mlsanityData to 14 Oct 2026

Large Language Models for Security Operations Centers: A Comprehensive Survey

arXiv 2509.10858 ↗First posted 13 Sep 2025cs.CR cs.AIcited by 9

Not on the map. Why?

Abstract (arXiv)

Large Language Models (LLMs) have emerged as powerful tools capable of understanding and generating human-like text, offering transformative potential across diverse domains. The Security Operations Center (SOC), responsible for safeguarding digital infrastructure, represents one of these domains. SOCs serve as the frontline of defense in cybersecurity, tasked with continuous monitoring, detection, and response to incidents. However, SOCs face persistent challenges such as high alert volumes, limited resources, high demand for experts with advanced knowledge, delayed response times, and difficulties in leveraging threat intelligence effectively. In this context, LLMs can offer promising solutions by automating log analysis, streamlining triage, improving detection accuracy, and providing the required knowledge in less time. This survey systematically explores the integration of generative AI and more specifically LLMs into SOC workflow, providing a structured perspective on its capabilities, challenges, and future directions. We believe that this survey offers researchers and SOC managers a broad overview of the current state of LLM integration within academic study. To the best of our knowledge, this is the first comprehensive study to examine LLM applications in SOCs in details.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Builds on 171 of its 352 references that are in the map. First posted on arXiv 13 Sep 2025.

Builds on

171 of 352 references.

References · 171

  1. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
  2. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  3. 2023A Survey on Evaluation of Large Language Modelscited by 1,242
  4. 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 906
  5. 2022CodeGen: An Open Large Language Model for Code with Multi-Turn Program Synthesiscited by 885
  6. 2024A Survey on Large Language Models for Code Generationcited by 658
  7. 2024Large Language Models: A Surveycited by 525
  8. 2024Mixture-of-Agents Enhances Large Language Model Capabilitiescited by 438
  9. 2023Large Language Models Are State-of-the-Art Evaluators of Translation Qualitycited by 420
  10. 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 418
  11. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  12. 2023CodeGeeX: A Pre-Trained Model for Code Generation with Multilingual Benchmarking on HumanEval-Xcited by 300
38 more
  1. 2019Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networkscited by 272
  2. 2024RepairAgent: An Autonomous, LLM-Based Agent for Program Repaircited by 232
  3. 2023An Empirical Evaluation of Using Large Language Models for Automated Unit Test Generationcited by 194
  4. 2020Deep Learning based Vulnerability Detection: Are We There Yet?cited by 144
  5. 2023From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacycited by 143
  6. 2024Vulnerability Detection with Code Language Models: How Far Are We?cited by 139
  7. 2023Towards Making the Most of ChatGPT for Machine Translationcited by 138
  8. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
  9. 2021LogBERT: Log Anomaly Detection via BERTcited by 118
  10. 2018Automated Vulnerability Detection in Source Code Using Deep Representation Learningcited by 114
  11. 2023DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detectioncited by 102
  12. 2018SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilitiescited by 92
  13. 2021CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Softwarecited by 91
  14. 2023Automatic Root Cause Analysis via Large Language Models for Cloud Incidentscited by 84
  15. 2024Large Language Model (LLM) for Telecommunications: A Comprehensive Survey on Principles, Key Techniques, and Opportunitiescited by 83
  16. 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 71
  17. 2020Loghub: A Large Collection of System Log Datasets for AI-driven Log Analyticscited by 70
  18. 2024Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAGcited by 68
  19. 2023Large Language Models for Test-Free Fault Localizationcited by 67
  20. 2022ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classificationcited by 66
  21. 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Modelscited by 65
  22. 2018Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulationcited by 63
  23. 2024Exploring LLM-based Agents for Root Cause Analysiscited by 61
  24. 2022SecureBERT: A Domain-Specific Language Model for Cybersecuritycited by 60
  25. 2021Log-based Anomaly Detection Without Log Parsingcited by 59
  26. 2018Tools and Benchmarks for Automated Log Parsingcited by 56
  27. 2024CyberMetric: A Benchmark Dataset based on Retrieval-Augmented Generation for Evaluating LLMs in Cybersecurity Knowledgecited by 55
  28. 2023How Effective Are Neural Networks for Fixing Security Vulnerabilitiescited by 52
  29. 2020A Survey on Automated Log Analysis for Reliability Engineeringcited by 50
  30. 2021D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysiscited by 49
  31. 2023No Need to Lift a Finger Anymore? Assessing the Quality of Code Generation by ChatGPTcited by 47
  32. 2025LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insightscited by 47
  33. 2019A Survey of Network-based Intrusion Detection Data Setscited by 46
  34. 2020NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systemscited by 45
  35. 2023ChatGPT for Vulnerability Detection, Classification, and Repair: How Far Are We?cited by 44
  36. 2024Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Aheadcited by 42
  37. 2023Revolutionizing Cyber Threat Detection with Large Language Models: A privacy-preserving BERT-based Lightweight Model for IoT/IIoT Devicescited by 39
  38. 2023Recommending Root-Cause and Mitigation Steps for Cloud Incidents using Large Language Modelscited by 38

50 most cited of 171 All 171 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 8.

9 papers.

  1. 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelinescited by 2
  2. 2026TxRay: Agentic Postmortem of Live Blockchain Attackscited by 2
  3. 2026CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alertscited by 2
  4. 2026Decomposing Memorization Reduction in Privacy-Preserving Fine-Tuning of SLMs for CSIRTscited by 1
  5. 2026Strengthening Human-Centric Chain-of-Thought Reasoning Integrity in LLMs via a Structured Prompt Frameworkcited by 0
  6. 2026GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attackscited by 0
  7. 2026DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defensecited by 0
  8. 2026MITRE-SAGE: A Multi-Agent Cybersecurity Question-Answering Modelcited by 0
  9. 2026REFINE: A Resilient Evolution Framework for Intelligent Enterprise Alert Triage in Security Operations Centerscited by 0