CoChat
Sign Up
Cited by 27Information and Cyber SecurityNetwork Security and Intrusion DetectionAdversarial Robustness in Machine Learning

LLMs in Cyber Security: Bridging Practice and Education

Open access
Atlam, Hany F.·2025·Big Data and Cognitive Computing
DOI 10.3390/bdcc9070184
Open this paper in CoChat — free accountOpen PDF

Abstract

Large Language Models (LLMs) have emerged as powerful tools in cyber security, enabling automation, threat detection, and adaptive learning. Their ability to process unstructured data and generate context-aware outputs supports both operational tasks and educational initiatives. Despite their growing adoption, current research often focuses on isolated applications, lacking a systematic understanding of how LLMs align with domain-specific requirements and pedagogical effectiveness. This highlights a pressing need for comprehensive evaluations that address the challenges of integration, generalization, and ethical deployment in both operational and educational cyber security environments. Therefore, this paper provides a comprehensive and State-of-the-Art review of the significant role of LLMs in cyber security, addressing both operational and educational dimensions. It introduces a holistic framework that categorizes LLM applications into six key cyber security domains, examining each in depth to demonstrate their impact on automation, context-aware reasoning, and adaptability to emerging threats. The paper highlights the potential of LLMs to enhance operational performance and educational effectiveness while also exploring emerging technical, ethical, and security challenges. The paper also uniquely addresses the underexamined area of LLMs in cyber security education by reviewing recent studies and illustrating how these models support personalized learning, hands-on training, and awareness initiatives. The key findings reveal that while LLMs offer significant potential in automating tasks and enabling personalized learning, challenges remain in model generalization, ethical deployment, and production readiness. Finally, the paper discusses open issues and future research directions for the application of LLMs in both operational and educational contexts. This paper serves as a valuable reference for researchers, educators, and practitioners aiming to develop intelligent, adaptive, scalable, and ethically responsible LLM-based cyber security solutions.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/bdcc9070184

Cites

12 of 12 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Agents inherit and amplify LLM weaknesses-hallucination, prompt sensitivity, contextual drift-and propagate them across longer decision chains.

    “Agents inherit and amplify the weaknesses of the underlying LLM-hallucination, prompt sensitivity, and contextual drift-and propagate them across longer decision chains [20,21].”

    From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [21]

    Section 6.1, “Model Reliability and Accuracy” (page not provided), reports LLM hallucinations and reliability that varies with prompt structure and context. The paper also describes difficulty with multi-step reasoning, but the passages do not establish that agents amplify these weaknesses or propagate them across longer decision chains; they do not specifically establish contextual drift in agents. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • Hallucination-resistant security planning, structured-prompt frameworks for CoT integrity, and verifiable autonomous reasoning are identified open problems.

    “Hallucination-resistant security planning, structured-prompt frameworks for CoT integrity, and verifiable autonomous reasoning are now identified open problems [21,70].”

    From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [21]

    Section 8.1 (page unavailable) identifies hallucinations in cyber security as an open concern and calls for more reliable, validated outputs. Section 8.3 (page unavailable) calls for interpretable reasoning and mentions chain-of-thought prompting. Neither section identifies hallucination-resistant security planning, structured-prompt frameworks for CoT integrity, or verifiable autonomous reasoning as the specific open problems claimed. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • A certain degree of hallucination is intrinsic to models that generalize from their training distributions.

    “and the literature indicates that a certain degree of hallucination is intrinsic to models that generalize from their training distributions [17], [18], [19].”

    From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [18]

    Section 7.3.1 describes hallucination as a persistent problem for LLMs, and Section 8.1 says they tend to produce factually incorrect information. Neither section says some hallucination is intrinsic to models that generalize from their training distributions; the proposed explanation and inevitability are not supported by this paper. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 100

  1. Scanlon, M.; Breitinger, F.; Hargreaves, C.; Hilgert, J.-N.; Sheppard, J. ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown. arXiv 2023, arXiv:2307.10195. [CrossRef] · DOI · Paper page
  2. Kouliaridis, V.; Karopoulos, G.; Kambourakis, G. Assessing the Effectiveness of LLMs in Android Application Vulnerability Analysis. In Attacks and Defenses for the Internet-of-Things; Springer: Cham, Switzerland, 2025; Volume 15397, pp. 139-154. [CrossRef] · DOI
  3. Jin, J.; Tang, B.; Ma, M.; Liu, X.; Wang, Y.; Lai, Q.; Yang, J.; Zhou, C. Crimson: Empowering Strategic Reasoning in Cybersecurity through Large Language Models. arXiv 2024, arXiv:2403.00878. [CrossRef] · DOI · Paper page
  4. Jada, I.; Mayayise, T.O. The impact of artificial intelligence on organisational cyber security: An outcome of a systematic literature review. Data Inf. Manag. 2024, 8, 100063. [CrossRef] · DOI
  5. Gandhi, P.A.; Wudali, P.N.; Amaru, Y.; Elovici, Y.; Shabtai, A. SHIELD: APT Detection and Intelligent Explanation Using LLM. arXiv 2025, arXiv:2502.02342. [CrossRef] · DOI
  6. Shafee, S.; Bessani, A.; Ferreira, P.M. Evaluation of LLM Chatbots for OSINT-based Cyber Threat Awareness. arXiv 2024, arXiv:2401.15127. [CrossRef] · DOI
  7. Sheng, Z.; Chen, Z.; Gu, S.; Huang, H.; Gu, G.; Huang, J. LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights. arXiv 2025, arXiv:2502.07049. [CrossRef] · DOI
  8. Agrawal, G. AISecKG: Knowledge Graph Dataset for Cybersecurity Education. In Proceedings of the AAAI-MAKE 2023: Challenges Requiring the Combination of Machine Learning 2023, San Francisco, CA, USA, 27-29 March 2023. Available online: https://par.nsf.gov/biblio/10401616-aiseckg-knowledge-graph-dataset-cybersecurity-education (accessed on 22 April 2025).
  9. Raiaan, M.A.K.; Mukta, M.S.H.; Fatema, K.; Fahad, N.M.; Sakib, S.; Mim, M.M.J.; Ahmad, J.; Ali, M.E.; Azam, S. A Review on Large Language Models: Architectures, Applications, Taxonomies, Open Issues and Challenges. IEEE Access 2024, 12, 26839-26874. [CrossRef] · DOI
  10. Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A.N.; Kaiser, L.; Polosukhin, I. Attention Is All You Need. arXiv 2023, arXiv:1706.03762. [CrossRef] · DOI · Paper page
  11. Schmid, L.; Hey, T.; Armbruster, M.; Corallo, S.; Fuchß, D.; Keim, J.; Liu, H.; Koziolek, A. Software Architecture Meets LLMs: A Systematic Literature Review. arXiv 2025, arXiv:2505.16697. [CrossRef] · DOI
  12. Devlin, J.; Chang, M.-W.; Lee, K.; Toutanova, K. BERT: Pre-training of Deep Bidirectional Transformers for Language Understand- ing. arXiv 2019, arXiv:1810.04805. [CrossRef] · DOI · Paper page
  13. Fedus, W.; Zoph, B.; Shazeer, N. Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsity. arXiv 2021, arXiv:2101.03961. · arXiv
  14. Brown, T.B.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al. Language Models are Few-Shot Learners. arXiv 2020, arXiv:2005.14165. [CrossRef] · DOI · Paper page
  15. Shoeybi, M.; Patwary, M.; Puri, R.; LeGresley, P.; Casper, J.; Catanzaro, B. Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelism. arXiv 2020, arXiv:1909.08053. [CrossRef] · DOI · Paper page
  16. Sahami, M.; Dumais, S.; Heckerman, D.; Horvitz, E. A Bayesian Approach to Filtering Junk Email. AAAI Technical Report; 1998; pp. 55-62. Available online: https://aaai.org/papers/055-ws98-05-009/ (accessed on 22 April 2025).
  17. Eskin, E.; Arnold, A.; Prerau, M.; Portnoy, L.; Stolfo, S. A Geometric Framework for Unsupervised Anomaly Detection; Barbará, D., Jajodia, S., Eds.; Springer US: Boston, MA, USA, 2002; Volume 6, pp. 77-101.
  18. Kim, G.; Lee, S.; Kim, S. A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Syst. Appl. 2014, 41, 1690-1700. [CrossRef] · DOI
  19. Saxe, J.; Berlin, K. Deep neural network based malware detection using two dimensional binary program features. In Proceedings of the 2015 10th International Conference on Malicious and Unwanted Software (MALWARE), Fajardo, PR, USA, 20-22 October 2015; pp. 11-20.
  20. Biggio, B.; Roli, F. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognit. 2018, 84, 317-331. [CrossRef] · DOI
  21. Raff, E.; Barker, J.; Sylvester, J.; Brandon, R.; Catanzaro, B.; Nicholas, C. Malware Detection by Eating a Whole EXE. arXiv 2017, arXiv:1710.09435. [CrossRef] · DOI
  22. Kolias, C.; Kambourakis, G.; Stavrou, A.; Gritzalis, S. Intrusion Detection in 802.11 Networks: Empirical Evaluation of Threats and a Public Dataset. IEEE Commun. Surv. Tutor. 2016, 18, 184-208. [CrossRef] · DOI
  23. Sommer, R.; Paxson, V. Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. In Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA, 16-19 May 2010; pp. 305-316.
  24. García-Teodoro, P.; Díaz-Verdejo, J.; Maciá-Fernández, G.; Vázquez, E. Anomaly-based network intrusion detection: Techniques, systems and challenges. Comput. Secur. 2009, 28, 18-28. [CrossRef] · DOI · Paper page
  25. Liu, X.; Yu, Z.; Zhang, Y.; Zhang, N.; Xiao, C. Automatic and Universal Prompt Injection Attacks against Large Language Models. arXiv 2024, arXiv:2403.04957. [CrossRef] · DOI
  26. Uddin, M.A.; Sarker, I.H. An Explainable Transformer-based Model for Phishing Email Detection: A Large Language Model Approach. arXiv 2024, arXiv:2402.13871. [CrossRef] · DOI
  27. Yan, B.; Li, K.; Xu, M.; Dong, Y.; Zhang, Y.; Ren, Z.; Cheng, X. On protecting the data privacy of Large Language Models (LLMs) and LLM agents: A literature review. High-Confid. Comput. 2025, 5, 100300. [CrossRef] · DOI
  28. Akinyele, A.R.; Ajayi, O.O.; Munyaneza, G.; Ibecheozor, U.H.B.; Gopakumar, N.; Akinyele, A.R.; Ajayi, O.O.; Munyaneza, G.; Ibecheozor, U.H.B.; Gopakumar, N. Leveraging Generative Artificial Intelligence (AI) for cybersecurity: Analyzing diffusion models in detecting and mitigating cyber threats. GSC Adv. Res. Rev. 2024, 21, 1-14. [CrossRef] · DOI
  29. Gupta, P.; Ding, B.; Guan, C.; Ding, D. Generative AI: A systematic review using topic modelling techniques. Data Inf. Manag. 2024, 8, 100066. [CrossRef] · DOI
  30. Noever, D. Can Large Language Models Find And Fix Vulnerable Software? arXiv 2023, arXiv:2308.10345. [CrossRef] · DOI
  31. Nahmias, D.; Engelberg, G.; Klein, D.; Shabtai, A. Prompted Contextual Vectors for Spear-Phishing Detection. arXiv 2024, arXiv:2402.08309. [CrossRef] · DOI · Paper page
  32. Sovrano, F.; Bauer, A.; Bacchelli, A. Large Language Models for In-File Vulnerability Localization Can Be "Lost in the End". Proc. ACM Softw. Eng. 2025, 2, FSE041. [CrossRef] · DOI
  33. Isozaki, I.; Shrestha, M.; Console, R.; Kim, E. Towards Automated Penetration Testing: Introducing LLM Benchmark, Analysis, and Improvements. arXiv 2025, arXiv:2410.17141. [CrossRef] · DOI
  34. Happe, A.; Kaplan, A.; Cito, J. LLMs as Hackers: Autonomous Linux Privilege Escalation Attacks. arXiv 2025, arXiv:2310.11409. [CrossRef] · DOI
  35. Zhang, C.; Liu, H.; Zeng, J.; Yang, K.; Li, Y.; Li, H. Prompt-Enhanced Software Vulnerability Detection Using ChatGPT. In Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, Lisbon, Portugal, 14-20 April 2024; Association for Computing Machinery: New York, NY, USA, 2024; pp. 276-277.
  36. Zhou, X.; Cao, S.; Sun, X.; Lo, D. Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Ahead. arXiv 2024, arXiv:2404.02525. [CrossRef] · DOI
  37. Zhou, X.; Tran, D.-M.; Le-Cong, T.; Zhang, T.; Irsan, I.C.; Sumarlin, J.; Le, B.; Lo, D. Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection. arXiv 2024, arXiv:2407.16235. [CrossRef] · DOI
  38. Tamberg, K.; Bahsi, H. Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study. IEEE Access 2025, 13, 29698-29717. [CrossRef] · DOI
  39. Mahyari, A.A. Harnessing the Power of LLMs in Source Code Vulnerability Detection. arXiv 2024, arXiv:2408.03489. [CrossRef] · DOI
  40. Mao, Q.; Li, Z.; Hu, X.; Liu, K.; Xia, X.; Sun, J. Towards Explainable Vulnerability Detection with Large Language Models. arXiv 2025, arXiv:2406.09701. [CrossRef] · DOI
  41. Cheshkov, A.; Zadorozhny, P.; Levichev, R. Evaluation of ChatGPT Model for Vulnerability Detection. arXiv 2023, arXiv:2304.07232. [CrossRef] · DOI
  42. Purba, M.D.; Ghosh, A.; Radford, B.J.; Chu, B. Software Vulnerability Detection using Large Language Models. In Proceedings of the 2023 IEEE 34th International Symposium on Software Reliability Engineering Workshops (ISSREW), Florence, Italy, 9-12 October 2023; pp. 112-119.
  43. Dozono, K.; Gasiba, T.E.; Stocco, A. Large Language Models for Secure Code Assessment: A Multi-Language Empirical Study. arXiv 2024, arXiv:2408.06428. [CrossRef] · DOI
  44. Berabi, B.; Gronskiy, A.; Raychev, V.; Sivanrupan, G.; Chibotaru, V.; Vechev, M. DeepCode AI Fix: Fixing Security Vulnerabilities with Large Language Models. arXiv 2024, arXiv:2402.13291. [CrossRef] · DOI
  45. Sheng, Z.; Wu, F.; Zuo, X.; Li, C.; Qiao, Y.; Hang, L. LProtector: An LLM-driven Vulnerability Detection System. arXiv 2024, arXiv:2411.06493. [CrossRef] · DOI
  46. Khare, A.; Dutta, S.; Li, Z.; Solko-Breslin, A.; Alur, R.; Naik, M. Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilities. arXiv 2024, arXiv:2311.16169. [CrossRef] · DOI · Paper page
  47. Jensen, R.I.T.; Tawosi, V.; Alamir, S. Software Vulnerability and Functionality Assessment using LLMs. arXiv 2024, arXiv:2403.08429. [CrossRef] · DOI · Paper page
  48. Shestov, A.; Levichev, R.; Mussabayev, R.; Maslov, E.; Cheshkov, A.; Zadorozhny, P. Finetuning Large Language Models for Vulnerability Detection. arXiv 2024, arXiv:2401.17010. [CrossRef] · DOI
  49. Li, H.; Hao, Y.; Zhai, Y.; Qian, Z. The Hitchhiker's Guide to Program Analysis: A Journey with Large Language Models. arXiv 2023, arXiv:2308.00245. [CrossRef] · DOI
  50. Guo, Y.; Patsakis, C.; Hu, Q.; Tang, Q.; Casino, F. Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection. In Computer Security-ESORICS 2024: 29th European Symposium on Research in Computer Security, Bydgoszcz, Poland, 16-20 September 2024, Proceedings, Part I; Springer: Berlin/Heidelberg, Germany, 2024; pp. 271-289.
  51. Wang, J.; Huang, Z.; Liu, H.; Yang, N.; Xiao, Y. DefectHunter: A Novel LLM-Driven Boosted-Conformer-based Code Vulnerability Detection Mechanism. arXiv 2023, arXiv:2309.15324. [CrossRef] · DOI
  52. Bakhshandeh, A.; Keramatfar, A.; Norouzi, A.; Chekidehkhoun, M.M. Using ChatGPT as a Static Application Security Testing Tool. arXiv 2023, arXiv:2308.14434. [CrossRef] · DOI
  53. Mathews, N.S.; Brus, Y.; Aafer, Y.; Nagappan, M.; McIntosh, S. LLbezpeky: Leveraging Large Language Models for Vulnerability Detection. arXiv 2024, arXiv:2401.01269. [CrossRef] · DOI
  54. Lin, Y.-Z.; Mamun, M.; Chowdhury, M.A.; Cai, S.; Zhu, M.; Latibari, B.S.; Gubbi, K.I.; Bavarsad, N.N.; Caputo, A.; Sasan, A.; et al. HW-V2W-Map: Hardware Vulnerability to Weakness Mapping Framework for Root Cause Analysis with GPT-assisted Mitigation Suggestion. arXiv 2023, arXiv:2312.13530. [CrossRef] · DOI
  55. Kaheh, M.; Kholgh, D.K.; Kostakos, P. Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks with GPT-4. arXiv 2023, arXiv:2309.16422. [CrossRef] · DOI · Paper page
  56. Dolcetti, G.; Arceri, V.; Iotti, E.; Maffeis, S.; Cortesi, A.; Zaffanella, E. Helping LLMs Improve Code Generation Using Feedback from Testing and Static Analysis. arXiv 2025, arXiv:2412.14841. [CrossRef] · DOI · Paper page
  57. Feng, R.; Pearce, H.; Liguori, P.; Sui, Y. CGP-Tuning: Structure-Aware Soft Prompt Tuning for Code Vulnerability Detection. arXiv 2025, arXiv:2501.04510. [CrossRef] · DOI
  58. Lin, J.; Mohaisen, D. Evaluating Large Language Models in Vulnerability Detection Under Variable Context Windows. arXiv 2025, arXiv:2502.00064. [CrossRef] · DOI
  59. Torkamani, M.J.; NG, J.; Mehrotra, N.; Chandramohan, M.; Krishnan, P.; Purandare, R. Streamlining Security Vulnerability Triage with Large Language Models. arXiv 2025, arXiv:2501.18908. [CrossRef] · DOI
  60. Ghosh, R.; von Stockhausen, H.-M.; Schmitt, M.; Vasile, G.M.; Karn, S.K.; Farri, O. CVE-LLM: Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models. arXiv 2025, arXiv:2502.15932. [CrossRef] · DOI
  61. Liu, Y.; Tao, S.; Meng, W.; Wang, J.; Ma, W.; Chen, Y.; Zhao, Y.; Yang, H.; Jiang, Y. Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies. In Proceedings of the 32nd IEEE/ACM International Conference on Program Comprehension, Lisbon, Portugal, 15-16 April 2024; Association for Computing Machinery: New York, NY, USA, 2024; pp. 35-46.
  62. Zhang, W.; Guan, X.; Yunhong, L.; Zhang, J.; Song, S.; Cheng, X.; Wu, Z.; Li, Z. Lemur: Log Parsing with Entropy Sampling and Chain-of-Thought Merging. arXiv 2025, arXiv:2402.18205. [CrossRef] · DOI
  63. Liu, J.; Huang, J.; Huo, Y.; Jiang, Z.; Gu, J.; Chen, Z.; Feng, C.; Yan, M.; Lyu, M.R. Log-based Anomaly Detection based on EVT Theory with feedback. arXiv 2023, arXiv:2306.05032. [CrossRef] · DOI
  64. Qi, J.; Huang, S.; Luan, Z.; Yang, S.; Fung, C.; Yang, H.; Qian, D.; Shang, J.; Xiao, Z.; Wu, Z. LogGPT: Exploring ChatGPT for Log-Based Anomaly Detection. In Proceedings of the 2023 IEEE International Conference on High Performance Computing & Communications, Data Science & Systems, Smart City & Dependability in Sensor, Cloud & Big Data Systems & Application (HPCC/DSS/SmartCity/DependSys), Melbourne, Australia, 13-15 December 2023; pp. 273-280.
  65. Han, X.; Yuan, S.; Trabelsi, M. LogGPT: Log Anomaly Detection via GPT. In Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy, 5-18 December 2023; pp. 1117-1122.
  66. Si, S.; Wu, Y.; Tang, L.; Zhang, Y.; Wosik, J.; Su, Q. Evaluating the Performance of ChatGPT for Spam Email Detection. arXiv 2025, arXiv:2402.15537. [CrossRef] · DOI
  67. Heiding, F.; Schneier, B.; Vishwanath, A.; Bernstein, J.; Park, P.S. Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models. arXiv 2023, arXiv:2308.12287. [CrossRef] · DOI
  68. Vörös, T.; Bergeron, S.P.; Berlin, K. Web Content Filtering Through Knowledge Distillation of Large Language Models. In Proceedings of the 2023 IEEE/WIC International Conference on Web Intelligence and Intelligent Agent Technology (WI-IAT), Venice, Italy, 26-29 October 2023; pp. 357-361.
  69. Chen, Y., Lin, C.-W., Chen, B., Zhu, Q., Eds.; Springer Nature Switzerland: Cham, Switzerland, 2024; pp. 83-99.
  70. Alnegheimish, S.; Nguyen, L.; Berti-Equille, L.; Veeramachaneni, K. Large language models can be zero-shot anomaly detectors for time series? arXiv 2024, arXiv:2405.14755. [CrossRef] · DOI
  71. Gu, Z.; Zhu, B.; Zhu, G.; Chen, Y.; Tang, M.; Wang, J. AnomalyGPT: Detecting Industrial Anomalies Using Large Vision-Language Models. arXiv 2023, arXiv:2308.15366. [CrossRef] · DOI
  72. Li, A.; Zhao, Y.; Qiu, C.; Kloft, M.; Smyth, P.; Rudolph, M.; Mandt, S. Anomaly Detection of Tabular Data Using LLMs. arXiv 2024, arXiv:2406.16308. [CrossRef] · DOI
  73. Guan, W.; Cao, J.; Qian, S.; Gao, J.; Ouyang, C. LogLLM: Log-based Anomaly Detection Using Large Language Models. arXiv 2025, arXiv:2411.08561. [CrossRef] · DOI · Paper page
  74. Su, J.; Jiang, C.; Jin, X.; Qiao, Y.; Xiao, T.; Ma, H.; Wei, R.; Jing, Z.; Xu, J.; Lin, J. Large Language Models for Forecasting and Anomaly Detection: A Systematic Literature Review. arXiv 2024, arXiv:2402.10350. [CrossRef] · DOI · Paper page
  75. Ali, T.; Kostakos, P. HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs). arXiv 2023, arXiv:2309.16021. [CrossRef] · DOI · Paper page
  76. Liu, X.; Liang, J.; Yan, Q.; Jang, J.; Mao, S.; Ye, M.; Jia, J.; Xi, Z. Cyber Defense Reinvented: Large Language Models as Threat Intelligence Copilots. arXiv 2025, arXiv:2502.20791. [CrossRef] · DOI
  77. Wang, Y.; Yang, X. Design and implementation of a distributed security threat detection system integrating federated learning and multimodal LLM. arXiv 2025, arXiv:2502.17763. [CrossRef] · DOI
  78. Qian, X.; Zheng, X.; He, Y.; Yang, S.; Cavallaro, L. LAMD: Context-driven Android Malware Detection and Classification with LLMs. arXiv 2025, arXiv:2502.13055. [CrossRef] · DOI
  79. Benabderrahmane, S.; Valtchev, P.; Cheney, J.; Rahwan, T. APT-LLM: Embedding-Based Anomaly Detection of Cyber Advanced Persistent Threats Using Large Language Models. arXiv 2025, arXiv:2502.09385. [CrossRef] · DOI
  80. Meguro, R.; Chong, N.S.T. AdaPhish: AI-Powered Adaptive Defense and Education Resource Against Deceptive Emails. In Proceedings of the 2025 IEEE 4th International Conference on AI in Cybersecurity (ICAIC), Houston, TX, USA, 5-7 February 2025; pp. 1-7.
  81. Akhtar, S.; Khan, S.; Parkinson, S. LLM-based event log analysis techniques: A survey. arXiv 2025, arXiv:2502.00677. [CrossRef] · DOI
  82. Walton, B.J.; Khatun, M.E.; Ghawaly, J.M.; Ali-Gombe, A. Exploring Large Language Models for Semantic Analysis and Categorization of Android Malware. arXiv 2025, arXiv:2501.04848. [CrossRef] · DOI
  83. Mitra, S.; Neupane, S.; Chakraborty, T.; Mittal, S.; Piplai, A.; Gaur, M.; Rahimi, S. LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge. arXiv 2025, arXiv:2401.10036. [CrossRef] · DOI
  84. Perrina, F.; Marchiori, F.; Conti, M.; Verde, N.V. AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generation. In Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy, 15-18 December 2023; pp. 3053-3062.
  85. Fayyazi, R.; Yang, S.J. On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions. arXiv 2023, arXiv:2306.14062. [CrossRef] · DOI
  86. Schwartz, Y.; Benshimol, L.; Mimran, D.; Elovici, Y.; Shabtai, A. LLMCloudHunter: Harnessing LLMs for Automated Extraction of Detection Rules from Cloud-Based CTI. arXiv 2024, arXiv:2407.05194. [CrossRef] · DOI
  87. Clairoux-Trepanier, V.; Beauchamp, I.-M.; Ruellan, E.; Paquet-Clouston, M.; Paquette, S.-O.; Clay, E. The Use of Large Language Models (LLM) for Cyber Threat Intelligence (CTI) in Cybercrime Forums. arXiv 2024, arXiv:2408.03354. [CrossRef] · DOI
  88. Siracusano, G.; Sanvito, D.; Gonzalez, R.; Srinivasan, M.; Kamatchi, S.; Takahashi, W.; Kawakita, M.; Kakumaru, T.; Bifulco, R. Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild. arXiv 2023, arXiv:2307.10214. [CrossRef] · DOI
  89. Hu, E.J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; Chen, W. LoRA: Low-Rank Adaptation of Large Language Models', presented at the International Conference on Learning Representations. 2022. Available online: https: //openreview.net/forum?id=nZeVKeeFYf9 (accessed on 21 April 2025).
  90. Zhang, Y.; Du, T.; Ma, Y.; Wang, X.; Xie, Y.; Yang, G.; Lu, Y.; Chang, E.-C. AttacKG+:Boosting Attack Knowledge Graph Construction with Large Language Models. arXiv 2024, arXiv:2405.04753. [CrossRef] 100. Fieblinger, R.; Alam, M.T.; Rastogi, N. Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models. arXiv 2024, arXiv:2407.02528. [CrossRef] 101. Park, Y.; You, W. A Pretrained Language Model for Cyber Threat Intelligence. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: Industry Track, Singapore, 6-10 December 2023; · DOI
  91. Wang, M., Zitouni, I., Eds.; Association for Computational Linguistics: Singapore, 2023; pp. 113-122. 102. Gao, P.; Liu, X.; Choi, E.; Ma, S.; Yang, X.; Song, D. ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management. arXiv 2024, arXiv:2212.10388. [CrossRef] 103. Sorokoletova, O.; Antonioni, E.; Colò, G. Towards a scalable AI-driven framework for data-independent Cyber Threat Intelligence Information Extraction. arXiv 2025, arXiv:2501.06239. [CrossRef] 104 · DOI
  92. Sun, Y.; Wu, D.; Xue, Y.; Liu, H.; Wang, H.; Xu, Z.; Xie, X.; Liu, Y. GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, Lisbon, Portugal, 14-20 April 2024; pp. 1-13. 120. Hossain, S.M.M.; Altarawneh, A.; Roberts, J. Leveraging Large Language Models and Machine Learning for Smart Contract Vulnerability Detection. In Proceedings of the 2025 IEEE 15th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 6-8 January 2025; pp. 00577-00583. 121
  93. Yu, L.; Chen, S.; Yuan, H.; Wang, P.; Huang, Z.; Zhang, J.; Shen, C.; Zhang, F.; Yang, L.; Ma, J. Smart-LLaMA: Two-Stage Post- Training of Large Language Models for Smart Contract Vulnerability Detection and Explanation. arXiv 2024, arXiv:2411.06221. [CrossRef] 122. Zaazaa, O.; Bakkali, H.E. SmartLLMSentry: A Comprehensive LLM Based Smart Contract Vulnerability Detection Framework. J. Metaverse 2024, 4, 126-137. [CrossRef] 123. Wei, Z.; Sun, J.; Zhang, Z.; Zhang, X.; Li, M.; Hou, Z. LLM-SmartAudit: Advanced Smart Contract Vulnerability Detection. arXiv 2024, arXiv:2410.09381. [CrossRef] 124. He, Z.; Li, Z.; Yang, S.; Ye, H.; Qiao, A.; Zhang, X.; Luo, X.; Chen, T. Large Language Models for Blockchain Security: A Systematic Literature Review. arXiv 2025, arXiv:2403.14280. [CrossRef] 125. Ding, H.; Liu, Y.; Piao, X.; Song, H.; Ji, Z. SmartGuard: An LLM-enhanced framework for smart contract vulnerability detection. Expert Syst. Appl. 2025, 269, 126479. [CrossRef] 126. Ma, W.; Wu, D.; Sun, Y.; Wang, T.; Liu, S.; Zhang, J.; Xue, Y.; Liu, Y. Combining Fine-Tuning and LLM-based Agents for Intuitive Smart Contract Auditing with Justifications. arXiv 2024, arXiv:2403.16073. [CrossRef] 127. Bu, J.; Li, W.; Li, Z.; Zhang, Z.; Li, X. Enhancing Smart Contract Vulnerability Detection in DApps Leveraging Fine-Tuned LLM. arXiv 2025, arXiv:2504.05006. [CrossRef] 128. Deng, G.; Liu, Y.; Mayoral-Vilches, V.; Liu, P.; Li, Y.; Xu, Y.; Zhang, T.; Liu, Y.; Pinzger, M.; Rass, S. PentestGPT: An LLM-empowered Automatic Penetration Testing Tool. arXiv 2024, arXiv:2308.06782. [CrossRef] 129. Fang, R.; Bindu, R.; Gupta, A.; Kang, D. LLM Agents can Autonomously Exploit One-day Vulnerabilities. arXiv 2024, arXiv:2404.08144. [CrossRef] 130. Temara, S. Maximizing Penetration Testing Success with Effective Reconnaissance Techniques using ChatGPT. arXiv 2023, arXiv:2307.06391. [CrossRef] 131. Deng, G.; Liu, Y.; Robotics, A.; Klagenfurt, A.-A.-U.; Liu, P.; Li, Y.; Zhang, T.; Liu, Y.; Klagenfurt, A.-A.-U.; Rass, S. PentestGPt: Evaluating and Harnessing Large Language Models for Automated Penetration Testing. arXiv 2024, arXiv:2308.06782v2. 132. · DOI
  94. Happe, A.; Cito, J. Getting pwn'd by AI: Penetration Testing with Large Language Models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, San Francisco, CA, USA, 3-9 December 2023; ACM: San Francisco CA USA, 2023; pp. 2082-2086. 133.
  95. Bianou, S.G.; Batogna, R.G. PENTEST-AI, an LLM-Powered Multi-Agents Framework for Penetration Testing Automation Leveraging Mitre Attack. In Proceedings of the 2024 IEEE International Conference on Cyber Security and Resilience (CSR), London, UK, 2-4 September 2024; pp. 763-770. 134. Yin, Z.; Wang, Z.; Xu, W.; Zhuang, J.; Mozumder, P.; Smith, A.; Zhang, W. Digital Forensics in the Age of Large Language Models. arXiv 2025, arXiv:2504.02963. [CrossRef] 135. Wickramasekara, A.; Breitinger, F.; Scanlon, M. Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency. Forensic Sci. Int. Digit. Investig. 2025, 52, 301859. [CrossRef] 136. Oh, D.B.; Kim, D.; Kim, D.; Kim, H.K. volGPT: Evaluation on triaging ransomware process in memory forensics with Large Language Model. Forensic Sci. Int. Digit. Investig. 2024, 49, 301756. [CrossRef] 137. Voigt, L.L.; Freiling, F.; Hargreaves, C.J. Re-imagen: Generating coherent background activity in synthetic scenario-based forensic datasets using large language models. Forensic Sci. Int. Digit. Investig. 2024, 50, 301805. [CrossRef] 138. Michelet, G.; Breitinger, F. ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models. Forensic Sci. Int. Digit. Investig. 2024, 48, 301683. [CrossRef] 139. Bhandarkar, A.; Wilson, R.; Swarup, A.; Zhu, M.; Woodard, D. Is the Digital Forensics and Incident Response Pipeline Ready for Text-Based Threats in LLM Era? arXiv 2024, arXiv:2407.17870. [CrossRef] 140. Loumachi, F.Y.; Ghanem, M.C.; Ferrag, M.A. GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Aug- mented Generation and Large Language Models. arXiv 2024, arXiv:2409.02572. [CrossRef] 141. Zhou, H.; Xu, W.; Dehlinger, J.; Chakraborty, S.; Deng, L. An LLM-driven Approach to Gain Cybercrime Insights with Evidence Networks. In Proceedings of the 2024 USENIX Symposium on Usable Privacy and Security (SOUPS), Philadelphia, PA, USA, 11-13 August 2024; pp. 1-3. 142. · DOI
  96. Kim, K.; Lee, C.; Bae, S.; Choi, J.; Kang, W. Digital Forensics in Law Enforcement: A Case Study of Llm-Driven Evidence Analysis; Social Science Research Network: Rochester, NY, USA, 2025; p. 5110258. [CrossRef] 143. Sharma, B.; Ghawaly, J.; McCleary, K.; Webb, A.M.; Baggili, I. ForensicLLM: A local large language model for digital forensics. Forensic Sci. Int. Digit. Investig. 2025, 52, 301872. [CrossRef] 144. Xu, E.; Zhang, W.; Xu, W. Transforming Digital Forensics with Large Language Models: Unlocking Automation, Insights, and Justice. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, Boise, IH, USA, 22-25 October 2024; Association for Computing Machinery: New York, NY, USA, 2024; pp. 5543-5546. 145. Cho, S.-H.; Kim, D.; Kwon, H.-C.; Kim, M. Exploring the potential of large language models for author profiling tasks in digital text forensics. Forensic Sci. Int. Digit. Investig. 2024, 50, 301814. [CrossRef] 146. Rahali, A.; Akhloufi, M.A. MalBERTv2: Code Aware BERT-Based Model for Malware Identification. Big Data Cogn. Comput. 2023, 7, 60. [CrossRef] 147. Rondanini, C.; Carminati, B.; Ferrari, E.; Gaudiano, A.; Kundu, A. Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluation. arXiv 2025, arXiv:2503.04302. [CrossRef] 148. · DOI
  97. Wudali, P.N.; Kravchik, M.; Malul, E.; Gandhi, P.A.; Elovici, Y.; Shabtai, A. Rule-ATT&CK Mapper (RAM): Mapping SIEM Rules to TTPs Using LLMs. arXiv 2025, arXiv:2502.02337. [CrossRef] 151. · DOI
  98. Zhao, C.; Maria, R.D.; Kumarage, T.; Chaudhary, K.S.; Agrawal, G.; Li, Y.; Park, J.; Deng, Y.; Chen, Y.-C.; Liu, H. CyberBOT: To- wards Reliable Cybersecurity Education via Ontology-Grounded Retrieval Augmented Generation. arXiv 2025, arXiv:2504.00389. [CrossRef] 159. Shepherd, C. Generative AI Misuse Potential in Cyber Security Education: A Case Study of a UK Degree Program. arXiv 2025, arXiv:2501.12883. [CrossRef] 160. Ohm, M.; Bungartz, C.; Boes, F.; Meier, M. Assessing the Impact of Large Language Models on Cybersecurity Education: A Study of ChatGPT's Influence on Student Performance. In Proceedings of the 19th International Conference on Availability, Reliability and Security, Vienna, Austria, 30 July 2024-2 August 2024; Association for Computing Machinery: New York, NY, USA, 2024; pp. 1-7. 161. · DOI
  99. Nizon-Deladoeuille, M.; Stefánsson, B.; Neukirchen, H.; Welsh, T. Towards Supporting Penetration Testing Education with Large Language Models: An Evaluation and Comparison. In Proceedings of the 2024 11th International Conference on Social Networks Analysis, Management and Security (SNAMS), Gran Canaria, Spain, 9-11 December 2024; pp. 227-229. 162. Al-Dhamari, N.; Clarke, N. GPT-Enabled Cybersecurity Training: A Tailored Approach for Effective Awareness. arXiv 2024, arXiv:2405.04138. [CrossRef] 163. Wang, T.; Zhou, N.; Chen, Z. CyberMentor: AI Powered Learning Tool Platform to Address Diverse Student Needs in Cybersecu- rity Education. arXiv 2025, arXiv:2501.09709. [CrossRef] 164. Tann, W.; Liu, Y.; Sim, J.H.; Seah, C.M.; Chang, E.-C. Using Large Language Models for Cybersecurity Capture-The-Flag Challenges and Certification Questions. arXiv 2023, arXiv:2308.10443. [CrossRef] 165. Shao, M.; Chen, B.; Jancheska, S.; Dolan-Gavitt, B.; Garg, S.; Karri, R.; Shafique, M. An Empirical Evaluation of LLMs for Solving Offensive Security Challenges. arXiv 2024, arXiv:2402.11814. [CrossRef] 166. Nelson, C.; Doupé, A.; Shoshitaishvili, Y. SENSAI: Large Language Models as Applied Cybersecurity Tutors. In Proceedings of the 56th ACM Technical Symposium on Computer Science Education V. 1, Pittsburgh, PA, USA, 26 February-1 March 2025; Association for Computing Machinery: New York, NY, USA, 2025; pp. 833-839. 167. Joon; Simmons, R. Innovating Cybersecurity Education Through AI-augmented Teaching. ECCWS 2024, 23, 476-482. · DOI
  100. CrossRef · DOI

Cited by

Sorted by citations

Authors
Atlam, H. F.
Affiliations
University of Warwick (GB)
Corresponding author
Atlam, Hany F.
ORCID
Atlam, Hany F.
Venue
Big Data and Cognitive Computing
Publisher
MDPI AG
Published
2025-07-08
Volume
9
Issue
7
Pages
184
ISSN
2504-2289 (ISSN-L)
DOI
10.3390/bdcc9070184
OpenAlex
W4412100992
Cited by
27
References
12
Citations by year
2026: 21 · 2025: 6
FWCI
28.07
Type
journal article
Language
en
Open access
Licence
Locations
  • Big Data and Cognitive Computing (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
large language models, cybersecurity, cybersecurity education, threat detection, automation, personalized learning, hands-on training, model generalization, production readiness, contextual reasoning, emerging threats

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review