Large Language Models for Explainable Threat Intelligence

Tiago Dinis, Miguel Correia, Roger Tavares
11/7/2025
cs.CL

No confident code implementation found for this paper. 3 possible matches can be shown below.

Abstract

As cyber threats continue to grow in complexity, traditional security mechanisms struggle to keep up. Large language models (LLMs) offer significant potential in cybersecurity due to their advanced capabilities in text processing and generation. This paper explores the use of LLMs with retrieval-augmented generation (RAG) to obtain threat intelligence by combining real-time information retrieval with domain-specific data. The proposed system, RAGRecon, uses a LLM with RAG to answer questions about cybersecurity threats. Moreover, it makes this form of Artificial Intelligence (AI) explainable by generating and visually presenting to the user a knowledge graph for every reply. This increases the transparency and interpretability of the reasoning of the model, allowing analysts to better understand the connections made by the system based on the context recovered by the RAG system. We evaluated RAGRecon experimentally with two datasets and seven different LLMs and the responses matched the reference responses more than 91% of the time for the best combinations.

View on arXivView PDF

Code Implementations

No confident code match yet

We couldn't find an author-owned or strongly-evidenced community implementation for this paper. 3 weaker matches are hidden by default — verify before relying on them.

No code implementations found yet.

Know of an implementation? Let us know in the comments below!

Similar Papers

LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing

88% match2023

Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence

88% match2025

Large Language Models in Cybersecurity: State-of-the-Art

87% match2024

The Use of Large Language Models (LLM) for Cyber Threat Intelligence (CTI) in Cybercrime Forums

86% match2024

Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques

85% match2025

Secure Retrieval-Augmented Generation against Poisoning Attacks

85% match2025

Cite this paper

@article{dinis2025large,
  title  = {Large Language Models for Explainable Threat Intelligence},
  author = {Tiago Dinis and Miguel Correia and Roger Tavares},
  year   = {2025},
  eprint = {2511.05406},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2511.05406v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2511.05406.svg)](https://codeofpaper.com/paper/2511.05406)

Discussion