CoChat
Sign Up
Cited by 191Adversarial Robustness in Machine LearningNetwork Security and Intrusion DetectionAdvanced Malware Detection Techniques

Large Language Models for Cyber Security: A Systematic Literature Review

Xu, Hanxiang, Wang, Shenao, Li, Ningke, Wang, Kailong, Zhao, Yanjie, Chen, Kai, Yu, Ting, Liu, Yang +1 more·2025·ACM Transactions on Software Engineering and Methodology
DOI 10.1145/3769676
Open this paper in CoChat — free account

Abstract

The rapid advancement of Large Language Models (LLMs) has opened up new opportunities for leveraging artificial intelligence in a variety of application domains, including cybersecurity. As the volume and sophistication of cyber threats continue to grow, there is an increasing need for intelligent systems that can automatically detect vulnerabilities, analyze malware, and respond to attacks. In this survey, we conduct a comprehensive review of the literature on the application of LLMs in cybersecurity (LLM4Security). By comprehensively collecting over 40K relevant papers and systematically analyzing 185 papers from top security and software engineering venues, we aim to provide a holistic view of how LLMs are being used to solve diverse problems across the cybersecurity domain. Through our analysis, we identify several key findings. First, we observe that LLMs are being applied to an expanding range of cybersecurity tasks, including vulnerability detection, malware analysis, and network intrusion detection. Second, we analyze application trends of different LLM architectures (such as encoder-only, encoder-decoder, and decoder-only) across security domains. Third, we identify increasingly sophisticated techniques for adapting LLMs to cybersecurity, such as advanced fine-tuning, prompt engineering, and external augmentation strategies. A significant emerging trend is the use of LLM-based autonomous agents, which represent a paradigm shift from single-task execution to orchestrating complex, multi-step security workflows. Furthermore, we find that the datasets used for training and evaluating LLMs are often limited, highlighting the need for more comprehensive datasets and the use of LLMs for data augmentation. Finally, we discuss the main challenges and opportunities for future research, including the need for more interpretable models, addressing the inherent security risks of LLMs, and their potential for proactive defense. Overall, our survey provides a comprehensive overview of the current state-of-the-art in LLM4Security and identifies several promising directions for future research. We believe that the insights and findings presented in this survey will contribute to the growing body of knowledge on the application of LLMs in cybersecurity and provide valuable guidance for researchers and practitioners working in this field.

Integrity signals

Registry

Crossref · 10.1145/3769676

Cites

113 of 113 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • LLMs have already been examined for cyber threat detection, threat-intelligence analysis, malware investigation support, and higher-level security reasoning, no longer confined to traditional classification pipelines or rule-based systems.

    “According to recent studies, LLMs have already been examined for cyber threat detection, threat-intelligence analysis, malware investigation support, and higher-level security reasoning, no longer confined to traditional classification pipelines or rule-based systems [12], [13].”

    From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [12]

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Xu, H., Wang, S., Li, N., Wang, K., Zhao, Y., Chen, K., Yu, T., Liu, Y., & Wang, H.
Affiliations
  • Huazhong University of Science and Technology (CN)
  • Hamad bin Khalifa University (QA)
  • Nanyang Technological University (SG)
ORCID
Venue
ACM Transactions on Software Engineering and Methodology
Publisher
Association for Computing Machinery (ACM)
Published
2025-09-29
ISSN
  • 1049-331X (ISSN-L)
  • 1557-7392
DOI
10.1145/3769676
OpenAlex
W4414594130
Cited by
189
References
105
Citations by year
2026: 129 · 2025: 54 · 2024: 6
FWCI
17.56
Type
journal article
Language
en
Open access
closed
Locations
ACM Transactions on Software Engineering and Methodology (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
Keywords
large language models, cybersecurity, vulnerability detection, malware analysis, network intrusion detection, LLM architecture, fine-tuning, prompt engineering, security datasets, data augmentation, interpretability, proactive defense

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review