mlsanityData to 7 Oct 2026

Large Language Models for Explainable Threat Intelligence

arXiv 2511.05406 ↗First posted 7 Nov 2025cs.CLcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

As cyber threats continue to grow in complexity, traditional security mechanisms struggle to keep up. Large language models (LLMs) offer significant potential in cybersecurity due to their advanced capabilities in text processing and generation. This paper explores the use of LLMs with retrieval-augmented generation (RAG) to obtain threat intelligence by combining real-time information retrieval with domain-specific data. The proposed system, RAGRecon, uses a LLM with RAG to answer questions about cybersecurity threats. Moreover, it makes this form of Artificial Intelligence (AI) explainable by generating and visually presenting to the user a knowledge graph for every reply. This increases the transparency and interpretability of the reasoning of the model, allowing analysts to better understand the connections made by the system based on the context recovered by the RAG system. We evaluated RAGRecon experimentally with two datasets and seven different LLMs and the responses matched the reference responses more than 91% of the time for the best combinations.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 21 of its 26 references that are in the map. First posted on arXiv 7 Nov 2025.

Builds on

21 of 26 references.

References · 21

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  4. 2022Generative Adversarial Networkscited by 5,603
  5. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,383
  6. 2019Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AIcited by 1,543
  7. 2023A Comprehensive Overview of Large Language Modelscited by 639
  8. 2024Large Language Models: A Surveycited by 506
  9. 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 408
  10. 2023Med-HALT: Medical Domain Hallucination Test for Large Language Modelscited by 156
  11. 2024Large Legal Fictions: Profiling Legal Hallucinations in Large Language Modelscited by 144
  12. 2023Self-Evaluation Improves Selective Generation in Large Language Modelscited by 74
9 more
  1. 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 70
  2. 2023Generative Pre-trained Transformer: A Comprehensive Review on Enabling Technologies, Potential Applications, Emerging Challenges, and Future Directionscited by 55
  3. 2024LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledgecited by 22
  4. 2024Explainable Generative AI (GenXAI): A Survey, Conceptualization, and Research Agendacited by 22
  5. 2023Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wildcited by 15
  6. 2024Evaluation of LLM Chatbots for OSINT-based Cyber Threat Awarenesscited by 14
  7. 2019Processing Tweets for Cybersecurity Threat Awarenesscited by 10
  8. 2024A RAG-Based Question-Answering Solution for Cyber-Attack Investigation and Attributioncited by 9
  9. 2024Exploring Advanced Large Language Models with LLMsuitecited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation
  2. 2025LLM-Assisted Proactive Threat Intelligence for Automated Reasoning
  3. 2025Retrieval Augmented Generation-based Large Language Models for Bridging Transportation Cybersecurity Legal Knowledge Gaps
  4. 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence
  5. 2026Beyond RAG for Cyber Threat Intelligence: A Systematic Evaluation of Graph-Based and Agentic Retrieval
  6. 2023Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generation
  7. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  8. 2025CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligence