Cybersecurity Threat Detection using MultiModal LLMs

Abstract

Cybersecurity threat detection is critical for safeguarding modern digital infrastructures against increasingly sophisticated attacks. Traditional detection systems often rely on single data modalities, such as network logs or system alerts, limiting their ability to identify complex, multi-faceted threats. Recent advancements in large language models (LLMs), combined with multi-modal learning approaches, offer promising avenues for enhancing threat detection by integrating heterogeneous data sources including text logs, network traffic metadata, and system behavior patterns. This paper explores the application of multi-modal LLMs for cybersecurity threat detection, leveraging their ability to process and fuse information across diverse data types. By combining textual information (e.g., incident reports, security advisories) with numerical and categorical features from network and system telemetry, multi-modal LLMs can provide enriched contextual understanding and improved anomaly detection. We survey state-of-the-art LLM architectures, including transformer-based models pre-trained on cybersecurity corpora, and highlight their capabilities in natural language understanding, pattern recognition, and zero-shot threat classification. The study investigates methods for aligning multi-modal inputs, such as embedding fusion and crossmodal attention mechanisms, tailored to cybersecurity datasets. Our research methodology involves constructing a multi-modal dataset integrating network flow records, system event logs, and threat intelligence feeds. We implement a transformer-based multi-modal model to classify and detect known and emerging threats. Performance is evaluated using standard cybersecurity benchmarks, measuring detection accuracy, false positive rate, and response latency. Results demonstrate that multi-modal LLMs outperform uni-modal baselines, particularly in detecting sophisticated attacks that exhibit subtle behavioral indicators across multiple data types. Challenges remain in model interpretability, data imbalance, and computational overhead. The paper concludes with discussions on deployment considerations for real-world cybersecurity environments and future research directions, including continual learning for evolving threats and integration with automated response systems.