Cited by 148Adversarial Robustness in Machine LearningNetwork Security and Intrusion DetectionInformation and Cyber Security

Generative AI in cybersecurity: A comprehensive review of LLM applications and vulnerabilities

Open access
Ferrag, Mohamed Amine, Alwahedi, Fatima, Battah, Ammar, Cherif, Bilel, Mechri, Abdechakour, Tihanyi, Norbert, Bisztray, Tamas, Debbah, Merouane·2025·Internet of Things and Cyber-Physical Systems

Abstract

This paper provides a comprehensive review of the future of cybersecurity through Generative AI and Large Language Models (LLMs). We explore LLM applications across various domains, including hardware design security, intrusion detection, software engineering, design verification , cyber threat intelligence , malware detection , and phishing detection . We present an overview of LLM evolution and its current state, focusing on advancements in models such as GPT-4, GPT-3.5, Mixtral-8x7B, BERT , Falcon2, and LLaMA. Our analysis extends to LLM vulnerabilities, such as prompt injection, insecure output handling, data poisoning, DDoS attacks, and adversarial instructions. We delve into mitigation strategies to protect these models, providing a comprehensive look at potential attack scenarios and prevention techniques. Furthermore, we evaluate the performance of 42 LLM models in cybersecurity knowledge and hardware security, highlighting their strengths and weaknesses. We thoroughly evaluate cybersecurity datasets for LLM training and testing, covering the lifecycle from data creation to usage and identifying gaps for future research. In addition, we review new strategies for leveraging LLMs, including techniques like Half-Quadratic Quantization (HQQ), Reinforcement Learning with Human Feedback (RLHF), Direct Preference Optimization (DPO), Quantized Low-Rank Adapters (QLoRA), and Retrieval-Augmented Generation (RAG). These insights aim to enhance real-time cybersecurity defenses and improve the sophistication of LLM applications in threat detection and response. Our paper provides a foundational understanding and strategic direction for integrating LLMs into future cybersecurity frameworks , emphasizing innovation and robust model deployment to safeguard against evolving cyber threats.

Integrity signals

Registry

Crossref · 10.1016/j.iotcps.2025.01.001

Cites

152 of 152 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Ferrag, M. A., Alwahedi, F., Battah, A., Cherif, B., Mechri, A., Tihanyi, N., Bisztray, T., & Debbah, M.
Affiliations
  • University of Guelma (DZ)
  • Technology Innovation Institute (AE)
  • Concordia University (CA)
  • Khalifa University of Science and Technology (AE)
Corresponding author
Ferrag, Mohamed Amine
Venue
Internet of Things and Cyber-Physical Systems
Publisher
Elsevier BV
Published
2025
Volume
5
Pages
1-46
ISSN
2667-3452 (ISSN-L)
OpenAlex
W4407070057
Cited by
148
References
150
Citations by year
2026: 108 · 2025: 38 · 2024: 2
FWCI
58.56
Type
journal article
Language
en
Open access
Locations
  • Internet of Things and Cyber-Physical Systems (publishedVersion, cc-by-nc-nd)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
generative AI, large language models, cybersecurity, LLM vulnerabilities, prompt injection, data poisoning, hardware security, intrusion detection, malware detection, phishing detection, cyber threat intelligence, design verification, reinforcement learning from human feedback, DPO, QLoRA, retrieval-augmented generation, threat detection

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review