Cybersecurity & LLMs

1. Threat Intelligence with LLMs

Threat intelligence analysts spend significant time reading vulnerability disclosures, malware reports, and dark web postings to understand the threat landscape. LLMs can process these sources at scale, extracting indicators of compromise (IOCs), mapping tactics to the MITRE ATT&CK framework, and generating actionable intelligence reports.

from openai import OpenAI
import json

client = OpenAI()

def extract_threat_intel(report_text: str) -> dict:
    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[
            {"role": "system", "content": """Extract structured threat intelligence.
Return JSON with: threat_actor, malware_family, iocs (ip_addresses,
domains, file_hashes), mitre_attack_techniques, severity,
affected_systems, recommended_actions."""},
            {"role": "user", "content": report_text},
        ],
        response_format={"type": "json_object"},
    )
    return json.loads(response.choices[0].message.content)

intel = extract_threat_intel("""A new ransomware variant dubbed 'NightOwl'
has been targeting healthcare organizations via phishing emails with
malicious PDF attachments. The malware communicates with C2 servers
at 198.51.100.42 and uses AES-256 encryption...""")
print(json.dumps(intel, indent=2))

2. Log Analysis and Anomaly Detection

Security logs generate millions of events per day. LLMs can analyze log patterns, identify anomalies that rule-based systems miss, and provide natural language explanations of what happened and why it matters. This is particularly valuable for reducing alert fatigue: instead of hundreds of raw alerts, the SOC analyst receives a prioritized summary with context.

# LLM-powered security log analysis
def analyze_security_logs(logs: list[str]) -> str:
    log_text = "\n".join(logs[-100:])  # Last 100 entries
    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[
            {"role": "system", "content": """You are a senior SOC analyst.
Analyze these security logs for suspicious patterns. Focus on:
failed authentication attempts, unusual access patterns, data
exfiltration indicators, privilege escalation, and lateral movement.
Prioritize findings by severity (Critical/High/Medium/Low)."""},
            {"role": "user", "content": f"Analyze these logs:\n{log_text}"},
        ],
    )
    return response.choices[0].message.content

3. Vulnerability Detection and Code Auditing

# LLM-powered code vulnerability scanner
def scan_for_vulnerabilities(code: str, language: str = "python") -> str:
    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[
            {"role": "system", "content": f"""You are a security code auditor for {language}.
Analyze the code for: SQL injection, XSS, command injection, path
traversal, hardcoded secrets, insecure deserialization, SSRF,
authentication/authorization flaws, and cryptographic weaknesses.
For each finding: describe the vulnerability, its severity (CVSS-like),
the affected line(s), and a remediation suggestion."""},
            {"role": "user", "content": f"Audit this code:\n```{language}\n{code}\n```"},
        ],
    )
    return response.choices[0].message.content

vulnerable_code = """
def get_user(request):
    user_id = request.args.get('id')
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)
"""

print(scan_for_vulnerabilities(vulnerable_code))

4. Adversarial Uses and Defense

LLMs lower the barrier for several categories of cyber attacks. Phishing emails generated by LLMs are more convincing because they avoid the grammatical errors and generic phrasing that traditional filters catch. LLMs can generate polymorphic malware code that evades signature-based detection. Social engineering attacks benefit from LLMs' ability to maintain convincing personas in real-time conversations. Understanding these offensive capabilities is essential for building effective defenses.