Skip to content

LADE: LLM-Assisted Advanced Persistent Threat Detection and Explanation

· 1 citation · 88 references

TL;DR

Experimental results show that LLMs, when guided by rubric-based prompts and supplemented with ATT&CK domain knowledge, achieve robust performance across detection, localization, and TTP mapping tasks.

View source

Similar papers

Jul 2026

Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection

This paper presents a framework for evaluating prompt injection attacks against LLM-based log interpretation using log traces generated during real cyber attacks, and creates adversarial examples through generic injection generation, refinement, and attack-specific optimization.

Max Landauer, F. Skopik, Markus Wurzenberger et al. · 0 citations
Open access Jul 2026

AttackLogGen: Benchmarking LLMs for generating attack logs

Evaluation across semantic similarity, distributional consistency, discriminability tests, and structural fidelity shows that LLM-generated logs—particularly using GPT-4o-mini, closely approximate real MHMS activity, enabling safe and scalable experimentation for intrusion-detection research.

Ajeet Kumar, Jatin Manoj Mudiraj, Geeta Yadav · 0 citations
Open access Aug 2026

Real-Time Detection and Mitigation of Prompt Injection Attacks in LLM-Integrated Enterprise Systems

Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents Prom...

Fatimah Alhamzawi · 0 citations
Review Open access 2026

DeepSeek Under Attack: An Analysis of Jailbreak Attacks and Prompt-Level Defenses

The reasoning model DeepSeek-R1 was more susceptible to jailbreak attacks than the non-reasoning model DeepSeek-V3, and different prompt-level defenses were effective against static jailbreaks.

V. T. Hayashi, Milton Pedro Pagliuso Neto, C. Miers et al. · 0 citations
Preprint Aug 2026

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

It is shown that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance, and that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context.

A. Al-Ghamdi, S. Layeghy, Marius Portmann · 0 citations
Jul 2026

Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

DeCNIP (Defense with Critical Neuron Isolation Pruning), which leverages representational analysis to identify and neutralize backdoors in a unified pipeline, is introduced, which achieves over 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron inter...

Yuxi Li, Zhi-Bo Zhang, Kailong Wang et al. · 0 citations

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.