Search papers, labs, and topics across Lattice.
This paper introduces a two-stage large language model (LLM) framework designed for zero-shot detection of insider threats and advanced persistent threats (APTs) by analyzing heterogeneous security logs. By modeling user activity as chronological timelines and utilizing retrieval-augmented generation (RAG) to enhance contextual understanding, the framework generates structured risk indicators that are classified across temporal sequences to identify attack patterns. Evaluated on benchmark datasets, the framework significantly outperforms existing LLM-based methods, achieving improvements in F1-scores of up to 31.50 percentage points, highlighting the critical role of risk indicator quality in cyber threat detection.
Zero-shot cyber threat detection can be dramatically improved by leveraging structured risk indicators generated from user activity timelines, outperforming previous state-of-the-art methods.
We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs. The framework models user activity as chronological timelines and incorporates retrieval-augmented generation (RAG) to provide personalised behavioural context from each user's historical activity. Rather than performing end-to-end classification directly from raw logs, it first generates structured, interpretable sets of threat-specific risk indicators, which are then classified jointly across temporal sequences to capture attack patterns spanning multiple windows.The framework is evaluated on two benchmark datasets, CERT r5.2 for insider threat detection and PicoDomain for APT detection, using four combinations of two open-weight LLMs under both retrieval and non-retrieval settings. All configurations outperform the previous state-of-the-art LLM-based framework (GABM), with the best configuration improving the F1-score by 11.40 percentage points on CERT r5.2 and 31.50 percentage points on PicoDomain. Results further show that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context. The most effective assignment of LLMs to the two stages depends on the dataset. These findings show that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance.
