Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study explores the use of large language models (LLMs) to facilitate the elicitation of security requirements for service-oriented cyber ranges, a process traditionally fraught with complexity and time demands. By employing a SEBoK-guided approach, the authors prompted five LLMs with security mission objectives and architectural guidelines, resulting in the generation of 84 security requirements, which were distilled into 27 comprehensive requirements. The evaluation by cybersecurity experts revealed a high acceptance rate for necessity, clarity, and completeness, although testability was notably lower, suggesting that while LLMs can enhance the initial stages of requirement elicitation, human oversight remains essential for refinement.
LLMs can generate security requirements with up to 98.5% acceptance on necessity, revolutionizing how we approach security in complex cyber environments.
Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range (SOR) is no exception, particularly when it comes to training scenarios targeting critical infrastructure. Security concerns are translated into security requirements, the elicitation of which is usually difficult and time-consuming. This work examines how large language models can assist in eliciting security requirements for a service-oriented range and help produce a useful baseline for designers and developers. The approach follows a SEBoK-guided process in which security mission objectives and stakeholder needs were first identified and then provided as a prompt context along with architectural guidelines to five LLMs: GPT-5.2, Gemini 3.1 Pro, Grok 4.1, Sonar, and Kimi K2.5. The models generated 84 security requirements in total, which were consolidated into a comprehensive set of 27 requirements and then mapped to the architectural layers of the service-oriented range. The final set was evaluated by five cybersecurity experts against the criteria of necessity, clarity, completeness, feasibility, and testability, with an additional rejection option. The results showed a high acceptance rate, specifically for necessity with 98.5%, clarity with 87.4%, completeness with 85.2%, feasibility with 78.5%, and rejection with 0.7%. Testability was lower at 44.4%, indicating a slight lack of information on how these requirements could be tested. These findings show that LLMs can support early stages of the elicitation of security requirements, although human review is still needed, especially to improve or adjust certain aspects of the requirements.