I'm Majid Mollaeefar

Ph.D. Cybersecurity Posture
University of Genova, Genova, Italy
Nov 2018 - Nov 2022

Dissertation: “Automating the Quantification and Mitigation of Risks for Multiple Stakeholders” (pdf)

Advisor: Prof. Silvio Ranise

AutoSecGPT

Description: AutoSecGPT is an AI-powered tool designed to help teams produce better threat models for their automotive applications. Aligned with the ISO/SAE 21434 standard, AutoSecGPT supports security teams by facilitating the entire cybersecurity engineering process—from threat identification to risk assessment. The ISO/SAE 21434 standard emphasizes the importance of identifying and assessing cybersecurity risks to anticipate and prepare for potential attack scenarios. Threat modeling, a critical activity in the software development lifecycle, is often overlooked or poorly executed, and the AutoSecGPT objective is to address this gap. Some features of the tool are:

• Works with different LLMs such as OpenAI to analyze threat scenarios
• Identify security threats specific to automotive systems
• Generate detailed threat scenarios and descriptions to facilitate risk understanding
• Visualize threat scenarios through attack graphs, enabling users to better understand threat causes
• Conduct likelihood and impact assessments to prioritize threats and propose mitigation controls
• Supports Threat Analysis and Risk Assessment (TARA) as per ISO/SAE 21434

Program Language: Python, Javascript, HTML

Access: Publicly available. Link . For a detailed demonstration of the tool watch the Demo

PILLAR

Description: PILLAR (Privacy risk Identification with LINDDUN and LLM Analysis Report) is an AI-powered tool developed to automate and enhance privacy threat modeling. Built on the LINDDUN framework, PILLAR leverages Large Language Models (LLMs) to automatically generate Data Flow Diagrams (DFDs), identify privacy threats, and prioritize risks. PILLAR is especially useful for industries dealing with sensitive data and needing to comply with regulations such as GDPR. By simplifying privacy threat modeling, PILLAR ensures that organizations can efficiently identify, mitigate, and manage privacy risks throughout the system development lifecycle. Key features include:

• Automates privacy threat modeling using LINDDUN and LLMs
• Generates DFDs from natural language descriptions
• Simulates multi-agent collaboration for more comprehensive threat analysis
• Assesses the impact of identified privacy threats and suggests control measures based on the privacy patterns
• Generates a comprehensive Report on the privacy threat modeling of the application

Program Language: Python

Access: Publicly available. GitHub Link . Try it out at this Website.

Multi-Stakeholder Risk Assessment Tool

Description: It is a risk assessment tool that enables risk analysts to perform a risk evaluation in a multi-stakeholder manner for a given system. The tool has a two-fold purpose:

• Evaluate and quantify risk levels for all involved stakeholders
• Solving the risk minimization problem, which is a multi-objective optimization problem

Program Language: This tool is written in Java and partially in Scala, it works with JSON files, all inputs and outputs.

Access: Publicly available. Link

Privacy Assessment GPT

Description: It is an AI-powered tool aiming to support privacy threat modeling and risk assessment by leveraging LLMs. Some features of the tool are:

• Works with different LLMs such as Open AI and Mistral
• Identify privacy threats based on LINDDUN threat categories together with potential consequences
• Generate threat scenarios and propose controls for the identified threats
• Generate different mitigation levels and interact the user for risk assessment in the form of generating a questionnaire
• and many more

Program Language: Python.

Access: Not publicly available yet. It is an ongoing project and if you are intersted, please contact me for more details .