@misc{WeberSteinPilgermannetal.2023, author = {Weber, Simon and Stein, Stefan and Pilgermann, Michael and Schrader, Thomas}, title = {Attack Detection for Medical Cyber- Physical Systems - The Visualization}, doi = {10.25933/opus4-2914}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:522-opus4-29142}, year = {2023}, abstract = {Attack Detection for Medical Cyber-Physical Systems - The Visualization}, language = {en} } @techreport{WeberPilgermannSteinetal.2024, author = {Weber, Simon and Pilgermann, Michael and Stein, Stefan and Schrader, Thomas}, title = {SzA4Hosp - Systeme zur Angriffserkennung in der Medizinischen Versorgung}, organization = {Technische Hochschule Brandenburg}, doi = {10.25933/opus4-3207}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:522-opus4-32075}, pages = {85}, year = {2024}, abstract = {Dieser Abschlussbericht stellt das Ergebnis der Projektarbeit {\"u}ber die Implementierung von Systemen zur Angriffserkennung (SzA) in deutschen Krankenh{\"a}usern im Kontext des IT-Sicherheitsgesetzes 2.0 und des branchenspezifischen Sicherheitsstandards (B3S) f{\"u}r die medizinische Versorgung dar. Ziel des Projekts war es, den aktuellen Umsetzungsstand von SzA in deutschen Krankenh{\"a}usern zu analysieren und Handlungsempfehlungen f{\"u}r die Weiterentwicklung des B3S zu erarbeiten. Die Analyse basiert auf einer umfangreichen Befragung von Krankenhausbetreibern, Expertengespr{\"a}chen sowie der Auswertung relevanter nationaler und internationaler Standards und Good Practices. Die Ergebnisse zeigen deutliche Unterschiede im Reifegrad der SzA-Implementierung zwischen verschiedenen Bereichen, wobei die Informationstechnik branchenweit am fortgeschrittensten ist. Der Bericht bietet konkrete Vorschl{\"a}ge zur Verbesserung der IT-Sicherheitslage in Krankenh{\"a}usern und betont die Notwendigkeit kontinuierlicher Weiterentwicklungen der SzA-Systeme, um den steigenden Anforderungen der IT-Sicherheit in der station{\"a}ren Versorgung gerecht zu werden.}, subject = {Computersicherheit}, language = {de} } @article{SteinPilgermannWeberetal.2025, author = {Stein, Stefan and Pilgermann, Michael and Weber, Simon and Sedlmayr, Martin}, title = {Leveraging MDS2 and SBOM data for LLM-assisted vulnerability analysis of medical devices}, series = {Computational and Structural Biotechnology Journal}, volume = {28}, journal = {Computational and Structural Biotechnology Journal}, publisher = {Elsevier}, doi = {10.1016/j.csbj.2025.07.012}, pages = {267 -- 280}, year = {2025}, abstract = {This study investigated the use of a semi-automated, Retrieval-Augmented Generation (RAG)-based multi-agent architecture to analyze security-relevant data and assemble specialized exploitation paths targeting medical devices. The input dataset comprised device-specific sources, namely, the Manufacturer Disclosure Statement for Medical Device Security (MDS2) documents and Software Bills of Materials (SBOMs), enriched with public vulnerability databases, including Common Vulnerabilities and Exposures (CVE), Known Exploited Vulnerabilities (KEV), and Metasploit exploit records. The objective was to assess whether a modular, Large Language Model (LLM)-driven agent system could autonomously correlate device metadata with known vulnerabilities and existing exploit information to support structured threat modeling. The architecture follows a static RAG design based on predefined prompts and fixed retrieval logic, without autonomous agent planning or dynamic query adaptation. The developed Vulnerability Intelligence for Threat Analysis in Medical Security (VITAMedSec) system operates under human-prompted supervision and successfully synthesizes actionable insights and exploitation paths without requiring manual step-by-step input during execution. Although technically coherent results were obtained under controlled conditions, real-world validation remains a critical avenue for future research. This study further discusses the dual-use implications of such an agent-based framework, its relevance to patient safety in medical device cybersecurity, and the broader applicability of the proposed architecture to other critical infrastructure sectors. These findings emphasize both the technical potential and ethical responsibility for applying semi-automated AI workflows in medical cybersecurity contexts.}, language = {en} }