大模型
arxiv.org ·
推理拓扑很重要：基于LLM的网络安全分析的受控研究
该论文提出 Security Reasoning Topology，将 LLM 推理过程建模为 Linear、Branching、Graph 三种结构，并在 MITRE ATT&CK 网络流量、CTI 威胁情报和 CVE 漏洞分析三个数据集上做受控实验，覆盖 Llama 2（7B/13B/70B）、GPT-5.1 和 Mistral Large 3。结果显示推理拓扑显著影响性能：Graph 推理整体准确率最高，较 few-shot prompting 提升 9.8-12.2 个百分点，Branching 为折中方案，且该效应在不同模型家族和规模上保持一致。
AI推荐理由 arXiv 预印本，作者与摘要信息完整，实验设计明确（三个网络安全数据集、多种 LLM、控制推理结构），报告 Graph 推理较 few-shot 提升 9.8-12.2 个百分点，属于可验证的受控研究；但为预印本、未经同行评审，且未提供代码或复现细节，结论需谨慎看待。对 LLM 推理结构设计与安全分析应用有参考价值。
78
正文
Computer Science > Cryptography and Security
arXiv:2609.24710 (cs)
[Submitted on 21 Sep 2026]
Title:Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis
Authors:Jiling Zhou, Aisvarya Adeseye, Antti Hakkala, Seppo Virtanen, Jouni Isoaho
View a PDF of the paper titled Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis, by Jiling Zhou and 4 other authors
View PDF
HTML (experimental)
Abstract:Large Language Models (LLMs) are increasingly used in cybersecurity, where accurate analysis often requires multi-step and context-dependent reasoning over complex and heterogeneous data. However, existing prompting approaches typically focus on eliciting reasoning without explicitly considering how intermediate reasoning steps are structurally organized. We introduce Security Reasoning Topology, which models reasoning through three representative structures: Linear, Branching, and Graph. To evaluate their effects, we conduct controlled experiments on three cybersecurity datasets covering MITRE ATT&CK network traffic, cyber threat intelligence (CTI), and CVE vulnerability analysis. We evaluate multiple LLMs, including Llama 2 (7B, 13B, 70B), GPT-5.1, and Mistral Large 3, while keeping task inputs consistent and controlling reasoning structure through system-level prompting. Results show that reasoning topology substantially affects performance: Graph reasoning achieves the highest overall accuracy, improving over few-shot prompting by 9.8-12.2 percentage points across datasets, while Branching provides a strong intermediate solution. The results further show that the effect of reasoning topology remains consistent across model families and scales, highlighting reasoning topology as an important design factor for LLM-based cybersecurity analysis.
Comments:
Subjects:
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
Cite as:
arXiv:2609.24710 [cs.CR]
(or
arXiv:2609.24710v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.24710
Focus to learn more
arXiv-issued DOI via DataCite (pending registration)
Submission history
From: Jiling Zhou [view email]
[v1]
Mon, 21 Sep 2026 14:52:30 UTC (693 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis, by Jiling Zhou and 4 other authors
View PDF
HTML (experimental)
TeX Source
view license
Current browse context:
cs.CR
new
|
recent
| 2026-09
Change to browse by:
cs
cs.AI
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)