Large Language Models for Cyber Security: A Systematic Literature Review

Large Language Models for Cyber Security: A Systematic Literature Review

15 May 2025 | HANXIANG XU, Huazhong University of Science and Technology, China; SHENAO WANG, Huazhong University of Science and Technology, China; NINGKE LI, Huazhong University of Science and Technology, China; KAILONG WANG*, Huazhong University of Science and Technology, China; YANJIE ZHAO, Huazhong University of Science and Technology, China; KAI CHEN*, Huazhong University of Science and Technology, China; TING YU, Hamad Bin Khalifa University, The State of Qatar; YANG LIU, Nanyang Technological University, Singapore; HAOYU WANG*, Huazhong University of Science and Technology, China
The rapid advancement of Large Language Models (LLMs) has opened new opportunities for leveraging artificial intelligence in cybersecurity. This systematic literature review (SLR) aims to provide a comprehensive overview of the current state of LLMs in cybersecurity (LLM4Security). By collecting over 40,000 relevant papers and analyzing 185 papers from top security and software engineering venues, the review identifies several key findings: 1. ** expanded range of cybersecurity tasks**: LLMs are being applied to tasks such as vulnerability detection, malware analysis, network intrusion detection, and phishing detection. 2. ** different LLM architectures**: Various LLM architectures (encoder-only, encoder-decoder, and decoder-only) are utilized across security domains and over time, with specific application trends identified. 3. ** sophisticated techniques**: Advanced fine-tuning, prompt engineering, and external augmentation strategies are used to adapt LLMs to specific cybersecurity domains. 4. ** limited datasets**: The datasets used for training and evaluating LLMs in cybersecurity tasks are often limited in size and diversity, highlighting the need for more comprehensive datasets and data augmentation techniques. The review also discusses the main challenges and opportunities for future research, including the need for more interpretable and robust models, addressing data security, and leveraging LLMs for proactive defense and threat hunting. The findings contribute to the growing body of knowledge on LLMs in cybersecurity and provide valuable guidance for researchers and practitioners.The rapid advancement of Large Language Models (LLMs) has opened new opportunities for leveraging artificial intelligence in cybersecurity. This systematic literature review (SLR) aims to provide a comprehensive overview of the current state of LLMs in cybersecurity (LLM4Security). By collecting over 40,000 relevant papers and analyzing 185 papers from top security and software engineering venues, the review identifies several key findings: 1. ** expanded range of cybersecurity tasks**: LLMs are being applied to tasks such as vulnerability detection, malware analysis, network intrusion detection, and phishing detection. 2. ** different LLM architectures**: Various LLM architectures (encoder-only, encoder-decoder, and decoder-only) are utilized across security domains and over time, with specific application trends identified. 3. ** sophisticated techniques**: Advanced fine-tuning, prompt engineering, and external augmentation strategies are used to adapt LLMs to specific cybersecurity domains. 4. ** limited datasets**: The datasets used for training and evaluating LLMs in cybersecurity tasks are often limited in size and diversity, highlighting the need for more comprehensive datasets and data augmentation techniques. The review also discusses the main challenges and opportunities for future research, including the need for more interpretable and robust models, addressing data security, and leveraging LLMs for proactive defense and threat hunting. The findings contribute to the growing body of knowledge on LLMs in cybersecurity and provide valuable guidance for researchers and practitioners.
Reach us at info@study.space