CoChat
Sign Up
Cited by 38Adversarial Robustness in Machine LearningNetwork Security and Intrusion DetectionInformation and Cyber Security

Beyond Detection: Large Language Models and Next-Generation Cybersecurity

Open access
Ali, Aitizaz, Ghanem, Mohamed C.·2025·SHIFRA
DOI 10.70470/shifra/2025/005
Open this paper in CoChat — free accountOpen PDF

Abstract

The Integrating Contextual and Adaptive Cyber Defense Systems The accelerating evolution of cyber threats, seen both in terms of their complexity and frequency of attempts, makes it imperative to move away from traditional, reactive defense structures and towards intelligent, adaptive and proactive cyber defense strategies. Large Language Models (LLMs) (such as GPT this-will-be-a-zillionth-of-a-second-type-here or BERT derivatives) represent powerful new capabilities developed for understanding, analyzing, and generating human-like language with contextual depth enabling a new frontier in the land of cyber defense. This survey investigates the influence of LLMs on multiple key technical areas of cybersecurity including software and system security, network security, content moderation, hardware security, and blockchain security. It showcases applications of LLMs in tasks in vulnerability detection and prevention, phishing, malware detection and analysis, and intrusion detection; as well as smart contract auditing and adversarial attack simulation. The paper goes more in-depth on technical constructs like zero-shot and few-shot threat hunting, prompt engineering for scenario modeling, and retrieval-augmented generation for real-time intelligence. Task differences are captured in knowledge retrieval from external sources, enabling more contextual learning and task adaptability, inter-model interaction, and augmentation through domain-specific fine-tuning. While promising, LLMs pose open challenges, such as hallucination, adversarial misuse, generalization problems, and ethical issues around privacy and accountability. The implications of such comparative analysis across domains highlight the strengths as well as ‘emerging risk’ associated with LLM systems at mission critical environments. The survey ends with a highly visionary section on the future opportunities around future self-healing systems, autonomous cyber agents, and the future of LLMs that can not only detect threats but also predict, simulate, and respond automatically to threats. This work serves as a foundational roadmap for researchers and practitioners for the use of LLMs for the next generation of resilient cybersecurity tools.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.70470/shifra/2025/005

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Cybersecurity environments impose distinct and high reliability, auditability, and reproducibility requirements because incorrect or unverifiable automatic actions are commonly found.

    “This approach is justified by the recent findings showing that cybersecurity environments impose distinct and high reliability, auditability, and reproducibility requirements because incorrect or unverifiable automatic actions are commonly found [9], [10], [11].”

    From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [10]

    Section 8, “Challenges and Open Issues” (page unavailable), says incorrect LLM outputs can have serious consequences in security-critical environments and calls for verification; it also raises accountability and transparency concerns about automated decisions. Section 2.3 describes auditability as a relevant model attribute. The paper does not establish a reproducibility requirement or say that incorrect or unverifiable automatic actions are commonly found. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

  • Current literature on the topic search looks into the application areas and limitations of LLMs in cybersecurity, yet it is not enough to trace the architectural development in the respective agentic systems over generations.

    “Current literature on the topic search looks into the application areas and limitations of LLMs in cybersecurity, yet it is not enough to trace the architectural development in the respective agentic systems over generations [10], [21], [22].”

    From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [10]

    The Introduction (page unavailable) says the survey reviews LLM applications and limitations across cybersecurity domains, supporting that part of the claim. Section 2.1 discusses LLM architecture types, but the passages do not assess whether existing literature adequately traces the architectural development of agentic systems across generations. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 57

  1. R. Pascanu, C. Gulcehre, K. Cho, and Y. Bengio, "How to construct deep recurrent neural networks," arXiv preprint arXiv:1312.6026, 2013. · arXiv
  2. S. Hochreiter and J. Schmidhuber, "Long short-term memory," Neural Computation, vol. 9, no. 8, pp. 1735-1780, 1997.
  3. R. Dey and F. M. Salem, "Gate-variants of gated recurrent unit (GRU) neural networks," in Proc. IEEE 60th Int. Midwest Symp. Circuits Syst. (MWSCAS), pp. 1597-1600, 2017.
  4. A. Vaswani et al., "Attention is all you need," in Advances in Neural Information Processing Systems, vol. 30, 2017.
  5. B. Yan et al., "On protecting the data privacy of large language models (LLMs): A survey," arXiv preprint arXiv:2403.05156, 2024. · arXiv
  6. D. Myers et al., "Foundation and large language models: Fundamentals, challenges, opportunities, and social impacts," Cluster Comput., vol. 27, no. 1, pp. 1-26, 2024.
  7. S. Tonmoy et al., "A comprehensive survey of hallucination mitigation techniques in large language models," arXiv preprint arXiv:2401.01313, 2024. · arXiv
  8. M. A. Ferrag, M. Debbah, and M. Al-Hawawreh, "Generative AI for cyber threat-hunting in 6G-enabled IoT networks," in Proc. IEEE/ACM 23rd Int. Symp. Cluster, Cloud and Internet Comput. Workshops (CCGridW), pp. 16- 25, 2023.
  9. Y. Yan, Y. Zhang, and K. Huang, "Depending on yourself when you should: Mentoring LLM with RL agents to become the master in cybersecurity games," arXiv preprint arXiv:2403.17674, 2024. · arXiv
  10. M. Sladić et al., "LLM in the shell: Generative honeypots," arXiv preprint arXiv:2309.00155, 2023. · arXiv
  11. W. Tann et al., "Using large language models for cybersecurity capture-the-flag challenges and certification questions," arXiv preprint arXiv:2308.10443, 2023. · arXiv
  12. O. G. Lira, A. Marroquin, and M. A. To, "Harnessing the advanced capabilities of LLM for adaptive intrusion detection systems," in Int. Conf. Adv. Inf. Netw. Appl., Springer, pp. 453-464, 2024.
  13. C. Ebert and M. Beck, "Artificial intelligence for cybersecurity," IEEE Softw., vol. 40, no. 6, pp. 27-34, 2023.
  14. J. Wang et al., "Software testing with large language models: Survey, landscape, and vision," IEEE Trans. Softw. Eng., 2024.
  15. E. Almazrouei et al., "The Falcon series of open language models," arXiv preprint arXiv:2311.16867, 2023. · arXiv
  16. H. Lai and M. Nissim, "A survey on automatic generation of figurative language: From rule-based systems to large language models," ACM Comput. Surv., 2024.
  17. M. A. Ferrag et al., "Revolutionizing cyber threat detection with large language models: A privacy-preserving BERT- based lightweight model for IoT/IIoT devices," IEEE Access, 2024.
  18. N. Tihanyi et al., "Dynamic intelligence assessment: Benchmarking LLMs on the road to AGI with a focus on model confidence," arXiv preprint arXiv:2410.15490, 2024. · arXiv
  19. N. Tihanyi et al., "Cybermetric: A benchmark dataset based on retrieval-augmented generation for evaluating LLMs in cybersecurity knowledge," in Proc. IEEE Int. Conf. Cyber Secur. Resilience (CSR), pp. 296-302, 2024.
  20. Z. Liu, "A review of advancements and applications of pre-trained language models in cybersecurity," in Proc. 12th Int. Symp. Digit. Forensics Secur. (ISDFS), pp. 1-10, 2024.
  21. O. Friha et al., "LLM-based edge intelligence: A comprehensive survey on architectures, applications, security and trustworthiness," IEEE Open J. Commun. Soc., 2024.
  22. S. Jamal, H. Wimmer, and I. H. Sarker, "An improved transformer-based model for detecting phishing, spam and ham emails: A large language model approach," Security Privacy, p. e402, 2024. [Online]. Available: https://doi.org/10.1002/spy2.402 · DOI
  23. W. X. Zhao et al., "A survey of large language models," arXiv preprint arXiv:2303.18223, 2023. · arXiv
  24. F. R. Alzaabi and A. Mehmood, "A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods," IEEE Access, vol. 12, pp. 30907-30927, 2024.
  25. M. A. K. Raiaan et al., "A review on large language models: Architectures, applications, taxonomies, open issues and challenges," IEEE Access, vol. 12, pp. 26839-26874, 2024.
  26. R. Fang et al., "LLM agents can autonomously exploit one-day vulnerabilities," arXiv preprint arXiv:2404.08144, 2024. · arXiv
  27. Y. Chang et al., "A survey on evaluation of large language models," ACM Trans. Intell. Syst. Technol., 2023.
  28. D. Saha et al., "LLM for SoC security: A paradigm shift," arXiv preprint arXiv:2310.06046, 2023. · arXiv
  29. B. Min et al., "Recent advances in natural language processing via large pre-trained language models: A survey," ACM Comput. Surv., vol. 56, no. 2, pp. 1-40, 2023.
  30. S. Zhang et al., "Instruction tuning for large language models: A survey," arXiv preprint arXiv:2308.10792, 2023. · arXiv
  31. A. Fan et al., "Large language models for software engineering: Survey and open problems," arXiv preprint arXiv:2310.03533, 2023. · arXiv
  32. J. Wu et al., "Multimodal large language models: A survey," arXiv preprint arXiv:2311.13165, 2023. · arXiv
  33. Y. Liu et al., "Trustworthy LLMs: A survey and guideline for evaluating large language models' alignment," arXiv preprint arXiv:2308.05374, 2023. · arXiv
  34. L. Hu et al., "A survey of knowledge enhanced pre-trained language models," IEEE Trans. Knowl. Data Eng., 2023.
  35. Z. A. Abbood, D. Ç. Atilla, and Ç. Aydin, "Intrusion detection system through deep learning in routing MANET networks," Intell. Autom. Soft Comput., vol. 37, no. 1, pp. 269-281, 2023.
  36. Z. A. Abbood, N. A. F. Abbas, and B. Makki, "Spectrum sensing utilizing power threshold and artificial intelligence in cognitive radio," Int. J. Robot. Control Syst., vol. 2, no. 4, pp. 628-637, 2022.
  37. Y. Yigit et al., "Critical infrastructure protection: Generative AI, challenges, and opportunities," arXiv preprint arXiv:2405.04874, 2024. · arXiv
  38. J. Wang et al., "Software testing with large language models: Survey, landscape, and vision," IEEE Trans. Softw. Eng., pp. 1-27, 2024.
  39. H. Xu et al., "Large language models for cyber security: A systematic literature review," arXiv preprint arXiv:2405.04760, 2024. · arXiv
  40. Z. Han et al., "Parameter-efficient finetuning for large models: A comprehensive survey," arXiv preprint arXiv:2403.14608, 2024. · arXiv
  41. J. Zhang et al., "When LLMs meet cybersecurity: A systematic literature review," arXiv preprint arXiv:2405.03644, 2024. · arXiv
  42. C. Cui et al., "A survey on multimodal large language models for autonomous driving," in Proc. IEEE/CVF Winter Conf. Appl. Comput. Vis. pp. 958-979, 2024,.
  43. G. Bai et al., "Beyond efficiency: A systematic survey of resource-efficient large language models," arXiv preprint arXiv:2401.00625, 2024. · arXiv
  44. S. Tian et al., "Opportunities and challenges for ChatGPT and large language models in biomedicine and health," Brief. Bioinform., vol. 25, no. 1, p. bbad493, 2024.
  45. D. E. Rumelhart, G. E. Hinton, and R. J. Williams, "Learning representations by back-propagating errors," Nature, vol. 323, no. 6088, pp. 533-536, 1986.
  46. S. M. Kasongo, "A deep learning technique for intrusion detection system using a recurrent neural networks based framework," Comput. Commun., vol. 199, pp. 113-125, 2023.
  47. S. M. Sohi, J.-P. Seifert, and F. Ganji, "RNNIDS: Enhancing network intrusion detection systems through deep learning," Comput. Secur., vol. 102, p. 102151, 2021.
  48. K. Cho et al., "Learning phrase representations using RNN encoder-decoder for statistical machine translation," arXiv preprint arXiv:1406.1078, 2014. · arXiv
  49. H. Sedjelmaci et al., "Cyber security based on artificial intelligence for cyber-physical systems," IEEE Netw., vol. 34, no. 3, pp. 6-7, 2020.
  50. P. Dixit and S. Silakari, "Deep learning algorithms for cybersecurity applications: A technological and status review," Comput. Sci. Rev., vol. 39, p. 100317, 2021.
  51. S. Gaba et al., "A systematic analysis of enhancing cybersecurity using deep learning for cyber physical systems," IEEE Access, 2024.
  52. C. Yin et al., "A deep learning approach for intrusion detection using recurrent neural networks," IEEE Access, vol. 5, pp. 21954-21961, 2017.
  53. D. Güera and E. J. Delp, "Deepfake video detection using recurrent neural networks," in Proc. 15th IEEE Int. Conf. Adv. Video Signal Based Surveill. (AVSS, pp. 1-6), 2018.
  54. S. Althubiti et al., "Applying long short-term memory recurrent neural network for intrusion detection," in Proc. SoutheastCon, pp. 1-5, 2018.
  55. C. Xu et al., "An intrusion detection system using a deep neural network with gated recurrent units," IEEE Access, vol. 6, pp. 48697-48707, 2018.
  56. M. A. Ferrag and L. Maglaras, "DeepCoin: A novel deep learning and blockchain-based energy exchange framework for smart grids," IEEE Trans. Eng. Manag., vol. 67, no. 4, pp. 1285-1297, 2019.
  57. A. Chawla et al., "Host based intrusion detection system with combined CNN/RNN model," in ECML PKDD 2018 Workshops, Springer, pp. 149-158, 2019.

Cited by

Sorted by citations

Authors
Ali, A., & Ghanem, M. C.
Affiliations
  • Asia Pacific University of Technology & Innovation (MY)
  • University of Liverpool (GB)
ORCID
Venue
SHIFRA
Publisher
Peninsula Publishing Press
Published
2025-02-15
Volume
2025
Pages
81-97
ISSN
3078-3186 (ISSN-L)
DOI
10.70470/shifra/2025/005
OpenAlex
W4409576412
Cited by
38
References
0
Citations by year
2026: 23 · 2025: 15
FWCI
15.30
Type
journal article
Language
en
Open access
Licence
Locations
  • Shifra. (publishedVersion, cc-by)
  • London Met Repository (London Metropolitan University) (submittedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
large language models, cybersecurity, adaptive cyber defense, proactive threat detection, vulnerability detection, phishing detection, malware detection, intrusion detection, smart contract auditing, threat hunting, prompt engineering, retrieval-augmented generation, hallucinations, self-healing systems, content moderation, hardware security, blockchain security, network security, software security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review