Towards the Development of an LLM-Based Methodology for Automated Security Profiling in Compliance with Ukrainian Cybersecurity Regulations

• URL: http://arxiv.org/abs/2604.06274v1
• Date: Tue, 07 Apr 2026 07:29:58 GMT
• Title: Towards the Development of an LLM-Based Methodology for Automated Security Profiling in Compliance with Ukrainian Cybersecurity Regulations
• Abstract summary: This paper explores the integration of international best practices, specifically ISO/IEC and the NIST Cybersecurity Framework, into national regulatory systems.<n>A focus is placed on the transition from traditional compliance models to risk-based approaches.<n>We propose a methodology for automating the development of target security profiles using Large Language Models (LLMs) enhanced by RetrievalAugmented Generation (RAG)
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: In recent years, the pace of development of information technology in various areas has increased drastically, forcing cybersecurity specialists to constantly review existing processes in order to prevent unauthorized access to confidential information. Using Ukraine as a primary case study, this paper explores the integration of international best practices, specifically ISO/IEC 27001 and the NIST Cybersecurity Framework, into national regulatory systems. A focus is placed on the transition from traditional compliance models to risk-based approaches, exemplified by the recent adoption of the Ukrainian normative documents. Furthermore, we propose a methodology for automating the development of target security profiles using Large Language Models (LLMs) enhanced by RetrievalAugmented Generation (RAG). By integrating a vector database of national regulations and organizational policies, the proposed RAG-based advisor reduces manual complexity, minimizes human error, and ensures alignment between technical controls and legal requirements. This study contributes to the field by providing a structured workflow for AI-assisted cybersecurity management in environments characterized by high-intensity hybrid threats.

Related papers

• Security, privacy, and agentic AI in a regulatory view: From definitions and distinctions to provisions and reflections [53.468443050795344]
  The rapid proliferation of artificial intelligence (AI) technologies has led to a dynamic regulatory landscape.<n>As AI paradigms shift towards greater autonomy, specifically in the form of agentic AI, it becomes increasingly challenging to articulate regulatory stipulations.<n>This paper reviews the evolving European Union (EU) AI regulatory provisions via analyzing 24 relevant documents published between 2024 and 2025.
  arXiv  Detail & Related papers  (2026-03-19T13:50:52Z)
• International AI Safety Report 2025: Second Key Update: Technical Safeguards and Risk Management [115.92752850425272]
  Second update to the 2025 International AI Safety Report assesses new developments in general-purpose AI risk management over the past year.<n> examines how researchers, public institutions, and AI developers are approaching risk management for general-purpose AI.
  arXiv  Detail & Related papers  (2025-11-25T03:12:56Z)
• A Proactive Insider Threat Management Framework Using Explainable Machine Learning [0.14323566945483496]
  This study proposes the Insider Threat Explainable Machine Learning (IT-XML) framework to enhance proactive insider threat management.<n>A quantitative approach is adopted using an online questionnaire to assess employees' knowledge of insider threat patterns.<n>The framework classified all organisations at the developing security maturity level with 97-98% confidence and achieved a classification accuracy of 91.7%.
  arXiv  Detail & Related papers  (2025-10-22T14:08:38Z)
• Incorporating AI Incident Reporting into Telecommunications Law and Policy: Insights from India [0.6875312133832078]
  This paper introduces a precise definition and a detailed typology of telecommunications AI incidents.<n>It argues for their recognition as a distinct regulatory concern.<n>The paper proposes policy recommendations centered on integrating AI incident reporting into India's existing telecom governance.
  arXiv  Detail & Related papers  (2025-09-11T14:50:41Z)
• Organizational Adaptation to Generative AI in Cybersecurity: A Systematic Review [0.0]
  This research employs systematic document analysis and comparative case study methodology to examine how cybersecurity organizations adapt their threat modeling frameworks and operational processes to address generative artificial intelligence integration.<n>The research identifies three primary adaptation patterns: Large Language Model integration for security applications, GenAI frameworks for risk detection and response automation, and AI/ML integration for threat hunting.<n> Organizations with mature security infrastructures, particularly in finance and critical infrastructure sectors, demonstrate higher readiness through structured governance approaches, dedicated AI teams, and robust incident response processes.
  arXiv  Detail & Related papers  (2025-05-31T18:16:11Z)
• Mitigating Cyber Risk in the Age of Open-Weight LLMs: Policy Gaps and Technical Realities [0.0]
  Open-weight general-purpose AI (GPAI) models offer significant benefits but also introduce substantial cybersecurity risks.<n>This paper analyzes the specific threats -- including accelerated malware development and enhanced social engineering -- magnified by open-weight AI release.<n>We propose a path forward focusing on evaluating and controlling specific high-risk capabilities rather than entire models.
  arXiv  Detail & Related papers  (2025-05-21T11:35:52Z)
• In-House Evaluation Is Not Enough: Towards Robust Third-Party Flaw Disclosure for General-Purpose AI [93.33036653316591]
  We call for three interventions to advance system safety.<n>First, we propose using standardized AI flaw reports and rules of engagement for researchers.<n>Second, we propose GPAI system providers adopt broadly-scoped flaw disclosure programs.<n>Third, we advocate for the development of improved infrastructure to coordinate distribution of flaw reports.
  arXiv  Detail & Related papers  (2025-03-21T05:09:46Z)
• AILuminate: Introducing v1.0 of the AI Risk and Reliability Benchmark from MLCommons [62.374792825813394]
  This paper introduces AILuminate v1.0, the first comprehensive industry-standard benchmark for assessing AI-product risk and reliability.<n>The benchmark evaluates an AI system's resistance to prompts designed to elicit dangerous, illegal, or undesirable behavior in 12 hazard categories.
  arXiv  Detail & Related papers  (2025-02-19T05:58:52Z)
• Securing the AI Frontier: Urgent Ethical and Regulatory Imperatives for AI-Driven Cybersecurity [0.0]
  This paper critically examines the evolving ethical and regulatory challenges posed by the integration of artificial intelligence in cybersecurity.<n>We trace the historical development of AI regulation, highlighting major milestones from theoretical discussions in the 1940s to the implementation of recent global frameworks such as the European Union AI Act.<n>Ethical concerns such as bias, transparency, accountability, privacy, and human oversight are explored in depth, along with their implications for AI-driven cybersecurity systems.
  arXiv  Detail & Related papers  (2025-01-15T18:17:37Z)
• Position: Mind the Gap-the Growing Disconnect Between Established Vulnerability Disclosure and AI Security [56.219994752894294]
  We argue that adapting existing processes for AI security reporting is doomed to fail due to fundamental shortcomings for the distinctive characteristics of AI systems.<n>Based on our proposal to address these shortcomings, we discuss an approach to AI security reporting and how the new AI paradigm, AI agents, will further reinforce the need for specialized AI security incident reporting advancements.
  arXiv  Detail & Related papers  (2024-12-19T13:50:26Z)
• The risks of risk-based AI regulation: taking liability seriously [46.90451304069951]
  The development and regulation of AI seems to have reached a critical stage. Some experts are calling for a moratorium on the training of AI systems more powerful than GPT-4. This paper analyses the most advanced legal proposal, the European Union's AI Act.
  arXiv  Detail & Related papers  (2023-11-03T12:51:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.