Large Language Models for Cyber Security: A Systematic Literature Review

TL;DR

This paper systematically reviews over 185 studies on the use of Large Language Models in cybersecurity, highlighting their expanding applications, adaptation techniques, and emerging autonomous agent trends for complex security tasks.

Contribution

It provides a comprehensive analysis of LLM applications in cybersecurity, identifying key trends, architectures, and innovative adaptation strategies in the field.

Findings

LLMs are applied to vulnerability detection, malware analysis, and intrusion detection.

Different LLM architectures are used across security domains.

Emerging use of LLM-based autonomous agents for complex workflows.

Abstract

The rapid advancement of Large Language Models (LLMs) has opened up new opportunities for leveraging artificial intelligence in a variety of application domains, including cybersecurity. As the volume and sophistication of cyber threats continue to grow, there is an increasing need for intelligent systems that can automatically detect vulnerabilities, analyze malware, and respond to attacks. In this survey, we conduct a comprehensive review of the literature on the application of LLMs in cybersecurity~(LLM4Security). By comprehensively collecting over 40K relevant papers and systematically analyzing 185 papers from top security and software engineering venues, we aim to provide a holistic view of how LLMs are being used to solve diverse problems across the cybersecurity domain. Through our analysis, we identify several key findings. First, we observe that LLMs are being applied to an expanding range of cybersecurity tasks, including vulnerability detection, malware analysis, and network intrusion detection. Second, we analyze application trends of different LLM architectures (such as encoder-only, encoder-decoder, and decoder-only) across security domains. Third, we identify increasingly sophisticated techniques for adapting LLMs to cybersecurity, such as advanced fine-tuning, prompt engineering, and external augmentation strategies. A significant emerging trend is the use of LLM-based autonomous agents, which represent a paradigm shift from single-task execution to orchestrating complex, multi-step security workflows.