Reasoning structure improves lln cybersecurity analysis accuracy
Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis
Cryptography and SecurityArtificial Intelligence
Summary
Analyzing cybersecurity problems can be tricky because it often requires many steps and understanding how these steps connect. The authors found that how these reasoning steps are organized—like a straight line, branches, or a complex graph—makes a big difference in accuracy when using big AI models. Organizing reasoning as a graph led to more accurate cybersecurity analysis across different types of data and large language models. This suggests that paying attention to the structure of AI reasoning can improve cybersecurity tools.
What this means in practice
- •For security operations teams: Improve automated threat detection accuracy by structuring AI reasoning as a graph instead of linear prompts.
- •For software developers: Build more accurate vulnerability assessment tools by incorporating reasoning structures that model complex analysis paths.
Authors
Jiling Zhou, Aisvarya Adeseye, Antti Hakkala, Seppo Virtanen, Jouni Isoaho
Abstract
Large Language Models (LLMs) are increasingly used in cybersecurity, where accurate analysis often requires multi-step and context-dependent reasoning over complex and heterogeneous data. However, existing prompting approaches typically focus on eliciting reasoning without explicitly considering how intermediate reasoning steps are structurally organized. We introduce Security Reasoning Topology, which models reasoning through three representative structures: Linear, Branching, and Graph. To evaluate their effects, we conduct controlled experiments on three cybersecurity datasets covering MITRE ATT&CK network traffic, cyber threat intelligence (CTI), and CVE vulnerability analysis. We evaluate multiple LLMs, including Llama 2 (7B, 13B, 70B), GPT-5.1, and Mistral Large 3, while keeping task inputs consistent and controlling reasoning structure through system-level prompting. Results show that reasoning topology substantially affects performance: Graph reasoning achieves the highest overall accuracy, improving over few-shot prompting by 9.8-12.2 percentage points across datasets, while Branching provides a strong intermediate solution. The results further show that the effect of reasoning topology remains consistent across model families and scales, highlighting reasoning topology as an important design factor for LLM-based cybersecurity analysis.