CoChat
Sign Up
Cited by 13Network Security and Intrusion DetectionInformation and Cyber SecurityAdversarial Robustness in Machine Learning

Large Language Models for Security Operations Centers: A Comprehensive Survey

Open access
Habibzadeh, Ali, Feyzi, Farid, Atani, Reza Ebrahimi·2026·Journal of Electrical and Computer Engineering
DOI 10.1155/jece/3383674
Open this paper in CoChat — free account

Abstract

Security operations centers (SOCs) face escalating challenges from alert fatigue and a critical skills gap, leading to delayed incident response times. Addressing these persistent issues calls for innovative automation and decision‐support approaches. Large language models (LLMs) present a transformative opportunity to automate complex workflows and augment the capabilities of human analysts. This survey provides the first comprehensive and structured analysis of LLM integration into SOC operations. We systematically map LLM applications to the functions of the NIST Cybersecurity Framework (CSF) and use the MITRE ATT&CK framework as an analytical lens to evaluate their granular threat detection capabilities. By synthesizing findings from 216 studies, we provide a structured overview of current methodologies, identify key trade‐offs between LLM architectures, and highlight significant gaps in research, particularly in the NIST “Recover” function. This survey offers researchers and SOC managers a clear research roadmap and actionable insights for leveraging LLMs to build more resilient and intelligent security operations.

Integrity signals

Registry

Crossref · 10.1155/jece/3383674

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

Research works printed but not linked: 260

  1. MinaeeS. MikolovT. NikzadN.et al. Large Language Models: A Survey 2024 https://arxiv.org/abs/2402.06196. · arXiv
  2. 10.1109/COMST.2024.3465447 · DOI
  3. 10.1016/j.compag.2025.110396 · DOI
  4. 10.1016/j.ait.2025.100004 · DOI
  5. 10.1016/j.smhl.2025.100570 · DOI
  6. HassaninM.andMoustafaN. A Comprehensive Overview of Large Language Models (LLMs) for Cyber Defences: Opportunities and Directions 2024 https://arxiv.org/abs/2405.14487. · arXiv
  7. AbdeenB. Al-ShaerE. SinghalA. KhanL. andHamlenK. SMET: Semantic Mapping of CVE to ATT&CK and Its Application to Cybersecurity Proceedings of the 2023 IFIP Annual Conference on Data and Applications Security and Privacy 2023 Sophia-Antipolis 243–260 https://doi.org/10.1007/978-3-031-37586-6_15. · DOI
  8. 10.1109/ACCESS.2025.3532951 · DOI · Paper page
  9. 10.1016/j.hcc.2024.100211 · DOI · Paper page
  10. 10.1186/s42400-025-00361-w · DOI · Paper page
  11. 10.1007/s10207-025-00992-7 · DOI
  12. 10.1109/ACCESS.2025.3541146 · DOI
  13. 10.1145/3708522 · DOI
  14. 10.1016/j.cose.2024.104016 · DOI
  15. FengC. WuS. andLiuN. A User-Centric Machine Learning Framework for Cyber Security Operations Center Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) 2017 Beijing 173–175 https://doi.org/10.1109/ISI.2017.8004902. · DOI
  16. OeschS. BridgesR. SmithJ.et al. An Assessment of the Usability of Machine Learning Based Tools for the Security Operations Center Proceedings of the 2020 International Conferences on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics) 2020 Rhodes 634–641. · DOI
  17. 10.1145/3641289 · DOI · Paper page
  18. JiangJ. WangF. ShenJ. KimS. andKimS. A Survey on Large Language Models for Code Generation 2024 https://arxiv.org/abs/2406.00515. · arXiv
  19. PengK. DingL. ZhongQ.et al. Towards Making the Most of ChatGPT for Machine Translation 2023 https://arxiv.org/abs/2303.13780. · DOI
  20. KocmiT.andFedermannC. Large Language Models Are State-of-the-Art Evaluators of Translation Quality 2023 https://arxiv.org/abs/2302.14520. · arXiv
  21. 10.2196/53216 · DOI
  22. 10.1016/j.ijmedinf.2025.106026 · DOI
  23. 10.1016/j.exger.2025.112812 · DOI
  24. 10.1007/s10916-023-01925-4 · DOI · Paper page
  25. 10.1016/j.cmpb.2024.108302 · DOI
  26. 10.1371/journal.pone.0272545 · DOI · Paper page
  27. 10.1080/23735082.2023.2257234 · DOI
  28. 10.1007/s10639-023-12146-0 · DOI · Paper page
  29. ChhetriC. Exploring Large Language Model-Powered Pedagogical Approaches to Cybersecurity Education Proceedings of the 25th Annual Conference on Information Technology Education 2024 El Paso TX 163–166 https://doi.org/10.1145/3686852.3686887. · DOI
  30. ElkinsS. KochmarE. SerbanI. andCheungJ. C. How Useful Are Educational Questions Generated by Large Language Models? Proceedings of the 2023 International Conference on Artificial Intelligence in Education 2023 Tokyo 536–542 https://doi.org/10.1007/978-3-031-36336-8_83. · DOI · Paper page
  31. HanJ. YooH. MyungJ.et al. LLM-as-a-tutor in EFL Writing Education: Focusing on Evaluation of Student-LLM Interaction 2023 https://arxiv.org/abs/2310.05191. · arXiv
  32. DaiW. LinJ. JinH.et al. Can Large Language Models Provide Feedback to Students? A Case Study on ChatGPT Proceedings of the 2023 IEEE International Conference on Advanced Learning Technologies (ICALT) 2023 Orem UT 323–325 https://doi.org/10.1109/ICALT58122.2023.00100. · DOI · Paper page
  33. NelsonC. DoupéA. andShoshitaishviliY. SENSAI: Large Language Models as Applied Cybersecurity Tutors Proceedings of the 56th ACM Technical Symposium on Computer Science Education 2025 Pittsburgh PA 833–839 https://doi.org/10.1145/3641554.3701801. · DOI
  34. ZhengQ. XiaX. ZouX.et al. CodeGeeX: A Pre-Trained Model for Code Generation With Multilingual Benchmarking on Humaneval-X Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining 2023 Long Beach CA 5673–5684 https://doi.org/10.1145/3580305.3599790. · DOI · Paper page
  35. 10.1109/TSE.2023.3334955 · DOI · Paper page
  36. ZhaoS. ZhuA. MozannarH. SontagD. TalwalkarA. andChenV. CodingGenie: A Proactive LLM-Powered Programming Assistant Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering 2025 Trondheim 1168–1172 https://doi.org/10.1145/3696630.3728603. · DOI
  37. 10.1109/TIFS.2024.3374558 · DOI
  38. BouzeniaI. DevanbuP. andPradelM. RepairAgent: An Autonomous LLM-Based Agent for Program Repair 2024 https://arxiv.org/abs/2403.17134. · arXiv
  39. 10.1145/3733599 · DOI
  40. Vielberth M., 2021, Encyclopedia of Cryptography, Security and Privacy, 1
  41. DeCusatis C., 2019, Cybersecurity and Secure Information Systems: Challenges and Solutions in Smart Environments, 287, 10.1007/978-3-030-16837-7_13 · DOI
  42. 10.1109/ACCESS.2020.3045514 · DOI
  43. Oniagbi O., 2024, Evaluation of LLM Agents for the SOC Tier 1 Analyst Triage Process
  44. GuptaN. TraoreI. andde QuinanP. M. F. Automated Event Prioritization for Security Operation Center Using Deep Learning Proceedings of the 2019 IEEE International Conference on Big Data (Big Data) 2019 Los Angeles CA 5864–5872 https://doi.org/10.1109/BigData47090.2019.9006073. · DOI
  45. 10.1016/j.comnet.2022.109116 · DOI
  46. Griffith S., 2024, Encyclopedia of Cryptography, Security and Privacy, 1
  47. 10.1016/j.comnet.2025.111614 · DOI
  48. Kitchenham B., 2007, Guidelines for Performing Systematic Literature Reviews in Software Engineering, Empirical Software Engineering
  49. GuoH. YuanS. andWuX. LogBERT: Log Anomaly Detection via BERT Proceedings of the 2021 International Joint Conference on Neural Networks (IJCNN) 2021 Shenzhen 1–8 https://doi.org/10.1109/IJCNN52387.2021.9534113. · DOI · Paper page
  50. HanX. YuanS. andTrabelsiM. LogGPT: Log Anomaly Detection via GPT Proceedings of the 2023 IEEE International Conference on Big Data (BigData) 2023 Sorrento IEEE 1117–1122 https://doi.org/10.1109/BigData59044.2023.10386543. · DOI
  51. 10.1016/j.asoc.2023.110689 · DOI
  52. 10.1109/TNSM.2024.3358730 · DOI · Paper page
  53. LeV.-H.andZhangH. Log-Based Anomaly Detection Without Log Parsing Proceedings of the 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) 2021 Melbourne 492–504 https://doi.org/10.1109/ASE51524.2021.9678773. · DOI · Paper page
  54. 10.1080/08839514.2022.2145642 · DOI
  55. 10.1109/JIOT.2024.3386183 · DOI
  56. GuanW. CaoJ. QianS. GaoJ. andOuyangC. LogLLM: Log-Based Anomaly Detection Using Large Language Models 2024 https://arxiv.org/abs/2411.08561. · arXiv
  57. LiuY. JiY. TaoS.et al. LogLM: From Task-Based to Instruction-Based Automated Log Analysis Proceedings of the 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) 2025 Ottawa 401–412 https://doi.org/10.1109/ICSE-SEIP66354.2025.00041. · DOI
  58. 10.1109/TSE.2025.3594046 · DOI
  59. 10.1016/j.knosys.2025.114064 · DOI · Paper page
  60. QiJ. HuangS. LuanZ.et al. LogGPT: Exploring ChatGPT for Log-Based Anomaly Detection Proceedings of the 2023 IEEE International Conference on High Performance Computing & Communications Data Science & Systems Smart City & Dependability in Sensor Cloud & Big Data Systems & Application (HPCC/DSS/SmartCity/DependSys) 2023 Melbourne 273–280 https://doi.org/10.1109/HPCC-DSS-SmartCity-DependSys60770.2023.00045. · DOI
  61. LiuY. TaoS. MengW.et al. Interpretable Online Log Analysis Using Large Language Models With Prompt Strategies Proceedings of the 32nd IEEE/ACM International Conference on Program Comprehension 2024 Lisbon 35–46 https://doi.org/10.1145/3643916.3644408. · DOI
  62. SongC. MaL. ZhengJ. LiaoJ. KuangH. andYangL. Audit-LLM: Multi-Agent Collaboration for Log-Based Insider Threat Detection 2024 https://arxiv.org/abs/2408.08902. · arXiv
  63. 10.1145/3703155 · DOI · Paper page
  64. PanJ. LiangW. S. andYidiY. RAGLog: Log Anomaly Detection Using Retrieval Augmented Generation Proceedings of the 2024 IEEE World Forum on Public Safety Technology (WFPST) 2024 Washington DC 169–174 https://doi.org/10.1109/WFPST58552.2024.00034. · DOI
  65. 10.1016/j.engappai.2024.108613 · DOI
  66. ZhuJ. HeS. HeP. LiuJ. andLyuM. R. Loghub: A Large Collection of System Log Datasets for AI-Driven Log Analytics Proceedings of the 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) 2023 Florence 355–366 https://doi.org/10.1109/ISSRE59848.2023.00071. · DOI · Paper page
  67. 10.1109/TNSM.2020.2967721 · DOI · Paper page
  68. LapradeC. BowmanB. andHuangH. H. PicoDomain: A Compact High-Fidelity Cybersecurity Dataset 2020 https://arxiv.org/abs/2008.09192. · arXiv
  69. OlinerA.andStearleyJ. What Supercomputers Say: A Study of Five System Logs Proceedings of the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’07) 2007 Edinburgh 575–584 https://doi.org/10.1109/DSN.2007.103. · DOI
  70. HeP. ZhuJ. ZhengZ. andLyuM. R. Drain: An Online Log Parsing Approach with Fixed Depth Tree Proceedings of the 2017 IEEE International Conference on Web Services (ICWS) 2017 Honolulu HI 33–40 https://doi.org/10.1109/ICWS.2017.13. · DOI · Paper page
  71. HousselP. R. SinghP. LayeghyS. andPortmannM. Towards Explainable Network Intrusion Detection Using Large Language Models 2024 https://arxiv.org/abs/2408.04342. · arXiv
  72. 10.1109/ACCESS.2024.3363469 · DOI
  73. 10.1109/ACCESS.2022.3165809 · DOI
  74. LiraO. G. MarroquinA. andToM. A. Harnessing the Advanced Capabilities of LLM for Adaptive Intrusion Detection Systems Proceedings of the 2024 International Conference on Advanced Information Networking and Applications 2024 Kitakyushu 453–464 https://doi.org/10.1007/978-3-031-57942-4_44. · DOI
  75. TavallaeeM. BagheriE. LuW. andGhorbaniA. A. A Detailed Analysis of the KDD CUP 99 Data Set Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications 2009 Ottawa 1–6. · DOI · Paper page
  76. DiafA. KorbaA. A. KarabadjiN. E. andGhamri-DoudaneY. Beyond Detection: Leveraging Large Language Models for Cyber Attack Prediction in IoT Networks Proceedings of the 2024 20th International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) 2024 Abu Dhabi 117–123 https://doi.org/10.1109/DCOSS-IoT61029.2024.00026. · DOI
  77. 10.3390/s23135941 · DOI
  78. LiQ. ZhangY. JiaZ.et al. DoLLM: How Large Language Models Understanding Network Flow Data to Detect Carpet Bombing DDoS 2024 https://arxiv.org/abs/2405.07638. · arXiv
  79. SharafaldinI. LashkariA. H. HakakS. andGhorbaniA. A. Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST) 2019 Chennai 1–8 https://doi.org/10.1109/CCST.2019.8888419. · DOI · Paper page
  80. 10.1109/TVT.2024.3402366 · DOI
  81. SharafaldinI. LashkariA. H. GhorbaniA. A.et al. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization Proceedings of the 4th International Conference on Information Systems Security and Privacy 2018 Funchal 108–116. · DOI · Paper page
  82. 10.1016/j.future.2020.03.042 · DOI
  83. 10.1016/j.vehcom.2019.100198 · DOI
  84. Li Y., 2024, IDS-Agent: An LLM Agent for Explainable Intrusion Detection in IoT Networks
  85. NackE. A. McKenzieM. C. andBastianN. D. ACI-IoT-2023: A Robust Dataset for Internet of Things Network Security Analysis Proceedings of the MILCOM 2024-2024 IEEE Military Communications Conference (MILCOM) 2024 Washington DC 1–6 https://doi.org/10.1109/MILCOM61039.2024.10773916. · DOI
  86. ZhangH. SediqA. B. AfanaA. andErol-KantarciM. Large Language Models in Wireless Application Design: In-Context Learning-Enhanced Automatic Network Intrusion Detection 2024 https://arxiv.org/abs/2405.11002. · arXiv
  87. FarzanehB. ShahriarN. Al MuktadirA. H. andTowhidM. S. DTL-IDS: Deep Transfer Learning-Based Intrusion Detection System in 5G Networks Proceedings of the 2023 19th International Conference on Network and Service Management (CNSM) 2023 Niagara Falls 1–5 https://doi.org/10.23919/CNSM59352.2023.10327918. · DOI
  88. DiafA. KorbaA. A. Elislem KarabadjiN. andGhamri-DoudaneY. BARTPredict: Empowering IoT Security With LLM-Driven Cyber Threat Prediction Proceedings of the GLOBECOM 2024 – 2024 IEEE Global Communications Conference 2024 1239–1244 https://doi.org/10.1109/GLOBECOM52923.2024.10901770. · DOI · Paper page
  89. 10.1016/j.comnet.2025.111341 · DOI
  90. 10.1016/j.comnet.2025.111473 · DOI
  91. 10.1109/ACCESS.2023.3319213 · DOI
  92. SarhanM. LayeghyS. MoustafaN. andPortmannM. Netflow Datasets for Machine Learning-Based Network Intrusion Detection Systems Proceedings of the 2020 International Conference on Big Data Technologies and Applications 2020 Springer 117–135 https://doi.org/10.1007/978-3-030-72802-1_9. · DOI
  93. 10.1016/j.comnet.2024.111023 · DOI
  94. 10.1016/j.cose.2025.104337 · DOI
  95. AdjewaF. EsseghirM. andMerghem-BoulahiaL. Efficient Federated Intrusion Detection in 5G Ecosystem Using Optimized BERT-Based Model Proceedings of the 2024 20th International Conference on Wireless and Mobile Computing Networking and Communications (WiMob) 2024 Paris 62–67 https://doi.org/10.1109/WiMob61911.2024.10770340. · DOI
  96. ZiemsN. LiuG. FlanaganJ. andJiangM. Explaining Tree Model Decisions in Natural Language for Network Intrusion Detection 2023 https://arxiv.org/abs/2310.19658. · arXiv
  97. 10.1016/j.eswa.2025.128089 · DOI
  98. AliT.andKostakosP. HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI With Large Language Models (LLMs) 2023 https://arxiv.org/abs/2309.16021. · arXiv
  99. 10.1016/j.cose.2019.06.005 · DOI
  100. 10.1109/ACCESS.2020.3022862 · DOI
  101. MisraK.andRayzJ. T. LMs go Phishing: Adapting Pre-Trained Language Models to Detect Phishing Emails Proceedings of the 2022 IEEE/WIC/ACM International Joint Conference on Web Intelligence and Intelligent Agent Technology (WI-IAT) 2022 Niagara Falls 135–142 https://doi.org/10.1109/WI-IAT55865.2022.00028. · DOI
  102. WangY. ZhuW. XuH. QinZ. RenK. andMaW. A Large-Scale Pretrained Deep Model for Phishing URL Detection Proceedings of the ICASSP 2023-2023 IEEE International Conference on Acoustics Speech and Signal Processing (ICASSP) 2023 Rhodes Island 1–5 https://doi.org/10.1109/ICASSP49357.2023.10095719. · DOI
  103. 10.1109/ACCESS.2024.3375882 · DOI · Paper page
  104. ChatautR. GyawaliP. K. andUsmanY. Can AI Keep You Safe? A Study of Large Language Models for Phishing Detection Proceedings of the 2024 IEEE 14th Annual Computing and Communication Workshop and Conference (CCWC) 2024 Las Vegas NV 0548–0554 https://doi.org/10.1109/CCWC60891.2024.10427626. · DOI
  105. 10.3390/make6010018 · DOI
  106. Hannousse A., 2021, Web Page Phishing Detection, Mendeley Data, 3
  107. PatelH. RehmanU. andIqbalF. Evaluating the Efficacy of Large Language Models in Identifying Phishing Attempts Proceedings of the 2024 16th International Conference on Human System Interaction (HSI) 2024 Paris 1–7 https://doi.org/10.1109/HSI61632.2024.10613528. · DOI
  108. LeeJ. LimP. HooiB. andDivakaranD. M. Multimodal Large Language Models for Phishing Webpage Detection and Identification Proceedings of the 2024 APWG Symposium on Electronic Crime Research (eCrime) 2024 Boston MA 1–13 https://doi.org/10.1109/eCrime66200.2024.00007. · DOI
  109. Le PochatV. Van GoethemT. TajalizadehkhoobS. KorczyńskiM. andJoosenW. Tranco: A Research-Oriented Top Sites Ranking Hardened against Manipulation 2018 https://tranco-list.eu/. · DOI
  110. LiY. HuangC. DengS.et al. KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24) 2024 Philadelphia PA 793–810.
  111. WangH.andHooiB. Automated Phishing Detection Using URLs and Webpages 2024 https://arxiv.org/abs/2408.01667. · arXiv
  112. 10.1109/ACCESS.2024.3483905 · DOI
  113. TradF.andChehabA. Large Multimodal Agents for Accurate Phishing Detection With Enhanced Token Optimization and Cost Reduction Proceedings of the 2024 2nd International Conference on Foundation and Large Language Models (FLLM) 2024 Dubai 229–237 https://doi.org/10.1109/FLLM63129.2024.10852444. · DOI
  114. 10.14419/ijet.v7i4.31.23333 · DOI
  115. NahmiasD. EngelbergG. KleinD. andShabtaiA. Prompted Contextual Vectors for Spear-Phishing Detection 2024 https://arxiv.org/abs/2402.08309. · arXiv
  116. RoyS. S.andNilizadehS. PhishLang: A Lightweight Client-Side Phishing Detection Framework Using Mobilebert for Real-Time Explainable Threat Mitigation 2024 https://arxiv.org/html/2408.05667v2.
  117. 10.1145/3733049 · DOI · Paper page
  118. 10.1109/ACCESS.2024.3352629 · DOI
  119. WangJ. WangJ. AthiwaratkunB. ZhangC. andZouJ. Mixture-of-Agents Enhances Large Language Model Capabilities 2024 https://arxiv.org/abs/2406.04692. · arXiv
  120. 10.1016/S0278-4254(02)00042-X · DOI
  121. ShengZ. ChenZ. GuS. HuangH. GuG. andHuangJ. LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights 2025 https://arxiv.org/abs/2502.07049. · arXiv
  122. GuoY. PatsakisC. HuQ. TangQ. andCasinoF. Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection Proceedings of the 2024 European Symposium on Research in Computer Security 2024 Bydgoszcz 271–289 https://doi.org/10.1007/978-3-031-70879-4_14. · DOI
  123. MahyariA. A. Harnessing the Power of LLMs in Source Code Vulnerability Detection Proceedings of the MILCOM 2024-2024 IEEE Military Communications Conference (MILCOM) 2024 Washington DC 251–256 https://doi.org/10.1109/MILCOM61039.2024.10774025. · DOI
  124. SteenhoekB. RahmanM. M. RoyM. K. AlamM. S. BarrE. T. andLeW. A Comprehensive Study of the Capabilities of Large Language Models for Vulnerability Detection 2024 https://arxiv.org/html/2403.17218v1.
  125. CheshkovA. ZadorozhnyP. andLevichevR. Evaluation of ChatGPT Model for Vulnerability Detection 2023 https://arxiv.org/abs/2304.07232. · arXiv
  126. FuM. TantithamthavornC. K. NguyenV. andLeT. ChatGPT for Vulnerability Detection Classification and Repair: How Far Are We? Proceedings of the 2023 30th Asia-Pacific Software Engineering Conference (APSEC) 2023 Seoul 632–636 https://doi.org/10.1109/APSEC60848.2023.00085. · DOI
  127. FuM.andTantithamthavornC. LineVul: A Transformer-Based Line-Level Vulnerability Prediction Proceedings of the 19th International Conference on Mining Software Repositories 2022 Pittsburgh PA 608–620 https://doi.org/10.1145/3524842.3528452. · DOI
  128. OmarM.andShiaelesS. VulDetect: A Novel Technique for Detecting Software Vulnerabilities Using Language Models Proceedings of the 2023 IEEE International Conference on Cyber Security and Resilience (CSR) 2023 Venice 105–110 https://doi.org/10.1109/CSR57506.2023.10224924. · DOI
  129. YangA. Z. Le GouesC. MartinsR. andHellendoornV. Large Language Models for Test-free Fault Localization Proceedings of the 46th IEEE/ACM International Conference on Software Engineering 2024 Lisbon 1–12 https://doi.org/10.1145/3597503.3623342. · DOI · Paper page
  130. 10.1016/j.cose.2024.104151 · DOI
  131. 10.1109/TSE.2025.3548168 · DOI
  132. FengZ. GuoD. TangD.et al. CodeBERT: A Pre-Trained Model for Programming and Natural Languages 2020 https://arxiv.org/abs/2002.08155. · arXiv
  133. NijkampE. PangB. HayashiH.et al. CodeGen: An Open Large Language Model for Code With Multi-Turn Program Synthesis 2022 https://arxiv.org/abs/2203.13474. · arXiv
  134. WangY. WangW. JotyS. andHoiS. C. CodeT5: Identifier-Aware Unified Pre-Trained Encoder-Decoder Models for Code Understanding and Generation 2021 https://arxiv.org/abs/2109.00859. · DOI · Paper page
  135. NguyenV. NepalS. WuT. YuanX. andRudolphC. SAFE: Advancing Large Language Models in Leveraging Semantic and Syntactic Relationships for Software Vulnerability Detection 2024 https://arxiv.org/abs/2409.00882. · arXiv
  136. RidoyS. Z. ShaonM. S. H. CuzzocreaA. andAkterM. S. EnStack: An Ensemble Stacking Framework of Large Language Models for Enhanced Vulnerability Detection in Source Code Proceedings of the 2024 IEEE International Conference on Big Data (BigData) 2024 Washington DC 6356–6364 https://doi.org/10.1109/BigData62323.2024.10825609. · DOI
  137. 10.1016/j.jss.2024.112031 · DOI
  138. 10.1016/j.jss.2024.112234 · DOI
  139. 10.1016/j.eswa.2025.126479 · DOI
  140. WangW. LiuE. GuoX. HuX. GrishchenkoI. andLieD. ANVIL: Anomaly-Based Vulnerability Identification Without Labelled Training Data 2024 https://arxiv.org/abs/2408.16028. · arXiv
  141. DuX. ZhengG. WangK.et al. Vul-RAG: Enhancing LLM-Based Vulnerability Detection via Knowledge-Level Rag 2024 https://arxiv.org/abs/2406.11147. · arXiv
  142. ShengZ. WuF. ZuoX. LiC. QiaoY. andHangL. LProtector: An LLM-Driven Vulnerability Detection System 2024 https://arxiv.org/abs/2411.06493. · arXiv
  143. MaoZ. LiJ. JinD. LiM. andTeiK. Multi-Role Consensus Through LLMs Discussions for Vulnerability Detection Proceedings of the 2024 IEEE 24th International Conference on Software Quality Reliability and Security Companion (QRS-C) 2024 Cambridge 1318–1319 https://doi.org/10.1109/QRS-C63300.2024.00173. · DOI
  144. 10.1109/TSE.2025.3597319 · DOI · Paper page
  145. FanJ. LiY. WangS. andNguyenT. N. A C/C++ Code Vulnerability Dataset With Code Changes and CVE Summaries Proceedings of the 17th International Conference on Mining Software Repositories 2020 Seoul 508–512 https://doi.org/10.1145/3379597.3387501. · DOI
  146. 10.1109/TDSC.2021.3051525 · DOI
  147. Zhou Y., 2019, Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks, Advances in Neural Information Processing Systems, 32
  148. 10.1109/TSE.2021.3087402 · DOI
  149. ZhengY. PujarS. LewisB.et al. D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis Proceedings of the 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) 2021 Madrid 111–120 https://doi.org/10.1109/ICSE-SEIP52600.2021.00020. · DOI
  150. 10.1016/j.mlwa.2024.100598 · DOI
  151. ChenY. DingZ. AlowainL. ChenX. andWagnerD. DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection Proceedings of the 26th International Symposium on Research in Attacks Intrusions and Defenses 2023 Hong Kong 654–668 https://doi.org/10.1145/3607199.3607242. · DOI
  152. RussellR. KimL. HamiltonL.et al. Automated Vulnerability Detection in Source Code Using Deep Representation Learning Proceedings of the 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA) 2018 Orlando FL 757–762 https://doi.org/10.1109/ICMLA.2018.00120. · DOI
  153. MaoQ. LiZ. HuX. LiuK. XiaX. andSunJ. Towards Effectively Detecting and Explaining Vulnerabilities Using Large Language Models 2024 https://arxiv.org/html/2406.09701v2.
  154. TihanyiN. BisztrayT. JainR. FerragM. A. CordeiroL. C. andMavroeidisV. The Formai Dataset: Generative AI in Software Security through the Lens of Formal Verification Proceedings of the 19th International Conference on Predictive Models and Data Analytics in Software Engineering 2023 San Francisco CA 33–43 https://doi.org/10.1145/3617555.3617874. · DOI
  155. GhalebA.andPattabiramanK. How Effective Are Smart Contract Analysis Tools? Evaluating Smart Contract Static Analysis Tools Using Bug Injection Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis Los Angeles 2020 415–427 https://doi.org/10.1145/3395363.3397385. · DOI
  156. 10.1145/3428334 · DOI
  157. DingY. FuY. IbrahimO.et al. Vulnerability Detection With Code Language Models: How Far Are We? 2024 https://arxiv.org/abs/2403.18624. · arXiv
  158. 10.1016/j.infsof.2021.106809 · DOI
  159. BhandariG. NaseerA. andMoonenL. CVEfixes: Automated Collection of Vulnerabilities and Their Fixes From Open-Source Software Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering Madrid Spain 2021 30–39 https://doi.org/10.5281/zenodo.5111494. · DOI
  160. RahaliA.andAkhloufiM. A. MalBERT: Malware Detection Using Bidirectional Encoder Representations From Transformers Proceedings of the 2021 IEEE International Conference on Systems Man and Cybernetics (SMC) 2021 Melbourne 3226–3231 https://doi.org/10.1109/SMC52423.2021.9659287. · DOI
  161. 10.1109/ACCESS.2022.3185748 · DOI
  162. VörösT. BergeronS. P. andBerlinK. Web Content Filtering Through Knowledge Distillation of Large Language Models Proceedings of the 2023 IEEE/WIC International Conference on Web Intelligence and Intelligent Agent Technology (WI-IAT) 2023 Venice 357–361 https://doi.org/10.1109/WI-IAT59888.2023.00058. · DOI
  163. 10.1016/j.jisa.2023.103690 · DOI
  164. 10.1002/spy2.402 · DOI
  165. DuD. GuanX. LiuY.et al. MAD-LLM: A Novel Approach for Alert-Based Multi-Stage Attack Detection via LLM Proceedings of the 2024 IEEE International Symposium on Parallel and Distributed Processing With Applications (ISPA) 2024 Kaifeng 2046–2053 https://doi.org/10.1109/ISPA63168.2024.00279. · DOI
  166. SiS. WuY. TangL. ZhangY. WosikJ. andSuQ. Evaluating the Performance of Chatgpt for Spam Email Detection 2024 https://arxiv.org/abs/2402.15537. · arXiv
  167. 10.1016/j.dcan.2025.07.008 · DOI
  168. RanadeP. PiplaiA. JoshiA. andFininT. CyBERT: Contextualized Embeddings for the Cybersecurity Domain Proceedings of the 2021 IEEE International Conference on Big Data (Big Data) 2021 Orlando FL 3334–3342 https://doi.org/10.1109/BigData52589.2021.9671824. · DOI
  169. ParkY.andYouW. A Pretrained Language Model for Cyber Threat Intelligence Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: Industry Track 2023 Singapore 113–122 https://doi.org/10.18653/v1/2023.emnlp-industry.12. · DOI
  170. 10.1145/3652594 · DOI
  171. RaniN. SahaB. MauryaV. andShuklaS. K. TTPHunter: Automated Extraction of Actionable Intelligence as TTPs From Narrative Threat Reports Proceedings of the 2023 Australasian Computer Science Week 2023 Melbourne 126–134 https://doi.org/10.1145/3579375.3579391. · DOI
  172. AghaeiE.andAl-ShaerE. CVE-Driven Attack Technique Prediction With Semantic Information Extraction and a Domain-Specific Language Model 2023 https://arxiv.org/abs/2309.02785. · arXiv
  173. AghaeiE. NiuX. ShadidW. andAl-ShaerE. SecureBERT: A Domain-Specific Language Model for Cybersecurity Proceedings of the 2022 International Conference on Security and Privacy in Communication Systems 2022 Springer 39–56 https://doi.org/10.1007/978-3-031-25538-0_3. · DOI · Paper page
  174. 10.1186/s42400-021-00106-5 · DOI
  175. 10.1186/s42400-022-00110-3 · DOI
  176. 10.1016/j.cose.2022.102763 · DOI
  177. AlamM. T. BhusalD. ParkY. andRastogiN. Looking Beyond IoCs: Automatically Extracting Attack Patterns From External CTI Proceedings of the 26th International Symposium on Research in Attacks Intrusions and Defenses 2023 Hong Kong 92–108 https://doi.org/10.1145/3607199.3607208. · DOI
  178. SiracusanoG. SanvitoD. GonzalezR.et al. Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild 2023 https://arxiv.org/abs/2307.10214. · arXiv
  179. ZhangY. DuT. MaY.et al. AttacKG+: Boosting Attack Knowledge Graph Construction With Large Language Models 2024 https://arxiv.org/abs/2405.04753. · arXiv
  180. 10.1016/j.cose.2024.103999 · DOI
  181. 10.1145/3696427 · DOI
  182. SchwartzY. Ben-ShimolL. MimranD. EloviciY. andShabtaiA. LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules From Cloud-Based CTI Proceedings of the ACM on Web Conference 2025 2025 Sydney 1922–1941 https://doi.org/10.1145/3696410.3714798. · DOI
  183. ChengY. BajaberO. TsegaiS. A. SongD. andGaoP. CTINexus: Leveraging Optimized LLM In-Context Learning for Constructing Cybersecurity Knowledge Graphs under Data Scarcity 2024 https://arxiv.org/html/2410.21060v1.
  184. PerrinaF. MarchioriF. ContiM. andVerdeN. V. AGIR: Automating Cyber Threat Intelligence Reporting With Natural Language Generation Proceedings of the 2023 IEEE International Conference on Big Data (BigData) 2023 Sorrento 3053–3062 https://doi.org/10.1109/BigData59044.2023.10386116. · DOI
  185. 10.1016/j.fsidi.2023.301683 · DOI
  186. HembergE. KellyJ. Shlapentokh-RothmanM.et al. Linking Threat Tactics Techniques and Patterns With Defensive Weaknesses Vulnerabilities and Affected Platform Configurations for Cyber Hunting 2020 https://arxiv.org/abs/2010.00533. · arXiv
  187. 10.1145/3737459 · DOI
  188. AmpelB. SamtaniS. UllmanS. andChenH. Linking Common Vulnerabilities and Exposures to the Mitre ATT&CK Framework: A Self-Distillation Approach 2021 https://arxiv.org/abs/2108.01696. · arXiv
  189. DasS. S. SerraE. HalappanavarM. PothenA. andAl-ShaerE. V2W-BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities Proceedings of the 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA) 2021 Porto 1–12 https://doi.org/10.1109/DSAA53316.2021.9564227. · DOI
  190. DasS. S. DuttaA. PurohitS. SerraE. HalappanavarM. andPothenA. Towards Automatic Mapping of Vulnerabilities to Attack Patterns Using Large Language Models Proceedings of the 2022 IEEE International Symposium on Technologies for Homeland Security (HST) 2022 Boston MA: IEEE 1–7 https://doi.org/10.1109/HST56032.2022.10025459. · DOI
  191. 10.3390/a15090314 · DOI
  192. JinJ. TangB. MaM.et al. Crimson: Empowering Strategic Reasoning in Cybersecurity Through Large Language Models 2024 https://arxiv.org/abs/2403.00878. · arXiv
  193. WebbB. K. PurohitS. andMeyurR. Cyber Knowledge Completion Using Large Language Models 2024 https://arxiv.org/abs/2409.16176. · arXiv
  194. FayyaziR. TaghdimiR. andYangS. J. Advancing Ttp Analysis: Harnessing the Power of Large Language Models With Retrieval Augmented Generation Proceedings of the 2024 Annual Computer Security Applications Conference Workshops (ACSAC Workshops) 2024 Honolulu HI 255–261 https://doi.org/10.1109/ACSACW65225.2024.00036. · DOI
  195. 10.3390/bdcc9020023 · DOI · Paper page
  196. FrancoM. F. RodriguesB. ScheidE. J.et al. SecBot: A Business-Driven Conversational Agent for Cybersecurity Planning and Management Proceedings of the 2020 16th International Conference on Network and Service Management (CNSM) 2020 Izmir 1–7 https://doi.org/10.23919/CNSM50824.2020.9269037. · DOI
  197. SinglaT. AnandayuvarajD. KaluK. G. SchorlemmerT. R. andDavisJ. C. An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses 2023 Copenhagen 5–15 https://doi.org/10.1145/3605770.3625214. · DOI · Paper page
  198. 10.1016/j.eswa.2024.125509 · DOI
  199. KahehM. KholghD. K. andKostakosP. Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks With GPT-4 2023 https://arxiv.org/abs/2309.16422. · arXiv
  200. RajapakshaS. RaniR. andKarafiliE. A RAG-Based Question-Answering Solution for Cyber-Attack Investigation and Attribution Proceedings of the 2024 European Symposium on Research in Computer Security 2024 Bydgoszcz 238–256 https://doi.org/10.1007/978-3-031-82362-6_15. · DOI

200 of 260 shown

Cited by

Sorted by citations

Authors
Habibzadeh, A., Feyzi, F., & Atani, R. E.
ORCID
Venue
Journal of Electrical and Computer Engineering
Publisher
Wiley
Published
2026-01
Volume
2026
Issue
1
ISSN
  • 2090-0147 (ISSN-L)
  • 2090-0155
DOI
10.1155/jece/3383674
OpenAlex
W4415250047
Cited by
13
References
2
Citations by year
2026: 13
FWCI
49.64
Type
journal article
Language
en
Open access
Licence
Locations
  • Journal of Electrical and Computer Engineering (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
large language models, security operations center, automated incident response, alarm fatigue, NIST Cybersecurity Framework, MITRE ATT&CK, threat detection, incident response time, incident recovery

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review