Large Language Models for Explainable Threat Intelligence

2025-04-08

2025 20th European Dependable Computing Conference Companion Proceedings (EDCC-C)

AI Summary

To address the limited interpretability and poor timeliness of conventional threat intelligence methods, this paper proposes an end-to-end framework integrating domain-adaptive fine-tuning of large language models (LLMs) with retrieval-augmented generation (RAG). The framework employs a vector database for dynamic, real-time retrieval of domain-specific cybersecurity knowledge and fine-tunes the LLM on security-oriented corpora to ensure transparent reasoning and up-to-date knowledge. Its key innovation lies in deeply embedding the RAG mechanism within the threat analysis pipeline, thereby significantly improving detection accuracy for zero-day threats and enhancing attribution traceability. Experimental results demonstrate that the method outperforms baseline models across multiple threat intelligence tasks. Generated intelligence reports exhibit high readability, strong interpretability, and operational responsiveness—with average inference latency under 3 seconds.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

As cyber threats continue to grow in complexity, traditional defense mechanisms often struggle to keep up. Large Language Models (LLMs) offer significant potential in cybersecurity due to their advanced capabilities in text comprehension and generation. This research explores the use of LLMs through Retrieval-Augmented Generation (RAG) to enhance cybersecurity functions by combining real-time information retrieval with domain-specific data for more accurate and timely Cyber Threat Intelligence (CTI).

Problem

• Using LLMs with RAG to obtain threat intelligence
• Making AI explainable via knowledge graphs for cybersecurity
• Increasing transparency in threat analysis model reasoning

Innovation

• Uses LLMs with retrieval-augmented generation for threat intelligence
• Generates explainable knowledge graphs for each AI response
• Combines real-time information with domain-specific cybersecurity data