
This paper presents Blackboard SA, an applied Situation Awareness (SA) architecture that operationalizes LLM Knowledge Sources (KS) via KS specialization, deterministic pre-filters, and per-KS observability. Rather than relying on a single model for all reasoning tasks, Blackboard SA assigns distinct pipeline responsibilities to specialized KS: normalization, proposal, critique, verification, and correlation, each with independent provider and model configuration and fallback behavior. The central engineering challenge addressed is not real-time detection performance per se, but rather enhancing SA via specialized LLM reasoning within a structured pipeline: how to constrain LLM model influence, recover gracefully from LLM API provider failures and refine specialized KS LLM prompting. This paper describes the architecture, implementation, and operational controls in a production-like web environment, including queue isolation, KS toggles, fallback LLM routing, and an explicit operator control panel. Operational findings are consistent with the hypothesis that KS specialization improves situation awareness relative to monolithic LLM prompting in our deployment setting, and that deterministic non-LLM constraints are essential for production stability. The contribution is an end-to-end, inspectable SA pipeline that is configurable, reasonably LLM API fault-tolerant, and suitable for iterative applied research and practitioner deployment.
artificial intelligence, cybersecurity, situation awareness, cyber situational awareness, multi-sensor data fusion, blackboard architecture, knowledge sources, large language models, multi-agent systems, intrusion detection
artificial intelligence, cybersecurity, situation awareness, cyber situational awareness, multi-sensor data fusion, blackboard architecture, knowledge sources, large language models, multi-agent systems, intrusion detection
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
