LLMs for Cybersecurity

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

19 papers in the last four weeks, up 280% on the four weeks before. 0.2% of all new papers.

Jul 13Week of Sep 28

Latest papers 166

All topics

Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations
Jun 9, 2026Aniket Anand, Yiwei Hou, Daniel Fields +4LLM Evaluation Cybersecurity
University of Chicago · USA · University of California, Berkeley +1
SAGE: An LLM-driven Self Reflective Agentic Framework for Fraud Detection
Jun 6, 2026Yichen Chen, Siying Li, Yuhang Liang +2Multi-Agent LLM Systems Financial Fraud Detection
National University of Singapore · School of Computing, Singapore 117417 · University of Chinese Academy of Sciences +4
GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks
Jun 4, 2026Hassan Jalil Hadi, Rehana Yasmin, Ali ShokerNetwork Intrusion Detection Synthetic Benchmark Generation
Cyber Security and Resilience Technology (CyberSaR), King Abdullah University of Science and Technology (KAUST), Saudi Arabia
ZERO-APT: A Closed-Loop Adversarial Framework for LLM-Driven Automated Penetration Testing under Intelligent Defense
Jun 4, 2026Anlan Zheng, Tiantian ZhuAI Agent Security Benchmarks Automated Penetration Testing
Zhejiang University of Technology Hangzhou, China
Willing but Unable: Separating Refusal from Capability in Code LLMs via Abliteration
Jun 3, 2026Cristina Carleo, Pietro Liguori, Naghmeh Ivaki +1LLM Safety Alignment LLMs for Cybersecurity
University of Naples Federico II, Naples, Italy · University of Coimbra, CISUC/LASI, Coimbra, Portugal · University of North Carolina at Charlotte, Charlotte, NC, USA
Large Byte Model: Teaching Language Models About Compiled Code
Jun 1, 2026Florian Störtz, Catalin-Andrei Stan, Alexandru Dinu +4Malware Classification Byte-Level Language Model
CrowdStrike · CrowdStrike U.K. · CrowdStrike Romania +1
IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems
Jun 1, 2026Yuchen Zhang, Ning Xi, Pengbin Feng +5Cyber-Physical Systems Industrial Anomaly Detection
School of Cyber Engineering, Xidian University, Xi’an 710126, China · School of Science, Computing and Engineering Technologies, Swinburne University of Technology, Hawthorn, VIC, Australia · School of Computer Science and Technology, Xidian University, Xi’an 710126, China
Needles at Scale: LLM-Assisted Target Selection for Windows Vulnerability Research
May 31, 2026Michael J. BommaritoSoftware Security LLMs for Cybersecurity
A New Framework for Cybersecurity Refusals in AI Agents
May 31, 2026Eliot Krzysztof Jones, Mateusz Dziemian, Matt Fredrikson +1LLM Agent Evaluation LLM Refusal Behavior
Work done while at Gray Swan · Gray Swan AI · Carnegie Mellon University
A Protocol-Language Model for Network Intrusion (Without Deep Packet Inspection)
May 29, 2026Vivek Kumar SharmaNetwork Intrusion Detection Encrypted Network Traffic Analysis
Palo Alto Networks
How Reliable Are AI Attackers Against a Fixed Vulnerable Target? A 400-Run Empirical Study of LLM Penetration Testing Consistency
May 28, 2026Galip Tolga ErdemAutomated Penetration Testing LLMs for Cybersecurity
Independent Researcher
Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots
May 28, 2026Mark Vero, Fabian Kaczmarczyck, Ivan Petrov +6LLMs for Cybersecurity
1ETH Zurich · 2Google · 3Google DeepMind +2
Dissecting the Black Box: Circuit-Level Analysis of LLM Vulnerability Detection
May 28, 2026Syafiq Al Atiiq, Chun Zhou, Christian GehrmannLLM Interpretability Software Vulnerability Detection
Lund University Lund, Sweden
Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models
May 25, 2026Mohammed N. Swileh, Shengli Zhang, Kai LeiNetwork Intrusion Detection Cybersecurity
College of Electronics and Information Engineering, Shenzhen University, Shenzhen, 518060, China · ICNLab, Shenzhen Graduate School, Peking University, Shenzhen, People’s Republic of China
CyberEvolver: Structured Self-Evolution for Cybersecurity Agents On the Fly
May 25, 2026Yihe Fan, Changyi Li, Lichen Xu +4LLM Agent Self-Improvement Automated Penetration Testing
Fudan University, Shanghai, China · Shanghai Innovation Institute, Shanghai, China · Shanghai Pudong Research Institute of Cryptology
TTPrint: Evidence-Grounded TTP Extraction via Diverge-then-Converge Verification
May 25, 2026Yutong Cheng, Changze Li, Raihan Sultan Pasha Basuki +3Cyber Threat Intelligence Document Information Extraction
Virginia Tech · Universitas Ary Ginanjar, Jakarta, Indonesia · Amazon
APT-Agent: Automated Penetration Testing using Large Language Models
May 24, 2026William Guanting Li, Alsharif Abuadbba, Kristen Moore +1LLM Hallucination Mitigation Automated Penetration Testing
University of Queensland · University of Queensland Brisbane, Australia · CSIRO Data61 +2
CyberMaskQA: A Privacy-Aware Benchmark for Evaluating Large Language Models in Cybersecurity Question Answering
May 23, 2026Matilda Gaddi, Jin Noh, Onat Gungor +1Cybersecurity LLMs for Cybersecurity
Department of Computer Science and Engineering University of California, San Diego (UCSD)
Demystifying the Mythos or Disrupting Bugonomics? From Zero-Day Asymmetry to Defender Remediation Throughput
May 23, 2026Alfredo Pesoli, Herman Errico, Lorenzo CavallaroSoftware Vulnerability Detection Software Security
Bynario · Vanta · University College London / Bynario
Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content
May 23, 2026Rohan Pandey, Archit BhujangIndirect Prompt Injection LLMs for Cybersecurity
DigitalOcean · Arizona State University
Are Frontier LLMs Ready for Cybersecurity? Evidence for Vertical Foundation Models from Dual-Mode Vulnerability Benchmarks
May 22, 2026Vivek Dahiya, Sunny Nehra, Vipul Dholariya +2Software Vulnerability Detection Cybersecurity
HIDBench: Benchmarking Large Language Models for Host-Based Intrusion Detection
May 20, 2026Danyu Sun, Jinghuai Zhang, Yuan Tian +1LLM Evaluation Cybersecurity
University of California, Irvine · University of California, Los Angeles
PocketAgents: A Manifest-Driven Library of Autonomous Defense Agents
May 20, 2026Sidnei Barbieri, Ágney Lopes Roth Ferraz, Lourenço Alves Pereira JúniorAutonomous Cyber Defense LLM Agent Security
Aeronautics Institute of Technology (ITA), São José dos Campos/SP, Brazil
GenAI-Driven Threat Detection with Microsoft Security Copilot
May 20, 2026Scott Freitas, Amir GharibAutonomous Cyber Defense Cybersecurity
Microsoft Security Research
Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source System
May 19, 2026Ivan DobrovolskyiLLM Fine-Tuning Text Classification
MS in AI & ML Engineering, Independent Researcher, Sunnyvale, CA, USA
Measuring Safety Alignment Effects in Autonomous Security Agents
May 19, 2026Isaac David, Arthur GervaisLanguage Model Safety Evaluation LLM Safety Alignment
University College London
Benchmarking Mythos-Linked Bug Rediscovery
May 17, 2026Isaac David, Arthur GervaisSoftware Engineering Software Vulnerability Detection
University College London
Ablating Safety: Mechanisms for Removing Alignment in Language Models for Security Applications
May 17, 2026Isaac David, Arthur GervaisLanguage Model Safety Evaluation Cybersecurity
University College London
GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Construction
May 15, 2026Liangyi Huang, Zichen Liu, Fei Shao +5KG Construction Cyber Threat Intelligence
Arizona State University · Case Western Reserve University · University of Notre Dame +2
Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP
May 15, 2026Igor Bogdanov, Chung-Horng Lung, Thomas Kunz +3Multi-Agent LLM Systems LLM Agent Orchestration
Carleton University Ottawa, Ontario, Canada · Defence R&D Canada Ottawa, Ontario, Canada · Cistel Technology Ottawa, Ontario, Canada

Jun 9, 2026, cs.CRJ/K move · Enter open · S save

Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations

Aniket Anand, Yiwei Hou, Daniel Fields, Alex Kantchelian+3

University of Chicago · USA · University of California, Berkeley+1

LLM Evaluation Cybersecurity Digital Forensics LLMs for Cybersecurity

Open paper AskPDF arXiv

This paper presents AuditBench, a new benchmark dataset for evaluating the capabilities of LLMs at investigating security-related system audit logs. We design and use this benchmark to explore the performance of LLMs on four log-investigation tasks that incident response teams commonly perform, ranging from triaging alerts generated by detectors to identifying persistence mechanisms on compromised systems. AuditBench consists of system audit logs collected from Linux and Windows machines, and spans over 50 different security investigation scenarios, including both malicious and benign activity. Using our benchmark, we evaluate and analyze the performance of five frontier LLMs at analyzing audit logs for attack investigations. Our analysis illuminates how LLM performance and error profiles vary according to different design choices, such as differences in model size, data representation, prompt construction, and specific investigation tasks. Additionally, we characterize the quality of the explanations produced by LLMs and the types of errors that models make across our benchmark. Collectively, our work provides a foundation for assessing the capabilities of LLMs for investigating security logs, novel insights for practitioners using LLMs in security operations, and important directions for future research.

Momentum

Related topics

Latest papers 166