Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis
A study finds graph-structured LLM reasoning lifts cybersecurity analysis accuracy by up to 12.2 points.
A cs.CR paper introduces Security Reasoning Topology, comparing Linear, Branching, and Graph organizations of intermediate LLM reasoning for cybersecurity analysis. Controlled tests cover MITRE ATT&CK network traffic, cyber threat intelligence, and CVE analysis, using Llama 2 at 7B, 13B, and 70B plus GPT-5.1 and Mistral Large 3 with fixed inputs. Graph reasoning was most accurate, improving 9.8 to 12.2 percentage points over few-shot prompting, while Branching was a strong middle option. The authors report the effect holds across model families and scales.
- Security Reasoning Topology compares Linear, Branching, and Graph structures.
- Evaluations used ATT&CK traffic, threat intelligence, and CVE analysis datasets.
- Models tested were Llama 2 7B, 13B, and 70B, GPT-5.1, and Mistral Large 3.
- Graph reasoning beat few-shot prompting by 9.8 to 12.2 percentage points.
- The topology effect stayed consistent across model families and scales.
- Products
- MITRE ATT&CK
- Organizations
- MITRE
- AI models
- Llama 2GPT-5.1Mistral Large 3
From the original article
1 min read at arxiv.orgLarge Language Models (LLMs) are increasingly used in cybersecurity, where accurate analysis often requires multi-step and context-dependent reasoning over complex and heterogeneous data. However, existing prompting approaches typically focus on eliciting reasoning without explicitly considering how intermediate reasoning steps are structurally organized.
By Jiling Zhou · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.