AI-Aided STPA-Sec for Managing Cyber Security in Industrial Plants – An Ontological Approach

The fourth industrial revolution led to the increasing adoption of cyber-physical systems (CPSs), where both physical and digital elements coexist, raising new joint safety and cyber security concerns. Recognizing the need for a systemic perspective, this paper applies the System-Theoretic Process Analysis for Security (STPA-Sec) – a method related to the System-Theoretic Accident Model and Processes (STAMP) – to manage safety and cyber security in an industrial plant. Despite its relevance, its usability demands for a challenging balance of methodological rigor and domain knowledge. To bridge this gap, this paper addresses the integration of Artificial Intelligence (AI) within STPA-Sec, by means of an AI assistant, built on GPT-4, and supported by an ontology model, to propose unsafe control actions (UCAs) and loss scenarios based on the STAMP model data. The paper shows the potential of the solution to enhance the collaboration between analysts with different areas of expertise, supporting the conduction of the STPA.