arXiv Machine Learning August 18, 2026 By Abdullah Alghamdi, Siamak Layeghy, Marius Portmann

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

Read the original on arXiv Machine Learning →

arXiv:2608. 16508v1 Announce Type: cross Abstract: We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs.

Summary generated by The Flow from the publisher's feed. The full article lives at arXiv Machine Learning.

arXiv AI

Jul 24

Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models

arXiv:2607. 20832v1 Announce Type: cross Abstract: Advanced Persistent Threats (APTs) remain difficult to detect because only a small fraction of events in large-scale logs are attack-related, and investigation is expensive and hard to scale.

By Shoya Otsu, Kei Suzuki, Toshiaki Koike-Akino, Jing Liu, Ye Wang

llms benchmarks

arXiv Machine Learning

Jun 17

Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation

arXiv:2606. 18190v1 Announce Type: cross Abstract: Multi-stage cyberattacks span system, network, and browser logs.

By Abir Ashab Niloy, Ahmed Ryan, Imamul Hossain Rafi, Md Erfan, Md Rayhanur Rahman

llms fine-tuning safety

arXiv AI

Jul 14

SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification

arXiv:2607. 09936v1 Announce Type: cross Abstract: Cybersecurity systems must adapt rapidly to emerging threats.

By Ivan Alejandro Montoya Sanchez, Anantaa Kotal, Aritran Piplai

llms fine-tuning efficiency benchmarks safety

arXiv AI

Jul 22

Towards Principled Continual Anomaly Detection: A Systematic Framework and Benchmark Scenarios

arXiv:2607. 18289v1 Announce Type: cross Abstract: Continual anomaly detection (CAD) studies how models can adapt to evolving data distributions while retaining performance on previously observed regimes.

By Kamil Faber, Mateusz Smendowski, Roberto Corizzo

benchmarks

arXiv AI

Jul 2

Toward Cybersecurity-Expert Small Language Models

arXiv:2510. 14113v2 Announce Type: replace-cross Abstract: Large language models (LLMs) are transforming everyday applications, yet deployment in cybersecurity lags due to a lack of high-quality, domain-specific models and training datasets.

By Matan Levi, Daniel Ohayon, Ariel Blobstein, Ravid Sagi, Ian Molloy, Yair Allouche

llms benchmarks

arXiv AI

Jun 9

Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning

arXiv:2606. 08649v1 Announce Type: cross Abstract: Forensic analysis of web server logs demands both accurate detection and human-readable explanations that can satisfy legal requirements.

By Bernhard Kneip, Nhien-An Le-Khac, Hong-Hanh Nguyen-Le

llms

Related stories

Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models

Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation

SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification

Towards Principled Continual Anomaly Detection: A Systematic Framework and Benchmark Scenarios

Toward Cybersecurity-Expert Small Language Models

Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning