months), Weapon System Prototype Identification (3 months), Interim Model Selection/Strategy (4 months), and Resource Identification (5 months).

At the end of Phase I, the Army will require the company to provide a concept demonstration of their technology to demonstrate a high probability that continued design and development will result in a Phase II mature product.

Prototype-scale model training and deployment in a controlled environment that identifies defined vulnerabilities and generates representative proof of concept exploits of a selected aviation or missile weapon system (24 months).

Interim milestones will validate or inform the project development team to include a Concept Review in month 6 (design concept approval), a Preliminary Design Review (PDR) in month 10 (review of preliminary design and datasets), an Intermediate Design Review (IDR) in month 14 (approval to proceed to model development/training), a Training Review in month 19 (approval for full-scale training), and a Critical Design Review (CDR) at month 22 (review fully trained model/results).

Monthly status reports will inform progress toward milestone and objective achievement. Implementation of the developed LLM can be used as a resource to design systems and identify security flaws for commercial, academic, and research use cases. The model potentially scales when trained with commercial data.

Financial Services: As the biggest buyer of cybersecurity software and services, financial services and Wall Street will be a big market segment for these systems. eCommerce: Protect systems that use AI/ML, like Amazon, from malicious actors. Manufacturing: As digital engineering continues to proliferate, manufacturing will need AI/ML vector analysis.

Healthcare: Similar to the proliferation of AI in other sectors, healthcare contains very sensitive data that requires state-of-the-art AI/ML cybersecurity. Energy & Utilities: Again, similar to the above sectors, it requires AI/ML cybersecurity. For more information, and to submit your full proposal package, visit the DSIP Portal .

SBIR|STTR Help Desk: usarmy. sbirsttr@army. mil Meta, “Code Llama,” accessed September 5, 2024, https://llama.

meta. com/code-llama/ Richard Fang, Rohan Bindu, Akul Gupta, Daniel Kang, “LLM Agents can Autonomously Exploit One-day Vulnerabilities,” https://arxiv. org/pdf/2404.

08144 Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, Daniel Kang, “Teams of LLM Agents can Exploit Zero-Day Vulnerabilities,”, https://ar5iv. labs. arxiv.

org/html/2406. 01637v1 KEYWORDS: Large Language Model; Cyber Security; System Security Engineering; Embedded Systems; Retrieval Augmented Generation Assistant Secretary of the Army for Acquisition, Logistics, and Technology ASA(ALT) releases contract opportunities on an ad-hoc basis to meet Army research and development needs.

Army Futures Command (AFC) releases topics during three specific solicitation periods throughout the fiscal year to address the Army’s current and anticipated war-fighting technology needs. Army STTR follows AFC’s topic release schedule but partners with a university, federally funded research and development center, or a qualified non-profit research institution as part of their contract.

Is the opportunity to establish the scientific, technical, commercial merit and feasibility of your proposed innovation. Is focused on the development, demonstration and delivery of your innovation from Phase I. Represents the commercialization phase of the program in which the company can market their products or services developed in Phase II, either to the government or in the commercial sector.

Allows small businesses to submit to Direct to Phase II applications if they performed the Phase I research through other funding sources. Provides funding to projects that require additional funding during their open Phase II contract. A Phase II Awardee may receive one additional, sequential Phase II award to continue the work of an initial Phase II award.

The sequential Phase II award has the same guideline amounts and limits as an initial Phase II award.

Artificial Intelligence/Machine Learning (supply chain management, logistics coordination, target identifications and simulation) Advanced Materials and Manufacturing (additive manufacturing) Autonomy (unmanned systems, drones, ground vehicle capabilities) Chemical and Biological (detection, defense) Cyber (biometric authentication, secure communications) Electronics (microelectronics, Very-Large-Scale Integration (VLSI)) Electronic Warfare (jamming, spoofing) Human Performance (wearables) Immersive (augmented reality, virtual reality, mixed reality) Network Technologies (antennas, radio frequency, communications systems) Position, Navigation, and Timing (GPS) Power (batteries, generators) Software Modernization (high performance computing, data management and visualization) Sensors (infrared sensing) Weapons Systems (hypersonics, munitions and projectiles, directed energy)