# ThreatModeling-LLM: Automating Threat Modeling using Large Language Models for Banking System

arXiv: https://arxiv.org/abs/2411.17058 · HTML: https://mlsanity.com/paper/2411.17058/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 25 references that are in the map.
- First posted on arXiv 26 Nov 2024.

## Builds on (most cited first, 7 of 7)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [The Llama 3 Herd of Models](https://mlsanity.com/paper/2407.21783/) (2024)
- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [Large Language Models as Optimizers](https://mlsanity.com/paper/2309.03409/) (2023)
- [Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methods](https://mlsanity.com/paper/2210.07321/) (2022)
- [Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks with GPT-4](https://mlsanity.com/paper/2309.16422/) (2023)

## Built on by (most cited first, 10 of 10)

- [ASTRIDE: A Security Threat Modeling Platform for Agentic-AI Applications](https://mlsanity.com/paper/2512.04785/) (2025)
- [Auspex: Building Threat Modeling Tradecraft into an Artificial Intelligence-based Copilot](https://mlsanity.com/paper/2503.09586/) (2025)
- [LLMs' Suitability for Network Security: A Case Study of STRIDE Threat Modeling](https://mlsanity.com/paper/2505.04101/) (2025)
- [ACSE-Eval: Can LLMs threat model real-world cloud infrastructure?](https://mlsanity.com/paper/2505.11565/) (2025)
- [CyberAId: AI-Driven Cybersecurity for Financial Service Providers](https://mlsanity.com/paper/2605.01892/) (2026)
- [On Automating Security Policies with Contemporary LLMs](https://mlsanity.com/paper/2506.04838/) (2025)
- [PriMod4AI: Lifecycle-Aware Privacy Threat Modeling for AI Systems using LLM](https://mlsanity.com/paper/2602.04927/) (2026)
- [From Incomplete Architecture to Quantified Risk: Multimodal LLM-Driven Security Assessment for Cyber-Physical Systems](https://mlsanity.com/paper/2604.05674/) (2026)
- [An Organization-Scoped LLM Agent Runtime Architecture for Regulated Cybersecurity Operations](https://mlsanity.com/paper/2605.30604/) (2026)
- [Agentic and Generative AI for Open-Source Intelligence and Cyber Investigations: Taxonomy, Evaluation, Challenges, and Future Directions](https://mlsanity.com/paper/2607.03233/) (2026)

## Abstract (arXiv)

Threat modeling is a crucial component of cybersecurity, particularly for industries such as banking, where the security of financial data is paramount. Traditional threat modeling approaches require expert intervention and manual effort, often leading to inefficiencies and human error. The advent of Large Language Models (LLMs) offers a promising avenue for automating these processes, enhancing both efficiency and efficacy. However, this transition is not straightforward due to three main challenges: (1) the lack of publicly available, domain-specific datasets, (2) the need for tailored models to handle complex banking system architectures, and (3) the requirement for real-time, adaptive mitigation strategies that align with compliance standards like NIST 800-53. In this paper, we introduce ThreatModeling-LLM, a novel and adaptable framework that automates threat modeling for banking systems using LLMs. ThreatModeling-LLM operates in three stages: 1) dataset creation, 2) prompt engineering and 3) model fine-tuning. We first generate a benchmark dataset using Microsoft Threat Modeling Tool (TMT). Then, we apply Chain of Thought (CoT) and Optimization by PROmpting (OPRO) on the pre-trained LLMs to optimize the initial prompt. Lastly, we fine-tune the LLM using Low-Rank Adaptation (LoRA) based on the benchmark dataset and the optimized prompt to improve the threat identification and mitigation generation capabilities of pre-trained LLMs.