Jun 2026· IEEE Conference on Network Softwarization· pp. 611-617· 0 citations· 27 references
Computer Science
Abstract
Artificial intelligence improves many cybersecurity areas, from proactive network monitoring to reactive incident handling. Since cybersecurity copes with critical decisions and data, approaches often aim to augment human intelligence instead of replacing it. Intelligence augmentation in mind allows designing tools that empower humans to process larger volumes of data, solve issues faster, and make cybersecurity analysis easier. In this paper, we propose how to apply large language models in the Resilmesh platform for cyber situational awareness. We implemented a visualization panel in the platform's dashboard and a service answering a user's questions concerning the current network state based on the content of a graph database. They were used for orientation in graph data and prioritization of vulnerabilities. Our results reveal that language models, retrieval augmented generation, and meta prompting usually allow answering clear and straightforward questions correctly, while sometimes not strictly following formatting instructions present in prompts. It implies that analysts could create their own analysis easily, quickly, and on demand. Despite several advantages, models must be instructed concerning several details in the future, such as outputting only distinct values from the database and not making up their own results when a question has no answer.
In critical infrastructure environments, cybersecurity situation-awareness platforms generate large volumes of alerts, including substantial numbers of false positives, placing a considerable burden on security analysts. At present, alert correlation methods mainly rely on rule-based matching or statistical clustering, and large language models often lack the domain-specific threat intelligence required for reliable security analysis. This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation. A temporal heterogeneous graph attention network constructs alert-relation graphs within a 72 h sliding window, and temporal decay and multi-relational dependencies are captured. Powered by bge-m3 embeddings and a dense vector index, the RAG module retrieves the most relevant threat intelligence entries above a cosine similarity threshold of 0.75. A domain-specific dataset of 1000 annotated security alerts from a nuclear power operational environment was built, and Cohen’s Kappa reached 0.87. The experiments show that GRAL achieves a macro-averaged precision of 87.0%, a macro-averaged recall of 97.0%, and a binary false-positive rate of 9.1%, together with 92.5% alert compression. Generalisation capability is confirmed by cross-dataset evaluation on CICIDS2017 (93.0% accuracy and 92.5% F1-score) and UNSW-NB15 (89.4% accuracy and 89.8% F1-score).
Deng Zhang, Juan Wang, Hanjun Gao et al.· Symmetry· 0 citations
In this paper, an intelligent cyber threat intelligence framework involving automated vulnerability severity assessment, contextual risk interpretation and generation of mitigation recommendation is presented. The proposed system has been designed to analyze the CVE-related description of vulnerabilities and the security metadata related to them, classify the level of severity of the threat and estimate its relevance to risk with the help of a transformer-based natural language processing model. To build contextual awareness beyond classification, it adds a retrieval-augmented mechanism to recognize semantically similar vulnerability records for contextual evidence-based threat interpretation. It is additionally fortified with vulnerability analysis, like CVE retrieval, client qualifications, record following, and even visualisation as a web application platform. The two processes, one involving the severities of the transformers, and the other the retrieval of threat intelligence and mitigation advice, into a single operational flow, thus reducing the manual reliance on Vulnerability Triage and aiding security analysts in prioritizing cyber risks. The proposed framework allows for the automatic processing of textual information on vulnerabilities and the comparison of such information and a contextual analysis with previous vulnerabilities discovered. Unlike conventional vulnerability assessment approaches that perform severity classification independently of contextual threat interpretation, the proposed framework integrates transformer-based semantic analysis, retrieval-augmented vulnerability intelligence, cyber-risk estimation, and mitigation recommendation generation within a unified analytical workflow. By combining predictive language modelling with contextual vulnerability retrieval, the framework supports evidence-driven cyber threat analysis and structured decision support for security analysts. The proposed architecture provides a scalable approach for automated vulnerability prioritization and contextual cyber threat intelligence that is suitable for modern cybersecurity operations involving large volumes of vulnerability reports.
Someru Kuruva Giriraju, Shaik Khaja Baba, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
With the development of smart civil aviation, the cybersecurity situation for air traffic management (ATM) continues to be critical. The increasingly exposed attack surface demands more advanced technologies and methods for protection. Large language models (LLMs) have been widely applied in cybersecurity, which has provided a novel paradigm for reconstructing ATM cybersecurity defense systems. However, existing vertical domain LLMs in ATM focus on providing passenger services and supporting daily operations, which do not concern cybersecurity. This neglect is a potential risk in the transition from security to safety. In this paper, a prompt-engineering-based method for generating question–answer pairs for ATM cybersecurity is proposed. Knowledge is extracted from multi-source heterogeneous primary sources and converted into uniformly formatted question–answer pairs, and an ATM cybersecurity fine-tuning dataset and benchmark are constructed. By fine-tuning the Deepseek-llm-7B-base model and DeepSeek-R1-Distill-Qwen-14B model using both instruction fine-tuning and reasoning fine-tuning methods, based on Low-Rank Adaptation (LoRA) and full-parameter fine-tuning technologies, a vertical domain LLM named “AeroSec” for ATM cybersecurity was constructed. By comparing the fine-tuned model with the base model, DeepSeek-V3 model, and DeepSeek-R1 model through the third-party model Qwen-Plus, the useful value of AeroSec in answering questions in specialized domains such as ATM network threat analysis and offensive-defensive techniques has been validated.
Ruochen Dong, Chengkai Piao, Buhong Wang et al.· Scientific Reports· 0 citations
The rapid evolution of cyberattacks, coupled with the increasing capacity of computing environments and the emergence of artificial intelligence (AI), has significantly complicated the security landscape. While existing studies largely emphasize improving AI model performance for individual cybersecurity tasks, this survey shifts the focus toward operationalizing the deployment rationale and understanding when, where, and why different AI paradigms should be deployed, the capabilities they offer; and the challenges that must be addressed to enable trustworthy and effective real-world cyber defense. This paper aims to provide researchers and practitioners with a comprehensive reference for understanding the evolving role of AI in cybersecurity and the challenges that must be addressed to develop trustworthy and resilient AI-driven cyber defense systems. In this paper, we propose a structured taxonomy to organize various dimensions of AI-driven cybersecurity; review them critically; and finally, discuss key challenges, open problems, and emerging trends.
This work proposes MITRE-SAGE, a multi-agent retrieval-augmented generation framework that integrates semantic and structural cybersecurity knowledge to improve the reliability and interpretability of LLM-based QA systems and proposes MITRE-QA, a comprehensive benchmark for evaluating LLMs across diverse cybersecurity knowledge tasks.
Ali Habibzadeh, Farid Feyzi, Reza Ebrahimi Atani· 0 citations
This paper provides a tutorial and survey of LLM-based agents for automated vulnerability discovery and penetration testing. The rapid advancements in Large Language Models (LLMs) have opened new possibilities for their application in cybersecurity. Unlike traditional tools, LLMs can process natural language, retain context, and perform structured reasoning, enabling automation of complex security workflows. By equipping these models with memory mechanisms and tool-use interfaces, researchers have developed LLM-driven autonomous agents capable of performing specialized tasks such as web application testing, source code auditing, fuzzing, and network security assessment. Multi-agent architectures have emerged in which agents assume specialized roles (e.g., distinct penetration-test phases or exploit types). In addition to surveying existing applications, this work provides a step-by-step walkthrough of integrating agentic AI into penetration testing workflows. The walkthrough explores four phases: (I) mission scoping and prompt engineering for test definition and constraint enforcement, (II) autonomous exploration and tool selection for target interaction, (III) vulnerability hypothesis formation and verification through experiment design and feedback, and (IV) payload generation and refinement to transform validated findings into concrete exploits. The survey synthesizes 155 cited sources (2022–early 2026) using explicit inclusion/exclusion criteria, with coverage extending to reasoning-class models, the Model Context Protocol ecosystem, autonomous bug-bounty agents, and standardized agentic security benchmarks. Despite progress, challenges persist, such as model hallucination, context limitations, operating costs, and ethical concerns. Future directions include advancements in multi-agent collaboration, mechanisms for agent self-improvement, and improved transparency into agent behavior.
Robel Addis, Kiran Porter, J. Ryan et al.· IEEE Access· 0 citations