LLMs for Cybersecurity

LLM: Large Language Model

This field studies how large language models can help identify and explain vulnerabilities, interpret threat intelligence and security logs, and support tasks such as incident response and penetration testing. Common approaches include retrieval-augmented generation, cybersecurity domain adaptation, multi-agent workflows, and integration with static analysis, command-line tools, fuzzers, or execution-based verification. Evaluation spans code datasets, CTI and log benchmarks, and interactive cyber ranges, where results often depend on data quality, tool access, prompts, and scoring methods. Models can assist with specific tasks, but unreliable reasoning, weak generalization to real systems, and the dual-use risks of offensive capability remain central challenges.

Latest papers

258 papers32 papers in the last four weeks, up 52% on the four weeks before. 0.2% of all new papers.

LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution
May 7, 2026Christopher G. Pedraza Pohlenz, Hassan Jalil Hadi, Ali Hassan +1LLMs for Cybersecurity Malware Analysis
aCyberSaR, King Abdullah University of Science and Technology, Thuwal, 23955-6900, Makkah Province, Saudi Arabia
Pen-Strategist: A Reasoning Framework for Penetration Testing Strategy Formation and Analysis
May 6, 2026Yasod Ginige, Pasindu Marasinghe, Sajal Jain +1Automated Penetration Testing LLMs for Cybersecurity
The University of Sydney, NSW, Australia · Catharsis.net.au, Australia
Tailored Prompts, Targeted Protection: Vulnerability-Specific LLM Analysis for Smart Contracts
May 5, 2026Xing Zhang, Keyu Zhang, Taohong Zhu +1Software Vulnerability Detection LLMs for Cybersecurity
NetX Foundation Zug, Switzerland · Department of Computer Science University of Oxford Oxford, UK · Department of Computer Science The University of Manchester Manchester, UK
FunFuzz: An LLM-Powered Evolutionary Fuzzing Framework
May 4, 2026Mario Rodríguez Béjar, B. Romera-Paredes, Jose L. Hernández-RamosEvolutionary Optimization Software Vulnerability Detection
Universidad de Murcia Murcia, Spain · Hiverge London, England
APIOT: Autonomous Vulnerability Management Across Bare-Metal Industrial OT Networks
May 4, 2026Adel ElZemity, Budi Arief, Shujun Li +6Industrial Control System Security Autonomous Cyber Defense
University of Kent, Canterbury, United Kingdom · University of Bristol, United Kingdom
LLM Ghostbusters: Surgical Package Hallucination Suppression via Adaptive Unlearning
May 1, 2026Joseph Spracklen, Pedram Aghazadeh, Farinaz Koushanfar +1LLM Hallucination Mitigation Hallucination in Language Models
University of Texas San Antonio San Antonio, TX, USA · University of California San Diego La Jolla, CA, USA
Trident: Improving Malware Detection with LLMs and Behavioral Features
Apr 30, 2026Rebecca Saul, Jingzhi Jiang, Elliott Chia +1Malware Classification LLMs for Cybersecurity
University of California, Berkeley Berkeley, California, USA
XekRung Technical Report
Apr 30, 2026Jiutian Zeng, Junjie Li, Chengwei Dai +13LLM Fine-Tuning Cybersecurity
Alibaba Security AGI Lab
Toward Autonomous SOC Operations: End-to-End LLM Framework for Threat Detection, Query Generation, and Resolution in Security Operations
Apr 30, 2026Md Hasan Saju, Akramul AzimCybersecurity LLMs for Cybersecurity
† Department of Electrical, Computer and Software Engineering, Ontario Tech University, Oshawa, Ontario, Canada
Enhancing Linux Privilege Escalation Attack Capabilities of Local LLM Agents
Apr 29, 2026Benjamin Probst, Andreas Happe, Jürgen CitoSelf-Reflection in Language Model Agents Open-Weight Language Models
TU Wien, Vienna, Austria
Autonomous LLM Agents & CTFs: A Second Look
Apr 29, 2026Youness Bouchari, Matteo Boffa, Marco Mellia +3LLM Agent Orchestration AI Agent Security Benchmarks
Politecnico di Torino · Universit`a di Torino · Huawei Technologies France
Towards Agentic Investigation of Security Alerts
Apr 28, 2026Even Eilertsen, Vasileios Mavroeidis, Gudmund GrovCybersecurity Agentic Workflows
University of Oslo · Norwegian Defence Research Establishment (FFI) · & University of Oslo
Learning Generalizable Multimodal Representations for Software Vulnerability Detection
Apr 28, 2026Zeming Dong, Yuejun Guo, Qiang Hu +5Representation Learning Software Vulnerability Detection
University of Luxembourg · 2Luxembourg Institute of Science and Technology · 3Tianjin University
CAN-QA: A Question-Answering Benchmark for Reasoning over In-Vehicle CAN Traffic
Apr 27, 2026Jing Chen, Abhijay Deevi, Onat Gungor +1Temporal Reasoning Network Intrusion Detection
Department of Computer Science and Engineering University of California, San Diego (UCSD)
PhySE: A Psychological Framework for Real-Time AR-LLM Social Engineering Attacks
Apr 25, 2026Tianlong Yu, Yang Yang, Ziyi Zhou +5Vision-Language Models Cybersecurity
1Hubei University · 2Apple Inc · 3Huazhong University of Science and Technology
Strategic Heterogeneous Multi-Agent Architecture for Cost-Effective Code Vulnerability Detection
Apr 23, 2026Zhaohui Geoffrey WangGame Theory Software Vulnerability Detection
University of Southern California Los Angeles, CA, USA
CyberCertBench: Evaluating LLMs in Cybersecurity Certification Knowledge
Apr 22, 2026Gustav Keppler, Ghada Elbez, Veit HagenmeyerLLM Evaluation Cybersecurity
Institute for Automation and Applied Informatics (IAI), Karlsruhe Institute of Technology (KIT), Karlsruhe, Germany
Taint-Style Vulnerability Detection and Confirmation for Node.js Packages Using LLM Agent Reasoning
Apr 22, 2026Ronghao Ni, Mihai Christodorescu, Limin JiaAutomated Exploit Generation Software Vulnerability Detection
Carnegie Mellon University · Google
Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps
Apr 21, 2026Alankrit Chona, Igor Kozlov, Ambuj KumarAI Agent Security Benchmarks LLMs for Cybersecurity
Simbian AI
Evaluating LLM-Generated Obfuscated XSS Payloads for Machine Learning-Based Detection
Apr 21, 2026Divyesh Gabbireddy, Suman SahaSoftware Vulnerability Detection Adversarial Examples
Department of Computer Science and Engineering · The Pennsylvania State University · University Park, PA, USA
Do Agents Dream of Root Shells? Partial-Credit Evaluation of LLM Agents in Capture the Flag Challenges
Apr 21, 2026Ali Al-Kaswan, Maksim Plotnikov, Maxim Hájek +3LLM Agent Evaluation AI Agent Security Benchmarks
Delft University of Technology Delft, The Netherlands
Refute-or-Promote: An Adversarial Stage-Gated Multi-Agent Review Methodology for High-Precision LLM-Assisted Defect Discovery
Apr 21, 2026Abhinav AgarwalSoftware Vulnerability Detection LLMs for Cybersecurity
Systematic Capability Benchmarking of Frontier Large Language Models for Offensive Cyber Tasks
Apr 18, 2026Tyler H. Merves, Michael H. Conaway, Joseph M. Escobar +2LLM Agent Evaluation Cybersecurity
Department of Cybersecurity · Department of Information Sciences and Technology
Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks
Apr 16, 2026Seyedreza Mohseni, Sarvesh Baskar, Edward Raff +1Software Reverse Engineering CoT Reasoning
University of Maryland Baltimore County, Baltimore, USA · CrowdStrike, New York, USA
LLM-Guided Prompt Evolution for Password Guessing
Apr 14, 2026Vladimir A. Mazin, Mikhail A. Zorin, Dmitrii S. Korzh +3Automatic Prompt Optimization LLMs for Cybersecurity
AXXX · MTUCI · Applied AI Center
LLMs for Qualitative Data Analysis Fail on Security-specificComments in Human Experiments
Apr 12, 2026Maria Camporese, Fabio Massacci, Yuanjun GongLLM-Assisted Annotation LLM Evaluation
University of Trento (Italy) · Vrije Universiteit Amsterdam (The Netherlands)
Verify Before You Fix: Agentic Execution Grounding for Trustworthy Cross-Language Code Analysis
Apr 12, 2026Jugal GajjarSoftware Vulnerability Detection LLMs for Cybersecurity
Department of Computer Science, The George Washington University, Washington, DC 20052
Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit
Apr 11, 2026Souradip Nath, Chih-Yi Huang, Aditi Ganapathi +3LLMs for Cybersecurity Cybersecurity
Arizona State University · Technische Universität Berlin
Multimodal Reasoning with LLM for Encrypted Traffic Interpretation: A Benchmark
Apr 9, 2026Longgang Zhang, Xiaowei Fu, Fuxiang Huang +1Encrypted Network Traffic Analysis Encrypted Traffic Classification
School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China. · School of Data Science, Lingnan University, Hong Kong, China.
SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training
Apr 8, 2026Nikolaos D. Tantaroudas, Ilias Karachalios, Andrew J. McCrackenCybersecurity Network Intrusion Detection
Institute of Communications and Computer Systems (ICCS), National Technical University of Athens, Iroon Polytechneiou 9, 15773 Zografou, Athens, Greece · National Technical University of Athens, Leof. Alimou, Katechaki, Zografou, 15772 Athens, Greece · DASKALOS-APPS, 183 Rue de l’Abbé Griffon, 01960 Péronnas, France

May 7, 2026J/K move · Enter open · S save

LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution

Christopher G. Pedraza Pohlenz, Hassan Jalil Hadi, Ali Hassan, Ali Shoker

aCyberSaR, King Abdullah University of Science and Technology, Thuwal, 23955-6900, Makkah Province, Saudi Arabia

LLMs for Cybersecurity Malware Analysis

Open paper AskPDF arXiv

LLMs are increasingly explored for malware analysis; however, current LLM-based malware attribution remains limited by unsupported indicators and insufficient code-level grounding for identifying malicious and vulnerable code segments. To address these limitations, this research introduces LCC-LLM, a code-centric benchmark dataset and evidence-grounded framework for malware attribution and multi-task static malware analysis. The proposed LCCD dataset contains approximately 34K PE samples processed through a large-scale reverse-engineering pipeline and represented using decompiled C code, assembly code, CFG/FCG artifacts, hexadecimal data, PE metadata, suspicious API evidence, and structural features. Beyond dataset construction, LCC-LLM integrates LangGraph-orchestrated static analysis with multi-source cybersecurity knowledge to support evidence-grounded malware reasoning. The framework employs a seven-layer retrieval-augmented generation pipeline, CoVe for IoC validation, and a multi-dimensional quality gate to improve factual reliability and analyst-oriented decision support. Curriculum-ordered instruction data is used to fine-tune DeepSeek-R1-Distill-Qwen-14B and Qwen3-Coder-30B-A3B using QLoRA. Evaluation across 43 malware-analysis task types achieves an average semantic similarity of 0.634, with the highest task-level performance in structured report generation, IoC extraction, vulnerability assessment, malware configuration extraction, and malware class detection. In a real-world case study using MalwareBazaar samples, the grounded pipeline achieves a 10/10 structured analysis pass rate, producing CFG/FCG evidence, MITRE ATT&CK mappings, detection guidance, and analyst-ready reports. These results show that code-centric representations, retrieval grounding, and verification-guided reasoning improve the reliability and operational usefulness of LLM-assisted malware attribution.