Large Language Models in Cybersecurity: State-of-the-Art
Open accessAbstract
The rise of Large Language Models (LLMs) has revolutionized our comprehension of intelligence bringing us closer to Artificial Intelligence. Since their introduction, researchers have actively explored the applications of LLMs across diverse fields, significantly elevating capabilities. Cybersecurity, traditionally resistant to data-driven solutions and slow to embrace machine learning, stands out as a domain. This study examines the existing literature, providing a thorough characterization of both defensive and adversarial applications of LLMs within the realm of cybersecurity. Our review not only surveys and categorizes the current landscape but also identifies critical research gaps. By evaluating both offensive and defensive applications, we aim to provide a holistic understanding of the potential risks and opportunities associated with LLM-driven cybersecurity.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Despite the significant research into LLMs within the field of cybersecurity, the exploration and application of such models remain in their initial stages and have great potential for development.
“Despite the significant research into LLMs within the field of cybersecurity, the exploration and application of such models remain in their initial stages and have great potential for development(deJesus Coelhoda Silva and Westphall 2024; Motlagh etal. 2024).”
From When LLMs meet cybersecurity: a systematic literature review (2025) · cites this paper as Motlagh et al. 2024
The Conclusion (p. 8) describes numerous studies of defensive applications and calls for more research on offensive risks. Section 3.4 (p. 5) also identifies underexplored response and recovery applications with potential for further development. These passages support the research and future-potential points, but do not characterize LLM exploration and application across cybersecurity as being in their initial stages. (LLM, conf=0.84)
Experimental — accuracy not yet measuredLLMs provide new opportunities for the cybersecurity community.
“LLMs provide new opportunities for the cybersecurity community(deJesus Coelho da Silva and Westphall 2024; Motlagh et al. 2024).”
From When LLMs meet cybersecurity: a systematic literature review (2025) · cites this paper as Motlagh et al. 2024
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404 · cited 1× · see citing works
“…the years several advancements pushed Natural Language Processing (NLP) forward, such as long short-term memories to handle a wide range of data [35], Stanford CoreNLP suite [56] providing a collection of algorithms to perform intricate NLP tasks and continued with transformer architecture [86].”
BackgroundHochreiter, S., & Schmidhuber, J. (1997) · Neural Computation · doi:10.1162/neco.1997.9.8.1735 · Cited by 102,318 · cited 1× · see citing works
“…the years several advancements pushed Natural Language Processing (NLP) forward, such as long short-term memories to handle a wide range of data [35], Stanford CoreNLP suite [56] providing a collection of algorithms to perform intricate NLP tasks and continued with transformer architecture [86].”
BackgroundExploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer
Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., & Liu, P. J. (2019) · arXiv · doi:10.48550/arxiv.1910.10683 · Cited by 10,929 · cited 1× · see citing works
“A breakthrough in Transformer-based models surged the field of NLP and led to the development of numerous kinds of effective LLMs. T5 [66] applied language modeling in pre-trained LLMs, where spans are altered with a single mask.”
BackgroundThe Stanford CoreNLP Natural Language Processing Toolkit
Manning, C. D., Surdeanu, M., Bauer, J., Finkel, J. R., Bethard, S. J., & McClosky, D. (2014) · Annual Meeting of the Association for Computational Linguistics: System Demonstrations (ACL Demo) · doi:10.3115/v1/p14-5010 · Cited by 7,171 · see citing works
ELIZA—a computer program for the study of natural language communication between man and machine
Weizenbaum, J. (1966) · Communications of the ACM · doi:10.1145/365153.365168 · Cited by 4,452 · cited 1× · see citing works
“From Eliza as a pattern recognition chatbot in the 1960s [89], over the years several advancements pushed Natural Language Processing (NLP) forward, such as long short-term memories to handle a wide range of data [35], Stanford CoreNLP suite [56] providing a collection of algorithms to perform…”
Llama 2: Open Foundation and Fine-Tuned Chat Models
Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al. (2023) · arXiv · doi:10.48550/arxiv.2307.09288 · Cited by 2,604 · cited 2× · see citing works
“Llama, a set of decoder-only models aimed at minimizing the amount of activations in the backward step [59, 84].”
BackgroundMethodA Survey of Large Language Models
Zhao, W. X., Zhou, K., Li, J., Tang, T., Dong, Z., Hou, Y., Zhang, B., Min, Y., Zhang, J., Liu, P., et al. (2026) · Frontiers of Computer Science · doi:10.1007/s11704-026-60308-3 · Cited by 2,093 · see citing works
WizardLM: Empowering Large Pre-Trained Language Models to Follow Complex InstructionsPreprint
Xu, C., Sun, Q., Zheng, K., Geng, X.-B., Zhao, P., Feng, J., Tao, C., Lin, Q.-W., & Jiang, D. (2023) · International Conference on Learning Representations · doi:10.48550/arxiv.2304.12244 · Cited by 1,362 · cited 1× · see citing works
“A general-purpose LLaMA-GPT-4 [65], Goat [54] for handling complicated arithmetic queries, HuaTuo [88] a medical knowledge model, Evol-Instruct [91] offering complicated prompts, and LLaMA 2-Chat fine-tuned using rejection sampling [84] are exemplary instruction-tuning LLMs. Running in higher…”
MethodA Comprehensive Overview of Large Language Models
Naveed, H., Khan, A. U., Qiu, S., Saqib, M., Anwar, S., Usman, M., Akhtar, N., Barnes, N., & Mian, A. (2025) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3744746 · Cited by 1,257 · cited 5× · see citing works
“Xuan Yuan 2.0, a Chinese financial chat model [59, 97], AlexaTM [80], PaLM-2 [5], as well as GLM-130B [96] are a few instances of general purpose pre-trained LLMs.”
InfluentialMegatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelism
Shoeybi, M., Patwary, M., Puri, R., LeGresley, P., Casper, J., & Catanzaro, B. (2019) · arXiv · doi:10.48550/arxiv.1909.08053 · Cited by 893 · cited 1× · see citing works
“Two benchmark datasets, SARD [102] and SeVC [77], were utilized by the authors to assess VulDetect’s performance.”
MethodRasmy, L., Xiang, Y., Xie, Z., Tao, C., & Zhi, D. (2021) · npj Digital Medicine · doi:10.1038/s41746-021-00455-y · Cited by 886 · cited 1× · see citing works
“Meanwhile, the utilization of LLMs in healthcare enables professionals by providing real-time clinical decision support [24, 69], medical education [50, 81], and prediction of disease progression [70, 78].”
BackgroundHarnessing the power of llms in practice: a survey on chatGPT and beyond
Yang, J., Jin, H., Tang, R., Han, X., Feng, Q., Jiang, H., Zhong, S., Yin, B., & Hu, X. (2024) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3649506 · Cited by 644 · cited 1× · see citing works
“Thanks to LLMs’ capability in breaking down complex natural language patterns, security experts are now enabled to explore more attack vectors in various contexts associated with textual data [93].”
BackgroundA comprehensive survey on pretrained foundation models: a history from BERT to ChatGPT
Zhou, C., Li, Q., Li, C., Yu, J., Liu, Y., Wang, G., Zhang, K., Ji, C., Yan, Q., He, L., et al. (2023) · arXiv · doi:10.48550/arxiv.2302.09419 · Cited by 574 · cited 1× · see citing works
“As a result, throughout various surveys, researchers attempted to categorize these advancements in LLM architecture [37, 59, 100, 101].”
BackgroundGuo, K., & Wang, D. (2024) · Education and Information Technologies · doi:10.1007/s10639-023-12146-0 · Cited by 449 · cited 1× · see citing works
“In education, LLMs support educators in various tasks such as assignment assessment [36], question generation [22], providing feedback [30], and essay grading [92].”
BackgroundTowards Reasoning in Large Language Models: A Survey
Huang, J., & Chang, K. C.-C. (2022) · arXiv · doi:10.48550/arxiv.2212.10403 · Cited by 428 · cited 1× · see citing works
“As a result, throughout various surveys, researchers attempted to categorize these advancements in LLM architecture [37, 59, 100, 101].”
BackgroundAll the News That’s Fit to Fabricate: AI-Generated Text as a Tool of Media Misinformation
Kreps, S., McCain, R. M., & Brundage, M. (2022) · Journal of Experimental Political Science · doi:10.1017/xps.2020.37 · Cited by 360 · cited 1× · see citing works
“Since people can adopt different personas in daily life and choose a variety of terms for a variety of circumstances, Kreps et al. [48] discuss how GPT2 can manipulate target users’ beliefs by generating stories, while Salewski et al. [74] investigate the role of LLMs on various per-sonas and adapt…”
BackgroundCyber Threat Intelligence Mining for Proactive Cybersecurity Defense: A Survey and New Perspectives
Sun, N., Ding, M., Jiang, J., Xu, W., Mo, X., Tai, Y., & Zhang, J. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3273282 · Cited by 335 · see citing works
GLM-130B: An Open Bilingual Pre-trained Model
Zeng, A., Liu, X., Du, Z., Wang, Z., Lai, H., Ding, M., Yang, Z., Xu, Y., Zheng, W., Xia, X., et al. (2022) · arXiv · doi:10.48550/arxiv.2210.02414 · Cited by 281 · cited 1× · see citing works
“Xuan Yuan 2.0, a Chinese financial chat model [59, 97], AlexaTM [80], PaLM-2 [5], as well as GLM-130B [96] are a few instances of general purpose pre-trained LLMs.”
BackgroundInfluentialIn-Context Impersonation Reveals Large Language Models' Strengths and BiasesPreprint
Salewski, L., Alaniz, S., Rio-Torto, I., et al. (2023) · Neural Information Processing Systems · doi:10.48550/arxiv.2305.14930 · Cited by 263 · cited 3× · see citing works
“…of terms for a variety of circumstances, Kreps et al. [48] discuss how GPT2 can manipulate target users’ beliefs by generating stories, while Salewski et al. [74] investigate the role of LLMs on various per-sonas and adapt their language accordingly a process known as in-context impersonation.”
BackgroundInfluentialEvaluating ChatGPT as an Adjunct for Radiologic Decision-Making
Rao, A., Kim, J., Kamineni, M., Pang, M., Lie, W., & Succi, M. D. (2023) · doi:10.1101/2023.02.02.23285399 · Cited by 257 · cited 1× · see citing works
“Meanwhile, the utilization of LLMs in healthcare enables professionals by providing real-time clinical decision support [24, 69], medical education [50, 81], and prediction of disease progression [70, 78].”
BackgroundSecureBERT: A Domain-Specific Language Model for Cybersecurity
Aghaei, E., Niu, X., Shadid, W., & Al-Shaer, E. (2023) · Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-25538-0_3 · Cited by 210 · cited 1× · see citing works
“Within a particular programming context that the authors had defined, they tested scenarios with and without AI support.”
Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix
Xiong, W.-J., Legrand, E., Åberg, O., et al. (2021) · Journal of Software and Systems Modeling · doi:10.1007/s10270-021-00898-7 · Cited by 188 · cited 7× · see citing works
“To this end, our approach involves with analyzing these approaches through the MITRE attack framework, which outlines various attacker tactics.”
InfluentialCyber security data sources for dynamic network research
Kent, A. D. (2016) · Security science and technology · doi:10.1142/9781786340757_0002 · Cited by 172 · cited 2× · see citing works
“The authors have demonstrated the efficacy of their approach by utilizing the Los Alamos National Laboratory Cyber Security Dataset [44].”
MethodLarge Language Models for Code: Security Hardening and Adversarial Testing
He, J., & Vechev, M. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623175 · Cited by 157 · see citing works
Getting pwn’d by AI: Penetration Testing with Large Language Models
Happe, A., & Cito, J. (2023) · Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3611643.3613083 · Cited by 144 · cited 1× · see citing works
“Furthermore, LLMs can improve team collaboration by offering security question solutions that are suitable for inexperienced as well as experts.”
(2023) · doi:10.1109/sp46215.2023.10179324 · Cited by 131 · see citing works
When ChatGPT Meets Smart Contract Vulnerability Detection: How Far Are We?
Chen, C., Su, J., Chen, J., Wang, Y., Bi, T., Yu, J., Wang, Y., Lin, X., Chen, T., & Zheng, Z. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3702973 · Cited by 118 · cited 2× · see citing works
“On the other hand, Chen et al. [13] trained LLM on a dataset of 10,000 smart contracts and evaluated how well it detected nine different vulnerabilities.”
BackgroundMethodKosasih, E. E., Papadakis, E., Baryannis, G., & Brintrup, A. M. (2023) · International Journal of Production Research · doi:10.1080/00207543.2023.2281663 · Cited by 118 · cited 1× · see citing works
“Automation is introduced into customer service [63], marketing [27, 94], and supply chain management [34, 47, 52] through the integration of LLMs in business.”
BackgroundLarge Language Models for Supply Chain Optimization
Li, B., Mellou, K., Zhang, B.-W., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2307.03875 · Cited by 117 · cited 1×
“Meanwhile, the utilization of LLMs in healthcare enables professionals by providing real-time clinical decision support [24, 69], medical education [50, 81], and prediction of disease progression [70, 78].”
HuaTuo: Tuning LLaMA Model with Chinese Medical Knowledge
Wang, H., Liu, C., Xi, N., Qiang, Z., Zhao, S., Qin, B., & Liu, T. (2023) · arXiv · doi:10.48550/arxiv.2304.06975 · Cited by 115 · cited 1× · see citing works
“A general-purpose LLaMA-GPT-4 [65], Goat [54] for handling complicated arithmetic queries, HuaTuo [88] a medical knowledge model, Evol-Instruct [91] offering complicated prompts, and LLaMA 2-Chat fine-tuned using rejection sampling [84] are exemplary instruction-tuning LLMs. Running in higher…”
MethodCyBERT: Contextualized Embeddings for the Cybersecurity Domain
Ranade, P., Piplai, A., Joshi, A., & Finin, T. (2021) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata52589.2021.9671824 · Cited by 115 · cited 1× · see citing works
“Ranade et al. [67] improve the processing of threats, attacks, and vulnerabilities which is challenging due to the high volume of data, and the dynamic nature of evolving attack techniques.”
BackgroundDo you still need a manual smart contract audit?
David, I., Zhou, L., Qin, K., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2306.12338 · Cited by 110 · cited 2×
“David et al. [16] utilized LLMs to target vulnerabilities in the smart contracts and DeFi protocol layers.”
BackgroundGoat: Fine-tuned LLaMA Outperforms GPT-4 on Arithmetic Tasks
Liu, T., & Low, K. (2023) · arXiv.org · doi:10.48550/arxiv.2305.14201 · Cited by 109 · cited 1×
“…medical knowledge model, Evol-Instruct [91] offering complicated prompts, and LLaMA 2-Chat fine-tuned using rejection sampling [84] are exemplary instruction-tuning LLMs. Running in higher costs, extensive hardware requirements, cost of slow training on various tasks, limited LLMs utilization [59].”
LogPrompt: Prompt Engineering Towards Zero-Shot and Interpretable Log Analysis
Liu, Y., Tao, S., Meng, W., Yao, F., Zhao, X., & Yang, H. (2024) · Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings · doi:10.1145/3639478.3643108 · Cited by 96 · cited 1× · see citing works
“Anomaly detection represents a key application of LLMs for identifying potential threats [55].”
BackgroundAn Attacker’s Dream? Exploring the Capabilities of ChatGPT for Developing Malware
Papa, Y., Tanizaki, S., Kou, T., et al. (2023) · CSET @ USENIX Security Symposium · doi:10.1145/3607505.3607513 · Cited by 94 · cited 6× · see citing works
“Theapplication of LLMs, particularly ChatGPT and AutoGPT, in malware generation is covered by Pa Pa et al. [62].”
BackgroundMethodInfluentialAlexaTM 20B: Few-Shot Learning Using a Large-Scale Multilingual Seq2Seq ModelPreprint
Soltan, S., Ananthakrishnan, S., FitzGerald, J. G. M., Gupta, R., Hamza, W., Khan, H., Peris, C., Rawls, S., Rosenbaum, A., Rumshisky, A., et al. (2022) · arXiv.org · doi:10.48550/arxiv.2208.01448 · Cited by 93 · cited 1× · see citing works
“Xuan Yuan 2.0, a Chinese financial chat model [59, 97], AlexaTM [80], PaLM-2 [5], as well as GLM-130B [96] are a few instances of general purpose pre-trained LLMs.”
BackgroundInfluentialXuanYuan 2.0: A Large Chinese Financial Chat Model with Hundreds of Billions Parameters
Zhang, X., & Yang, Q. (2023) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3583780.3615285 · Cited by 87 · cited 1× · see citing works
“Xuan Yuan 2.0, a Chinese financial chat model [59, 97], AlexaTM [80], PaLM-2 [5], as well as GLM-130B [96] are a few instances of general purpose pre-trained LLMs.”
BackgroundInfluentialSong, H., Xia, Y., Luo, Z., Liu, H., Song, Y., Zeng, X., Li, T., Zhong, G., Li, J., Chen, M., et al. (2023) · Journal of Medical Systems · doi:10.1007/s10916-023-02021-3 · Cited by 85 · cited 1× · see citing works
“Meanwhile, the utilization of LLMs in healthcare enables professionals by providing real-time clinical decision support [24, 69], medical education [50, 81], and prediction of disease progression [70, 78].”
BackgroundCyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model
Ameri, K., Hempel, M., Sharif, H., Lopez, J., & Perumalla, K. S. (2021) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp1040031 · Cited by 78 · cited 1× · see citing works
“CyBERT [3] un-veils a classifier for detecting cybersecurity feature claims.”
BackgroundDecoding the Threat Landscape : ChatGPT, FraudGPT, and WormGPT in Social Engineering Attacks
Falade, P. V. (2023) · International Journal of Scientific Research in Computer Science Engineering and Information Technology · doi:10.32628/cseit2390533 · Cited by 73 · cited 1× · see citing works
“To further elaborate, Wor-mGPT [23] is an AI-powered tool designed for cybercriminals to automate the generation of personalized phishing emails.”
MethodTihanyi, N., Charalambous, Y., Jain, R., Ferrag, M. A., & Cordeiro, L. C. (2025) · International Conference/Workshop on Automation of Software Test · doi:10.1109/ast66626.2025.00020 · Cited by 72 · cited 1× · see citing works
“Furthermore, LLMs boost risk modeling by generating expert opinions based on prior patterns, risk mitigation by generating contingency plans, and risk reporting by providing customized risk assessments.”
CySecBERT : A Domain-Adapted Language Model for the Cybersecurity Domain
Bayer, M., Kuehn, P., Shanehsaz, R., & Reuter, C. (2024) · ACM Transactions on Privacy and Security · doi:10.1145/3652594 · Cited by 71 · cited 1× · see citing works
“Their findings indicate that users assisted by AI develop security flaws at a rate lower than ten percent, suggesting that using LLMs in their security-oriented research does not present major new security risks.”
LLM in the Shell: Generative Honeypots
Sladić, M., Valeros, V., Catania, C., & Garcia, S. (2024) · 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw61312.2024.00054 · Cited by 70 · cited 2× · see citing works
“In another study, Sladic et al. [79] present an LLM-based technique for developing software honeypots.”
MethodTraining Data Extraction From Pre-trained Language Models: A SurveyPreprint
Ishihara, S. (2023) · TRUSTNLP · doi:10.48550/arxiv.2305.16157 · Cited by 66 · cited 1× · see citing works
“Though previous studies have investigated literature reviews to highlight the safety aspects of LLMs [1, 38, 39, 49], the present study focuses primarily on the application of LLMs in the context of cyberdefense as well as cyberattack.”
BackgroundRevolutionizing Cyber Threat Detection with Large Language Models
Ferrag, M., Ndhlovu, M., Tihanyi, N., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2306.14263 · Cited by 64 · cited 1×
“Their findings indicate that users assisted by AI develop security flaws at a rate lower than ten percent, suggesting that using LLMs in their security-oriented research does not present major new security risks.”
CPLLM: Clinical prediction with large language models
Shoham, O. B., & Rappoport, N. (2024) · PLOS Digital Health · doi:10.1371/journal.pdig.0000680 · Cited by 62 · cited 1× · see citing works
“…also be equipped with cutting-edge tools, assisting cybersecurity practitioners who continuously seek solutions to implement advanced policies or strengthen technological protections against the disclosure of confidential information, unauthorized access, and other forms of data modification [43].”
How Useful are Educational Questions Generated by Large Language Models?Preprint
Elkins, S., Kochmar, E., Cheung, J., et al. (2023) · International Conference on Artificial Intelligence in Education · doi:10.48550/arxiv.2304.06638 · Cited by 57 · cited 1× · see citing works
“In education, LLMs support educators in various tasks such as assignment assessment [36], question generation [22], providing feedback [30], and essay grading [92].”
VulDetect: A novel technique for detecting software vulnerabilities using Language Models
Omar, M., & Shiaeles, S. N. (2023) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr57506.2023.10224924 · Cited by 54 · cited 1× · see citing works
“GPT-2 is used by VulDetect[61], a transformer-based vulnerability detection framework, to detect anomalies in system logs.”
MethodLost at C: A User Study on the Security Implications of Large Language Model Code Assistants
Sandoval, G., Pearce, H., Nys, T., Karri, R., Garg, S., & Dolan-Gavitt, B. (2022) · arXiv · doi:10.48550/arxiv.2208.09727 · Cited by 52 · cited 1× · see citing works
“Furthermore, Sandoval et al. [75] performed an examination of potentially insecure code suggestions during the process of code development.”
BackgroundRecurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly DetectionPreprint
Tuor, A. R., Baerwolf, R., Knowles, N., Hutchinson, B., Nichols, N., & Jasper, R. J. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1712.00557 · Cited by 50 · cited 2× · see citing works
“Another research accomplished by Yu et al. [95] investigates GPT-3’s capacity to produce honeywords to trap the attackers if they are using deceptive generated passwords.”
Generating Phishing Attacks using ChatGPTPreprint
Roy, S., Naragam, K. V., & Nilizadeh, S. (2023) · arXiv.org · doi:10.48550/arxiv.2305.05133 · Cited by 49 · see citing works
Targeted Phishing Campaigns using Large Scale Language ModelsPreprint
Karanjai, R. (2022) · arXiv.org · doi:10.48550/arxiv.2301.00665 · Cited by 48 · cited 1× · see citing works
“With a dataset of phishing emails, Karanjai [42] investigates the effectiveness of generating convincing phishing emails with GPT2, GPT-3, and LSTM while taking into account the removal of HTML elements, URLs, and email addresses as well as tokenizing the text into words.”
MethodAssessing AI-Powered Patient Education: A Case Study in Radiology
Kuckelman, I. J., Yi, P. H., Bui, M., Onuh, I., Anderson, J. A., & Ross, A. B. (2023) · Academic Radiology · doi:10.1016/j.acra.2023.08.020 · Cited by 46 · cited 1× · see citing works
“Meanwhile, the utilization of LLMs in healthcare enables professionals by providing real-time clinical decision support [24, 69], medical education [50, 81], and prediction of disease progression [70, 78].”
BackgroundRatGPT: Turning online LLMs into Proxies for Malware AttacksPreprint
Beckerich, M., Plein, L., & Coronado, S. (2023) · arXiv.org · doi:10.48550/arxiv.2308.09183 · Cited by 45 · cited 2× · see citing works
“…authors [62] reported that a number of the commercially available antivirus applications and Endpoint Detection and Response (EDR) solutions failed to detect the LLM-generated executables since some LLM-generated functions can establish connections toward attackers through the victim’s machine [7].”
BackgroundMethodHsiao, Y. P., Klijn, N., & Chiu, M.-S. (2023) · Learning Research and Practice · doi:10.1080/23735082.2023.2257234 · Cited by 45 · cited 1× · see citing works
“In education, LLMs support educators in various tasks such as assignment assessment [36], question generation [22], providing feedback [30], and essay grading [92].”
Yan, L.-X., Sha, L., Zhao, L.-X., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2303.13379 · Cited by 42 · cited 2×
“In the entertainment industry, LLMs demonstrate competitive performance in generating music captions [19] as well as video game scripts [51].”
Pandya, K., & Holia, M. (2023) · arXiv · doi:10.48550/arxiv.2310.05421 · Cited by 39 · cited 1× · see citing works
“Meanwhile, the utilization of LLMs in healthcare enables professionals by providing real-time clinical decision support [24, 69], medical education [50, 81], and prediction of disease progression [70, 78].”
GPThreats-3: Is Automatic Malware Generation a Threat?
Botacin, M. F. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00027 · Cited by 39 · cited 2× · see citing works
“The feasibility of employing large textual models to automatically generate malware along with the model’s constraints when generating actual malware samples is studied by Botacin [8].”
BackgroundBalancing Specialized and General Skills in LLMs: The Impact of Modern Tuning and Data Strategy
Zhang, Z., Zheng, C., Tang, D., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2310.04945 · Cited by 38 · cited 1×
“While pre-trained models offer an essential understanding of languages, as AI advances, fine-tuning LLMs boost business functions and satisfaction by fulfilling industry-specific criteria [99].”
BackgroundPentestGPT: An LLM-empowered Automatic Penetration Testing Tool
Deng, G., Liu, Y., Mayoral-Vilches, V., Liu, P., Li, Y., Xu, Y., Zhang, T., Liu, Y., Pinzger, M., & Rass, S. (2023) · arXiv · doi:10.48550/arxiv.2308.06782 · Cited by 37 · cited 1× · see citing works
“A three-step process is described by Charalambous et al. [10] for addressing automotive vulnerability issues.”
LLMParser: A LLM-based Log Parsing Framework
Jiang, Z., Liu, J., Chen, Z., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2310.01796 · Cited by 34 · cited 2×
“Their findings indicate that users assisted by AI develop security flaws at a rate lower than ten percent, suggesting that using LLMs in their security-oriented research does not present major new security risks.”
Scamming the Scammers: Using ChatGPT to Reply Mails for Wasting Time and Resources
Cambiaso, E., & Caviglione, L. (2023) · Italian Conference on Cybersecurity · doi:10.48550/arxiv.2303.13521 · Cited by 33 · cited 2×
“5 Turbo & GPT-4 [9] 2023 Respond Replying to the scam emails using LLM. GPT-3 "write a malware X," and next, by giving more specific malware and attack tool functionalities.”
MethodPrivacy in Large Language Models: Attacks, Defenses and Future DirectionsPreprint
Li, H., Chen, Y., Luo, J., Wang, J., Peng, H., Kang, Y., Zhang, X., Hu, Q., Chan, C., Xu, Z., et al. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2310.10383 · Cited by 32 · cited 1× · see citing works
“Furthermore, LLMs mitigate potential risks by offering automated vulnerability fixes, aiming to improve organizations’ security posture [64].”
Chatbots in a Honeypot WorldPreprint
McKee, F., & Noever, D. A. (2023) · arXiv.org · doi:10.48550/arxiv.2301.03771 · Cited by 32 · cited 2× · see citing works
“Exploring anomaly detection in system logs is a crucial step toward developing effective detection methods through the use of LLMs. Recurrent Neural Network Language Models are used by Tuor et al. [85] to present an unsupervised, online anomaly detection method for computer security log analysis.”
Fundamentals of Generative Large Language Models and Perspectives in Cyber-DefensePreprint
Kucharavy, A., Schillaci, Z. M., Maréchal, L., Würsch, M., Dolamic, L., Sabonnadiere, R., David, D. P., Mermoud, A., & Lenders, V. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2303.12132 · Cited by 31 · cited 1× · see citing works
“Though previous studies have investigated literature reviews to highlight the safety aspects of LLMs [1, 38, 39, 49], the present study focuses primarily on the application of LLMs in the context of cyberdefense as well as cyberattack.”
BackgroundImpacts and Risk of Generative AI Technology on Cyber Defense
Neupane, S., Fernandez, I., Mittal, S., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2306.13033 · Cited by 30
SecureFalcon: The Next Cyber Reasoning System for Cyber SecurityPreprint
Ferrag, M., Battah, A., Tihanyi, N., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2307.06616 · Cited by 30 · cited 2× · see citing works
“SecureFalcon [25] is an LLM-based cybersecurity reasoning sys-tem targeted to detect software flaws.”
MethodSpear Phishing With Large Language Models
Hazell, J. (2023) · arXiv · doi:10.48550/arxiv.2305.06972 · Cited by 28 · cited 2× · see citing works
“According to Hazell et al. [32], LLMs are able to assist during the reconnaissance stage of a spear phishing attack, a process when attackers get sensitive information about their targets in order to develop compelling messages.”
Detecting Phishing Sites Using ChatGPTPreprint
Koide, T., Fukushi, N., Nakano, H., & Chiba, D. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2306.05816 · Cited by 26 · cited 1× · see citing works
“Their findings indicate that users assisted by AI develop security flaws at a rate lower than ten percent, suggesting that using LLMs in their security-oriented research does not present major new security risks.”
Detecting Scams Using Large Language Models
Jiang, L. (2024) · arXiv.org · doi:10.48550/arxiv.2402.03147 · Cited by 26
Charan, P. V. S., Chunduri, H., Anand, P. M., & Shukla, S. K. (2023) · arXiv · doi:10.48550/arxiv.2305.15336 · Cited by 25 · cited 1× · see citing works
“The authors [72] conduct a number of attacks, including text encoding, clickjacking, polymorphic URL, and QR code-based multi-stage attacks, to show how LLMs have the potential to be leveraged to generate a variety of phishing attack forms.”
Reformulating Domain Adaptation of Large Language Models as Adapt-Retrieve-Revise
Wan, Z., Zhang, Y., Wang, Y., et al. (2023) · Annual Meeting of the Association for Computational Linguistics · doi:10.48550/arxiv.2310.03328 · Cited by 23 · cited 1×
“Retrieving support evidence from an external in-domain knowledge base [98], parameter tuning and knowledge distillation are among the techniques extensively researched for effective LLM deployment [59].”
BackgroundSelf-citationBypassing antivirus detection: old-school malware, new tricks
Chatzoglou, E., Karopoulos, G., Kambourakis, G., et al. (2023) · ARES · doi:10.1145/3600160.3605010 · Cited by 21 · cited 4×
“According to Chatzoglou et al. [12] LLMs establish an initial TCP listener that resembles an SSH listener.”
BackgroundMethodInfluentialArtificial Intelligence for next generation cybersecurity: The AI4CYBER framework
Iturbe, E., Rios, E., Rego, A., & Toledo, N. (2023) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3600160.3605051 · Cited by 21 · cited 1× · see citing works
“Though previous studies have investigated literature reviews to highlight the safety aspects of LLMs [1, 38, 39, 49], the present study focuses primarily on the application of LLMs in the context of cyberdefense as well as cyberattack.”
BackgroundVulnerability Detection via Multimodal Learning: Datasets and Analysis
Zhou, X., & Verma, R. M. (2022) · ACM Asia Conference on Computer and Communications Security · doi:10.1145/3488932.3527288 · Cited by 20 · cited 1×
“Two benchmark datasets, SARD [102] and SeVC [77], were utilized by the authors to assess VulDetect’s performance.”
MethodChatGPT: Cyber Security Threats and CountermeasuresPreprint
Addington, S. (2023) · Social Science Research Network · doi:10.2139/ssrn.4425678 · Cited by 20 · cited 1× · see citing works
“Though previous studies have investigated literature reviews to highlight the safety aspects of LLMs [1, 38, 39, 49], the present study focuses primarily on the application of LLMs in the context of cyberdefense as well as cyberattack.”
Against Opacity: Explainable AI and Large Language Models for Effective Digital Advertising
Yang, Q., Ongpin, M., Nikolenko, S., et al. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612817 · Cited by 18 · see citing works
Building Resilient SMEs: Harnessing Large Language Models for Cyber Security in Australia
Kereopa-Yorke, B. (2023) · Journal of AI, Robotics & Workplace Automation · doi:10.48550/arxiv.2306.02612 · Cited by 17
Deng, Z., Ma, Y., Liu, Y., Guo, R., Zhang, G., Chen, W., Huang, W., & Benetos, E. (2023) · arXiv · doi:10.48550/arxiv.2309.08730 · Cited by 15 · cited 1×
“In the entertainment industry, LLMs demonstrate competitive performance in generating music captions [19] as well as video game scripts [51].”
BackgroundTann, W., Liu, Y., Sim, J. H., Seah, C. M., & Chang, E.-C. (2023) · arXiv · doi:10.48550/arxiv.2308.10443 · Cited by 14 · cited 1× · see citing works
“Tann et al. [83] apply LLMs to tackle professional certification topics and perform Capture The Flag (CTF) tasks to improve participants’ cybersecurity education.”
BackgroundGenerative Models for Spear Phishing Posts on Social MediaPreprint
Seymour, J., & Tully, P. J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.05196 · Cited by 14 · cited 1× · see citing works
“According to John et al. [40], ML-based techniques group people according to their value and level of participation, and then utilize the timeliness of the target users to provide content and a phishing URL.”
MethodWeb Content Filtering Through Knowledge Distillation of Large Language Models
Vörös, T., Bergeron, S. P., & Berlin, K. (2023) · IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology (WI-IAT) · doi:10.1109/wi-iat59888.2023.00058 · Cited by 13 · see citing works
Yu, F., & Martín, M. V. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-35504-2_5 · Cited by 12 · cited 1× · see citing works
“The process of developing an organizational understanding to manage cybersecurity risk concerning systems, assets, data, and capabilities is referred to the Identify function in the context of the NIST framework [15].”
Gan, C., Yang, D., Hu, B.-B., et al. (2023) · arXiv.org · doi:10.48550/arxiv.2312.05276 · Cited by 10 · cited 1×
“Automation is introduced into customer service [63], marketing [27, 94], and supply chain management [34, 47, 52] through the integration of LLMs in business.”
BackgroundUtilizing Chatbots to Increase the Efficacy of Information Security Practitioners
Dutta, S., Joyce, G., & Brewer, J. (2017) · International Conference on Applied Human Factors and Ergonomics · doi:10.1007/978-3-319-60585-2_22 · Cited by 10 · cited 2×
“5 Turbo [95] 2023 Protect Generating honeywords using LLMs. GPT-3 [20] 2018 SecureFalcon (FalconLLM) [79] 2023 Respond Creating honeypots related to continuously monitoring and detecting threats.”
BackgroundMethodA Review of the Role of ChatGPT for Clinical Decision Support Systems
Fawzi, S. A. (2023) · Novel Intelligent and Leading Emerging Sciences Conference (NILES) · doi:10.1109/niles59815.2023.10296668 · Cited by 10 · cited 1× · see citing works
“With advancements in cyber threats, the cybersecurity domain can also be equipped with cutting-edge tools, assisting cybersecurity practitioners who continuously seek solutions to implement advanced policies or strengthen technological protections against the disclosure of confidential information,…”
Generating Video Game Scripts with Style
Latouche, G. L., Marcotte, L., & Swanson, B. (2023) · Workshop on NLP for Conversational AI (NLP4ConvAI) · doi:10.18653/v1/2023.nlp4convai-1.11 · Cited by 7 · cited 1× · see citing works
“In the entertainment industry, LLMs demonstrate competitive performance in generating music captions [19] as well as video game scripts [51].”
BackgroundThe Advance of GPTs and Language Model in Cyber Security
Gao, M. (2023) · Highlights in Science Engineering and Technology · doi:10.54097/hset.v57i.10001 · Cited by 5 · see citing works
Can Generative-AI (ChatGPT and Bard) Be Used as Red Team Avatars in Developing Foresight Scenarios?
Garvey, B., & Svendsen, A. D. M. (2023) · Social Science Research Network · doi:10.2139/ssrn.4541396 · Cited by 5 · cited 1×
“Their findings indicate that users assisted by AI develop security flaws at a rate lower than ten percent, suggesting that using LLMs in their security-oriented research does not present major new security risks.”
Ameri, K., Hempel, M., Sharif, H., Lopez, J., & Perumalla, K. S. (2022) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp2020022 · Cited by 2 · cited 1× · see citing works
“Several subsequent works have furthered the advancements of this research in terms of both training efficiency and accuracy such as SecureBERT [2], CySecBERT [6], and ClaimsBERT [4].”
Background
Flagged first, then by citations
12 of the 102 references couldn’t be matched to a known paper.
Research works printed but not linked: 9
- [5][5] Rohan Anil, Andrew M Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Siamak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, et al. 2023. Palm 2 technical report. arXiv preprint arXiv:2305.10403 (2023). - · arXiv
- [15][15] Critical Infrastructure Cybersecurity. 2014. Framework for improving critical infrastructure cybersecurity. Framework 1, 11 (2014). -
- [34][34] Christian Hendriksen. 2023. AI for Supply Chain Management: Disruptive Innovation or Innovative Disruption? Journal of Supply Chain Management (2023). -
- [43][43] Ramanpreet Kaur, Dušan Gabrijelčič, and Tomaž Klobučar. 2023. Artificial intelligence for cybersecurity: Literature review and future research directions. Information Fusion (2023), 101804. -
- [64][64] Hammond Pearce, Benjamin Tan, Baleegh Ahmad, Ramesh Karri, and Brendan Dolan-Gavitt. 2023. Examining zero-shot vulnerability repair with large language models. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2339-2356. -
- [65][65] Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. 2023. Instruction tuning with gpt-4. arXiv preprint arXiv:2304.03277 (2023). - · arXiv
- [68][68] Javier Rando, Fernando Perez-Cruz, and Briland Hitaj. 2023. PassGPT: Password Modeling and (Guided) Generation with Large Language Models. arXiv preprint arXiv:2306.01545 (2023). - · arXiv
- [69][69] Arya Rao, John Kim, Meghana Kamineni, Michael Pang, Winston Lie, and Marc D Succi. 2023. Evaluating ChatGPT as an adjunct for radiologic decisionmaking. medRxiv (2023), 2023-02. -
- [72][72] Sayak Saha Roy, Krishna Vamsi Naragam, and Shirin Nilizadeh. 2023. Generating Phishing Attacks using ChatGPT. arXiv e-prints (2023), arXiv-2305. -
Cited by
Sorted by citations
When LLMs meet cybersecurity: a systematic literature review
Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., & Meng, D. (2025) · Cybersecurity · doi:10.1186/s42400-025-00361-w · Cited by 220 · see citing works
“First, many studies rely on case studies without comprehensive methodology, raising concerns about scalability and reproducibility.”
InfluentialKheddar, H. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103347 · Cited by 214 · see citing works
Enhancing Autonomous System Security and Resilience With Generative AI: A Comprehensive Survey
Lopez, M. A., Lunardi, W. T., Lawton, G., & Thakkar, S. (2024) · IEEE Access · doi:10.1109/access.2024.3439363 · Cited by 115 · see citing works
AI-Driven Safety and Security for UAVs: From Machine Learning to Large Language Models
Yang, Z., Zhang, Y., Zeng, J., Yang, Y., Jia, Y., Song, H., Lv, T., Sun, Q., & An, J. (2025) · Drones · doi:10.3390/drones9060392 · Cited by 49 · see citing works
Uddin, M., Irshad, M. S., Kandhro, I. A., Alanazi, F., Ahmed, F., Maaz, M., Hussain, S., & Ullah, S. S. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-025-11219-5 · Cited by 55 · see citing works
A Review of Advancements and Applications of Pre-Trained Language Models in Cybersecurity
Liu, Z. (2024) · International Symposium on Digital Forensics and Security (ISDFS) · doi:10.1109/isdfs60797.2024.10527236 · Cited by 39 · see citing works
“Motlagh et al.’s comprehensive review of LLMs in cybersecurity [142] identifies key areas for further research, emphasizing the need for a balanced approach to harnessing LLM capabilities while mitigating associated risks.”
BackgroundDing, W., Abdel‐Basset, M., Ali, A. M., & Moustafa, N. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.112663 · Cited by 40 · see citing works
Transfer Learning in Pre-Trained Large Language Models for Malware Detection Based on System Calls
Sánchez, P. M. S., Celdrán, A. H., Bovet, G., & Pérez, G. M. (2024) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom61039.2024.10773857 · Cited by 33 · see citing works
“As can be seen in the related work comparison in TABLE I and recent literature reviews confirm [5], LLMs have not been extensively applied in syscall data in the realm of intrusion or malware detection, remaining a field requiring considerable research efforts.”
Far, S. M. T., & Feyzi, F. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-00992-7 · Cited by 34 · see citing works
CyberRAG: An agentic RAG cyber attack classification and reporting tool
Blefari, F., Cosentino, C., Pironti, F. A., Furfaro, A., & Marozzo, F. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.108186 · Cited by 33 · see citing works
“Here, combining LLM capabilities with knowledge graphs and advanced threat intelligence fosters deeper insights into malware campaigns and social engineering tactics [75].”
Red teaming large language models: A comprehensive review and critical analysis
Jabbar, M. S., Al-Azani, S., Alotaibi, A., & Ahmed, M. (2025) · Information Processing & Management · doi:10.1016/j.ipm.2025.104239 · Cited by 25 · see citing works
Cognitive Computing and Business Intelligence Applications in Accounting, Finance and Management
Ao, S. I., Hurwitz, M., & Palade, V. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9030054 · Cited by 18 · see citing works
Hou, S., Zhao, A., Liang, J., Shen, Z., & Wu, H. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.113624 · Cited by 25 · see citing works
Harnessing the power of language models in cybersecurity: A comprehensive review
Kaur, R., Klobučar, T., & Gabrijelčič, D. (2024) · International Journal of Information Management Data Insights · doi:10.1016/j.jjimei.2024.100315 · Cited by 16 · see citing works
Nicoletti, B., & Appolloni, A. (2025) · Digital engineering. · doi:10.1016/j.dte.2025.100058 · Cited by 21 · see citing works
Assessing the risk of takeover catastrophe from large language models
Baum, S. D. (2024) · Risk Analysis · doi:10.1111/risa.14353 · Cited by 11 · see citing works
“LLMs are able to produce computer code, an ability that can be leveraged for computer security on both offense and defense (Motlagh et al., 2024; Yao et al., 2024).”
Assessing the Effectiveness of LLMs in Android Application Vulnerability Analysis
Kouliaridis, V., Καρόπουλος, Γ., & Kambourakis, G. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-85593-1_9 · Cited by 11 · see citing works
Kumar, A., Salim, M. M., Camacho, D., & Park, J. H. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111379 · Cited by 12 · see citing works
ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Models
Jin, H., Zhang, C., Shi, S., Lou, W., & Hou, Y. T. (2024) · IEEE Conference on Communications and Network Security · doi:10.1109/cns62487.2024.10735575 · Cited by 11 · see citing works
“…years, Large Language Models (LLMs) have at-tracted significant attention from both the industry and academic communities for their capabilities to not only serve as chatbots but also solve real-world problems in various fields such as medicine [1], cybersecurity [2], and software development [3].”
BackgroundPrivacy-Aware Detection for Large Language Models Using a Hybrid BiLSTM-HMM Approach
Abbasalizadeh, M., & Narain, S. (2025) · IEEE Access · doi:10.1109/access.2025.3587988 · Cited by 10 · see citing works
“Motlagh et al. identify critical gaps in post-attack recovery mechanisms, underscoring the need for adaptive and resilient security strategies [42].”
The Three Sides of the Moon LLMs in Cybersecurity: Guardians, Enablers and Targets
Marulli, F., Paganini, P., & Lancellotti, F. (2024) · Procedia Computer Science · doi:10.1016/j.procs.2024.09.653 · Cited by 9 · see citing works
He, C., Wang, Y., Hu, J., et al. (2024) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2024.3461855 · Cited by 7 · see citing works
Nadeem, M., & Hongsong, C. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111375 · Cited by 7 · see citing works
Leveraging MDS2 and SBOM data for LLM-assisted vulnerability analysis of medical devices
Stein, S., Pilgermann, M., Weber, S., & Sedlmayr, M. (2025) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2025.07.012 · Cited by 6 · see citing works
“In cybersecurity, LLMs are increasingly applied to tasks such as real-time threat detection, automatic vulnerability analysis, and code-based exploit identification [4–7].”
TAGAPT: Toward Automatic Generation of APT Samples With Provenance-Level Granularity
Cheng, W., Yuan, Q., Zhu, T., et al. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3557742 · Cited by 6 · see citing works
Foundations of Deep Learning and Large Language Models in Cybersecurity
Zangana, H. M., Omar, M., & Al-Karaki, J. N. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3296-3.ch001 · Cited by 6 · see citing works
OHRA: Dynamic Multi-protocol LLM-Based Cyber Deception
Safargalieva, A., Rüffer, A., & Vasilomanolakis, E. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-14782-0_7 · Cited by 6 · see citing works
Nizon-Deladoeuille, M., Stefánsson, B., Neukirchen, H., & Welsh, T. (2024) · International Conference on Social Networks Analysis, Management and Security (SNAMS) · doi:10.1109/snams64316.2024.10883774 · Cited by 7 · see citing works
“LLMs have recently been utilised in supporting practitioners’ various domains, including cybersecurity [3], [4].”
From Synthetic Text to Real Threats
Omar, K., Zraqou, J. S., & Gómez, J. M. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-0832-6.ch001 · Cited by 5 · see citing works
Exploring the Potential of Large Language Models for Red Teaming in Military Coalition Networks
Adler, E., Loevenich, J. F., Moxon, L., Hürten, T., Spelter, F., Braun, J., Gourlet, Y., Lefeuvre, T., & Lopes, R. R. F. (2024) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom61039.2024.10773947 · Cited by 5 · see citing works
Zacharis, A., Gavrila, R., Patsakis, C., et al. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104037 · Cited by 5 · see citing works
Exploiting LLMs for E-Learning: A Cybersecurity Perspective on AI-Generated Tools in Education
Greco, D., & Chianese, L. (2024) · doi:10.1109/techdefense63521.2024.10863662 · Cited by 5 · see citing works
“Large language models such as BERT and GPT-3 have demonstrated remarkable capabilities in tasks ranging from nat-ural language processing to content generation [6].”
Abdallah, A. M., Aslan, H. K., Abdallah, M. S., Cho, Y. I., & Azer, M. A. (2025) · Symmetry · doi:10.3390/sym17040496 · Cited by 4 · see citing works
Investigating the Effectiveness of Bayesian Spam Filters in Detecting LLM-Modified Spam Mails
Josten, M., & Weis, T. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-89363-6_16 · Cited by 4 · see citing works
“Motlagh et al. also explore the adversarial and defensive use cases for LLMs [16].”
BackgroundVinay, V. (2026) · 2026 IEEE 5th International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic67076.2026.11395809 · Cited by 15 · see citing works
“Recent state-of-the-art reviews in the area of cybersecurity argue that LLMs facilitate innovative defensive capabilities; however, their reliability, controllability, and auditability are still key open challenges to mission-critical deployment [20].”
Secure Authentication and Identity Management With AI
Mohammed, D., & MacLennan, H. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3296-3.ch009 · Cited by 3 · see citing works
Tariq, S., Rodríguez, E., Masip‐Bruin, X., Díaz, R., Martrat, J., & Trakadas, P. T. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111594 · Cited by 4 · see citing works
Machine Learning Algorithms for Threat Detection and Evidence Analysis
Albtosh, L. B., & Yates, R. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6536-7.ch003 · Cited by 3 · see citing works
The Future of Autonomous Forensic Agents and AI-Augmented Investigators
Jones, R. K. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6536-7.ch010 · Cited by 3 · see citing works
Intelligent Cyber Defense: Leveraging LLMs for Real-Time Threat Detection and Analysis
Kakoulli, E., Zacharioudakis, E., & Evripidou, S. (2025) · Lecture notes in business information processing · doi:10.1007/978-3-031-81322-1_5 · Cited by 3 · see citing works
Context-based Password Cracking Dictionary Expansion Using Generative Pre-trained Transformers
Imhof, G., Kanta, A., & Scanlon, M. (2024) · Cyber Research Conference - Ireland (Cyber-RCI) · doi:10.1109/cyber-rci60769.2024.10939663 · Cited by 3 · see citing works
“An example of this is WormGPT, which is a tool that generates personalised phishing emails to be used maliciously [20].”
The Hidden Dangers of Publicly Accessible LLMs: A Case Study on Gab AI
Vaishnav, L., Singh, S., & Cornell, K. A. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-89363-6_18 · Cited by 3 · see citing works
Goto, T., Ono, K., & Morita, A. (2024) · doi:10.36227/techrxiv.170975411.12532297/v1 · Cited by 3 · see citing works
Using LLMs as AI Agents to Identify False Positive Alerts in Security Operation CenterPreprint
Rafiey, P., & Namadchian, A. (2024) · Research Square · doi:10.21203/rs.3.rs-5420741/v1 · Cited by 3 · see citing works
Ethical Considerations in Deploying Autonomous AI
Jones, R. K. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6876-4.ch005 · Cited by 2 · see citing works
Experimenting with Neurosymbolic Artificial Intelligence for Defending Against Cyber Attacks
Eckhoff, M. W., Halvorsen, J., Hansen, B. J., Eian, M., Mavroeidis, V., Chetwyn, R. A., Skjøtskift, G., & Grov, G. (2025) · Neurosymbolic Artificial Intelligence · doi:10.1177/29498732251377352 · Cited by 2 · see citing works
“Various GPT-models have been used in the cyber security domain for a variety of purposes (Motlagh et al., 2024), including pay-load generation for offensive security tasks, leveraging knowledge from the MITRE ATT&CK framework and detection engineering.”
Evaluating Three Large Language Models for Security Incident Detection and Analysis
Mudzakir, A., Janaprasetya, J. T. A., Kayowuan, E., et al. (2025) · Procedia Computer Science · doi:10.1016/j.procs.2025.08.299 · Cited by 2 · see citing works
Tantaroudas, N. D., Karachalios, I., & McCracken, A. J. (2026) · Open Research Europe · doi:10.12688/openreseurope.22957.1 · Cited by 3 · see citing works
Zhao, Y., Li, H., Nguyễn, T. T., Matthews, C., & Yang, Z. (2026) · Safety Science · doi:10.1016/j.ssci.2026.107384 · Cited by 2 · see citing works
Psychological Profiling in Cybersecurity: A Look at LLMs and Psycholinguistic Features
Tshimula, J. M., Nkashama, D. K., Muabila, J. T., Galekwa, R. M., Kanda, H., Dialufuma, M. V., Didier, M. M., Kalala, K., Mundele, S., Lenye, P. K., et al. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-1483-7_31 · Cited by 2 · see citing works
Mahar, M. A., Raza, A., Larik, R. S. A., Burdi, A., Shabbir, M., & Iftikhar, M. (2025) · VAWKUM Transactions on Computer Sciences · doi:10.21015/vtcs.v13i1.2127 · Cited by 2 · see citing works
CyberLlama2 - MEDICALHARM Threat Modeling Assistant
Kwarteng, E., Cebe, M., & Kwarteng, J. L. (2024) · International Conference on Machine Learning and Applications · doi:10.1109/icmla61862.2024.00136 · Cited by 1 · see citing works
“Various advances in research on domain-specific LLMs, including cybersecurity, have been noted in recent studies [3], [4].”
Malware Analysis and Classification Using Deep Learning
Jones, R. K. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3296-3.ch006 · Cited by 1 · see citing works
Phishing and Social Engineering Attack Prevention With LLMs
Queiroz, H. J. D. S. D. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3296-3.ch005 · Cited by 1 · see citing works
LLMs in Security Testing and Monitoring: An Initial Study
Nguyen, L., Nguyen, M.-D., Bui, A. H., Cavalli, A. R., & de, E. M. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-00644-8_9 · Cited by 1 · see citing works
Deep Learning in Malware Classification and Behavior Analysis
Mohammed, D., & MacLennan, H. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6536-7.ch006 · Cited by 1 · see citing works
Adversarial Attacks on Autonomous AI Agents and Mitigation Strategies
Zangana, H. M., Omar, M., Nobles, C., & Rangarajan, A. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6876-4.ch001 · Cited by 1 · see citing works
Agentic AI for Cyber Defense: LLM-Guided Hierarchical Multi-Agent Reinforcement Learning
Jiang, G., Imani, M., Bastian, N. D., & Lan, T. (2025) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom64451.2025.11310253 · Cited by 1 · see citing works
“LLMs have rapidly emerged as dual-use tools in cyber-security, enabling both defensive innovation and new attack vectors [25], [26].”
Eskandarian, M., Rabbani, M., Kaniyamattam, A., Nejati, F., Mirani, M., Piya, G., Opushnyev, I., Ghorbani, A. A., & Dadkhah, S. (2026) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2026.104552 · Cited by 1 · see citing works
Yu, H., Iqbal, S., Neto, E. C. P., Buffett, S., & Taylor, A. (2026) · International Journal of Information Security · doi:10.1007/s10207-026-01321-2 · Cited by 1 · see citing works
Threat Detection and Anomaly Identification Using Deep Learning
Queiroz, H. J. D. S. D., & MacLennan, H. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3296-3.ch003 · Cited by 1 · see citing works
Optimizing Malware Detection with Random Forest, XGBoost, LightGBM, and LLM-Reporting
Charoenthanakitkul, A., Viboonsang, P., & Kosolsombat, S. (2025) · IEEE International Conference on Cybernetics and Innovations (ICCI) · doi:10.1109/icci64209.2025.10987272 · Cited by 1 · see citing works
“Additionally, researchers have explored generative AI models in cybersecurity, particularly in detecting and countering adversarial attacks on machine learning models [6][15].”
A Survey on Large Language Models in Phishing Detection
Şentürk, M. A., & Bahtıyar, Ş. (2025) · IFIP International Conference on New Technologies, Mobility and Security (NTMS) · doi:10.1109/ntms65597.2025.11076905 · Cited by 3 · see citing works
“Motlagh et al. [42] conducted a comprehensive examination of possible risks and advantages related to the offensive and defensive applications of large language models in cyber-security.”
The Impact of Large Language Models on Cybersecurity
Moongela, H., & Mayayise, T. O. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-96262-2_10 · Cited by 1 · see citing works
Omnisec: Llm-Driven Provenance-Based Intrusion Detection Via Retrieval-Augmented Behavior Prompting
Cheng, W., Zhu, T., Jing, S., Mei, J.-P., Ma, M., Jin, J., & Weng, Z. (2025) · doi:10.2139/ssrn.5397852 · Cited by 1 · see citing works
Explainability of Large Language Models (LLMs) in Providing Cybersecurity AdvicePreprint
Okutu, K., & Yumetoshi, H. (2024) · doi:10.31219/osf.io/q84rk
AI Automated Incident Response and Threat Mitigation Using AI
Jones, R. K. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3296-3.ch007
On the Properness of Large Language Models for Malware Detection
Lupaşcu, M., Constantin, V. S., Gavriluţ, D. T., et al. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-89350-6_8
Das, B. R., Jassi, S., Khandelwal, V., Tarun, Agarwal, A., & Priyadarshini, K. (2025) · International Conference on Electronics, AI and Computing (EAIC) · doi:10.1109/eaic66483.2025.11101426
Human Oversight and Fail-Safe Mechanisms in AI Agents
Zangana, H. M., Mustafa, F. M., & Vitianingsih, A. V. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6876-4.ch007
Cybersecurity Architectures for Multi-Agent Autonomous Systems
Yates, R., Abdullah, A., & Sadek, S. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6876-4.ch008
Future Trends in Securing Autonomous AI Agents
Yates, R. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6876-4.ch010
Future skills of a cybersecurity defence team
Lam, T. K., Bongiovanni, I., Carthouser, B., & Williams, J. A. (2025) · Information and Computer Security · doi:10.1108/ics-09-2024-0227
Semantic Information Extraction with Language Models for Zero-Day Attack Detection
Karunarathne, S. S., Rajasegarar, S., & Pan, L. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3061-8_26
Adversarial Threats and Vulnerabilities in Large Language Models
Zangana, H. M., Omar, M., Mustafa, F. M., & Wani, S. (2025) · IGI Global eBooks · doi:10.4018/979-8-3373-7133-7.ch001
Prompt Injection Attacks Risks and Defense Mechanisms
Jones, R. K., & Mohammed, A. M. (2025) · IGI Global eBooks · doi:10.4018/979-8-3373-7133-7.ch005
Red Teaming and Stress-Testing Methodologies for LLM Security
Albtosh, L. B., & Aribowo, W. (2025) · IGI Global eBooks · doi:10.4018/979-8-3373-7133-7.ch006
Open Bilingual Benchmark and Leaderboard for Large Language Models in Cybersecurity
Yu, W., Wan, W., Wang, Z., Li, F., Wang, K., & Hu, G. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3346-6_35
A red teaming framework for large language models: a case study on faithfulness evaluation
Alotaibi, A., Mughus, R., & Ahmed, M. (2026) · Software Quality Journal · doi:10.1007/s11219-026-09779-y · Cited by 1 · see citing works
Weighted Reciprocal Rank Fusion RAG for Context-Aware DoS Attack Mitigation
Kafi, A., Saha, S., & Shahriar, N. (2026) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc65079.2026.11366368
“LLMs show promise for malware analysis, threat reporting, and incident response [1], but general-purpose models often produce vague or incorrect mitigation guidance due to hallucination [2], stale knowledge, and limited grounding—risks that are unacceptable in operational cybersecurity.”
LLM-based Security Audit Assistant for Configuration File Analysis
Depuru, S., Chandana, N., Alekhya, P., Madhu, S. V., & Devi, S. V. C. (2025) · International Conference on Evolutionary Computing and Mobile Sustainable Networks (ICECMSN) · doi:10.1109/icecmsn68058.2025.11383204
“[12].”
MACD: Multi-Agent Collaborative Approach for Cybersecurity Defense Strategy Generation
Li, N., Li, X., Li, Z., Ma, D., Yan, L., Cao, H., Zhang, W., Wang, X., & Liu, Y. (2026) · Information · doi:10.3390/info17040370
Tsochev, G., & Gergov, I. (2026) · Future Internet · doi:10.3390/fi18060295 · Cited by 1 · see citing works
Agentic Architecture for Formalising Security Risk Elicitation
Antipenko, V., & Matulevičius, R. (2026) · Lecture notes in business information processing · doi:10.1007/978-3-032-28274-3_29
AI-Mediated Access to Cybersecurity Risk Information in Corporate Disclosures
Du, H. W., Li, X., & Du, L. (2026) · Information Systems Frontiers · doi:10.1007/s10796-026-10774-8
GENSALE, A., Cagliero, L., Basile, C., Garza, P., & Ferrua, L. (2026) · Algorithms · doi:10.3390/a19070555
“The generated responses exhibit limited bias and hallucination compared to zero-or few-shot LLM prompting [11].”
BabeLLM: A unified taxonomy for NLP-based LLM cybersecurity applications
Casoria, P., & Romano, S. P. (2026) · Expert Systems with Applications · doi:10.1016/j.eswa.2026.133540
Wang, H., Zhao, H., & Yang, Q. (2026) · IEEE International Conference on Electrical Power Systems and Intelligent Control (EPSIC) · doi:10.1109/epsic70071.2026.11590595
Kumar, T. A., Deepak, K., Vignesh, P. S., Rahman, S., Reddy, S. V., & Garidepally, N. (2026) · International Conference on Innovations in Cybersecurity and Data Science (ICICDS) · doi:10.1109/icicds70526.2026.11604913
“A recent advanced review in [3] sorted the defensive and adversarial uses of large language models (LLMs) and highlighted the difficulties connected to reliability, explainability, and hallucination in cybersecurity settings.”
Large Language Model-Driven Cybersecurity Threat Detection and Intelligent Analysis
Xu, S. (2026) · International Conference on Computer Intelligence and Software Engineering (CICSE) · doi:10.1109/cicse70286.2026.11620737
“From traditional intrusion detection systems, they have gradually advanced to intelligent detection solutions based on machine learning and deep learning[7], achieving an improvement in detection accuracy in specific attack scenarios.”
Betancourt, A., COYAGO, G. A. A., Sangoluisa, K., Auz-Torres, M., & Yoo, S. G. (2026) · IEEE Access · doi:10.1109/access.2026.3718389
A Four-Axis Systematization of AI and Cybersecurity in the Era of Large Language Models
Farin, M. A., & Thuraisingham, B. M. (2026) · IEEE Conference on Big Data Security on Cloud (BigDataSecurity) · doi:10.1109/bigdatasecurity69476.2026.00009
“In Cyber Threat Intelligence (CTI), LLMs automate vulnerability summarization, indicator extraction [54], [100], [160],”
Berkimbayev, K., Абитова, Г. А., Perizat, A., et al. (2026) · doi:10.1109/iccsdfai70505.2026.11648053
“…valid while targeting a non-existent module version, a hallucinated SQL payload may be logically malformed in a way that corrupts database state rather than extracting it, and a hallucinated CVE reference may point to a real identifier with entirely fabricated vulnerability details [7].”
Large Language Models in Cybersecurity
Sharma, D., Girdhar, N., & Modi, A. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-1970-2.ch009
- Authors
- Motlagh, F. N., Hajizadeh, M., Majd, M., Najafi, P., Cheng, F., & Meinel, C.
- Affiliations
- Hasso Plattner Institute (DE)
- Chemnitz University of Technology (DE)
- ORCID
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2024
- Pages
- 98-110
- arXiv
- 2402.00891
- OpenAlex
- W4407937958
- Semantic Scholar
- a88d5fb82358d19d0daed7d35d49f03ea6796b57
- Cited by
- 92
- References
- 102
- Citations by year
- 2026: 20 · 2025: 55 · 2024: 17
- FWCI
- 71.12
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Keywords
- large language models, cybersecurity, threat detection, security analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
