Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Decoding BACnet Packets: A Large Language Model Approach for Packet Interpretation

Rashi Sharma, Hiroyuki Okada, Tatsumi Oba, Karthikk Subramanian, Naoto Yanai, Sugiri Pranata

TL;DR

The paper tackles the challenge of explaining ICS BACnet traffic to SOC analysts by generating readable per-packet summaries. It introduces a Retrieval-Augmented Generation (RAG) pipeline that preprocesses BACnet packets, maps device information, and fuses service-database context with FAISS-based retrieval to condition an LLM-generated packet summary. Key contributions include the end-to-end architecture, dual-context extraction (service and RAG), and empirical evaluation via human judgments showing improved informativeness with preserved accuracy. The work enables faster triage, better analyst training, and clearer reporting, with potential to extend beyond BACnet to other ICS protocols and to incorporate IDS-related context.

Abstract

The Industrial Control System (ICS) environment encompasses a wide range of intricate communication protocols, posing substantial challenges for Security Operations Center (SOC) analysts tasked with monitoring, interpreting, and addressing network activities and security incidents. Conventional monitoring tools and techniques often struggle to provide a clear understanding of the nature and intent of ICS-specific communications. To enhance comprehension, we propose a software solution powered by a Large Language Model (LLM). This solution currently focused on BACnet protocol, processes a packet file data and extracts context by using a mapping database, and contemporary context retrieval methods for Retrieval Augmented Generation (RAG). The processed packet information, combined with the extracted context, serves as input to the LLM, which generates a concise packet file summary for the user. The software delivers a clear, coherent, and easily understandable summary of network activities, enabling SOC analysts to better assess the current state of the control system.

Decoding BACnet Packets: A Large Language Model Approach for Packet Interpretation

TL;DR

The paper tackles the challenge of explaining ICS BACnet traffic to SOC analysts by generating readable per-packet summaries. It introduces a Retrieval-Augmented Generation (RAG) pipeline that preprocesses BACnet packets, maps device information, and fuses service-database context with FAISS-based retrieval to condition an LLM-generated packet summary. Key contributions include the end-to-end architecture, dual-context extraction (service and RAG), and empirical evaluation via human judgments showing improved informativeness with preserved accuracy. The work enables faster triage, better analyst training, and clearer reporting, with potential to extend beyond BACnet to other ICS protocols and to incorporate IDS-related context.

Abstract

The Industrial Control System (ICS) environment encompasses a wide range of intricate communication protocols, posing substantial challenges for Security Operations Center (SOC) analysts tasked with monitoring, interpreting, and addressing network activities and security incidents. Conventional monitoring tools and techniques often struggle to provide a clear understanding of the nature and intent of ICS-specific communications. To enhance comprehension, we propose a software solution powered by a Large Language Model (LLM). This solution currently focused on BACnet protocol, processes a packet file data and extracts context by using a mapping database, and contemporary context retrieval methods for Retrieval Augmented Generation (RAG). The processed packet information, combined with the extracted context, serves as input to the LLM, which generates a concise packet file summary for the user. The software delivers a clear, coherent, and easily understandable summary of network activities, enabling SOC analysts to better assess the current state of the control system.
Paper Structure (18 sections, 4 figures, 1 table)

This paper contains 18 sections, 4 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background
  3. Large Language Models
  4. RAG (Retrieval-Augmented Generation)
  5. Related Work
  6. Problem Statement
  7. Proposed Solution
  8. Packet Data Preprocessing
  9. Mapping of Device Information
  10. Context Extraction
  11. Service Database Context Extraction
  12. RAG-based Context Extraction
  13. Summary Generation
  14. Experiments and Results
  15. Evaluation
  16. ...and 3 more sections

Figures (4)

  • Figure 1: RAG Flow
  • Figure 2: Proposed Solution Architecture
  • Figure 3: Mapping device information for all packets in packet file
  • Figure 4: Context extraction for each packet of packet file with two packets