15 May 2025 | HANXIANG XU, SHENAO WANG, NINGKE LI, KAILONG WANG*, YANJIE ZHAO, KAI CHEN*, TING YU, YANG LIU, HAOYU WANG*
The rapid advancement of Large Language Models (LLMs) has opened new opportunities for leveraging artificial intelligence in cybersecurity. This systematic literature review (SLR) aims to provide a comprehensive overview of the current state of LLMs in cybersecurity (LLM4Security). By collecting over 40,000 relevant papers and analyzing 185 papers from top security and software engineering venues, the review identifies several key findings:
1. ** expanded range of cybersecurity tasks**: LLMs are being applied to tasks such as vulnerability detection, malware analysis, network intrusion detection, and phishing detection.
2. ** different LLM architectures**: Various LLM architectures (encoder-only, encoder-decoder, and decoder-only) are utilized across security domains and over time, with specific application trends identified.
3. ** sophisticated techniques**: Advanced fine-tuning, prompt engineering, and external augmentation strategies are used to adapt LLMs to specific cybersecurity domains.
4. ** limited datasets**: The datasets used for training and evaluating LLMs in cybersecurity tasks are often limited in size and diversity, highlighting the need for more comprehensive datasets and data augmentation techniques.
The review also discusses the main challenges and opportunities for future research, including the need for more interpretable and robust models, addressing data security, and leveraging LLMs for proactive defense and threat hunting. The findings contribute to the growing body of knowledge on LLMs in cybersecurity and provide valuable guidance for researchers and practitioners.The rapid advancement of Large Language Models (LLMs) has opened new opportunities for leveraging artificial intelligence in cybersecurity. This systematic literature review (SLR) aims to provide a comprehensive overview of the current state of LLMs in cybersecurity (LLM4Security). By collecting over 40,000 relevant papers and analyzing 185 papers from top security and software engineering venues, the review identifies several key findings:
1. ** expanded range of cybersecurity tasks**: LLMs are being applied to tasks such as vulnerability detection, malware analysis, network intrusion detection, and phishing detection.
2. ** different LLM architectures**: Various LLM architectures (encoder-only, encoder-decoder, and decoder-only) are utilized across security domains and over time, with specific application trends identified.
3. ** sophisticated techniques**: Advanced fine-tuning, prompt engineering, and external augmentation strategies are used to adapt LLMs to specific cybersecurity domains.
4. ** limited datasets**: The datasets used for training and evaluating LLMs in cybersecurity tasks are often limited in size and diversity, highlighting the need for more comprehensive datasets and data augmentation techniques.
The review also discusses the main challenges and opportunities for future research, including the need for more interpretable and robust models, addressing data security, and leveraging LLMs for proactive defense and threat hunting. The findings contribute to the growing body of knowledge on LLMs in cybersecurity and provide valuable guidance for researchers and practitioners.