VulnTACT: Predicting ATT&CK for ICS Tactics and Techniques from Vulnerability Information Using Domain-Adapted Large Language Models

Industrial control systems (ICS) require vulnerability prioritization that reflects adversarial behavior and operational consequences, particularly when patching is constrained by safety and availability requirements. However, existing vulnerability-to-ATT&CK approaches are largely designed for general IT environments and often rely on direct CVE-to-technique mapping, providing limited support for ICS-specific context, multi-label inference, and downstream operational impacts. This study proposes VulnTACT, a lightweight framework for predicting MITRE ATT&CK for ICS tactics and techniques from heterogeneous vulnerability evidence. Rather than directly mapping vulnerability descriptions to ATT&CK labels, VulnTACT performs five ICS-aware reasoning steps covering vulnerability type, enabled functionality, exploitation technique, affected object, and adversarial tactic. The intermediate results and retrieved evidence are synthesized into category-specific candidates for exploitation techniques, primary impacts, and secondary impacts, followed by a ranked multi-label prediction. The reasoning structure is informed by MITRE’s CVE Mapping Methodology, while retrieval and QLoRA-based domain adaptation provide vulnerability-specific evidence and alignment with recurring ICS terminology and cross-source security semantics. Experiments using a 2024 validation set, a temporally separated 2025 test set, and 59 CTI-derived cases show improvements of approximately 7–12 percentage points over the strongest baseline across ranking metrics. Ablation results confirm the complementary contributions of retrieval, domain adaptation, and structured five-step reasoning. VulnTACT therefore supports resource-efficient and traceable vulnerability-to-ATT&CK mapping for threat-informed prioritization and compensating-control selection in patch-constrained ICS environments.