Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/ ZENODOarrow_drop_down
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Preprint . 2026
License: CC BY
Data sources: ZENODO
ZENODO
Preprint . 2026
License: CC BY
Data sources: Datacite
ZENODO
Preprint . 2026
License: CC BY
Data sources: Datacite
versions View all 2 versions
addClaim

Blackboard SA: Operationalizing LLM Knowledge Source Specialization for Cyber Situational Awareness

Authors: Bass, Tim;

Blackboard SA: Operationalizing LLM Knowledge Source Specialization for Cyber Situational Awareness

Abstract

This paper presents Blackboard SA, an applied Situation Awareness (SA) architecture that operationalizes LLM Knowledge Sources (KS) via KS specialization, deterministic pre-filters, and per-KS observability. Rather than relying on a single model for all reasoning tasks, Blackboard SA assigns distinct pipeline responsibilities to specialized KS: normalization, proposal, critique, verification, and correlation, each with independent provider and model configuration and fallback behavior. The central engineering challenge addressed is not real-time detection performance per se, but rather enhancing SA via specialized LLM reasoning within a structured pipeline: how to constrain LLM model influence, recover gracefully from LLM API provider failures and refine specialized KS LLM prompting. This paper describes the architecture, implementation, and operational controls in a production-like web environment, including queue isolation, KS toggles, fallback LLM routing, and an explicit operator control panel. Operational findings are consistent with the hypothesis that KS specialization improves situation awareness relative to monolithic LLM prompting in our deployment setting, and that deterministic non-LLM constraints are essential for production stability. The contribution is an end-to-end, inspectable SA pipeline that is configurable, reasonably LLM API fault-tolerant, and suitable for iterative applied research and practitioner deployment.

Keywords

artificial intelligence, cybersecurity, situation awareness, cyber situational awareness, multi-sensor data fusion, blackboard architecture, knowledge sources, large language models, multi-agent systems, intrusion detection

  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
0
Average
Average
Average