LLM-powered system improves cyber threat ranking and mitigation actions
Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation
Cryptography and SecurityArtificial Intelligence
Summary
Cybersecurity experts often find it hard to gather and make sense of bits of information about online threats spread across many sources. The authors created POLAR, a tool that uses large language models (LLMs) to collect and connect real-world evidence about cyber threats. POLAR helps prioritize which threats are most dangerous soon and suggests the best ways to fix or defend against them. It also explains its assessments clearly so analysts can verify the information. Tests showed that POLAR helps identify and respond to new vulnerabilities more effectively than other methods.
What this means in practice
- •For cybersecurity operations teams: Automatically rank and assess emerging cyber threats to better prioritize defense efforts and recommend tailored mitigation steps.
- •For incident response teams: Use synthesized real-world data to link active threats with actionable remediation advice under operational constraints.
Authors
Luoxi Tang, Yuqiao Meng, Ankita Patra, Weicheng Ma, Muchao Ye, Zhaohan Xi
Abstract
Cyber threat analysis increasingly depends on evidence distributed across vendor advisories, vulnerability databases, and threat intelligence sources. Turning these fragmented observations into timely decisions requires models to connect technical severity with evolving exploitation evidence and available defensive actions. We present POLAR, an LLM-powered framework for synthesizing real-world cyber evidence into threat-centric assessments for prioritization and mitigation. POLAR first disentangles overlapping incidents and grounds each threat in source-linked evidence. For prioritization, it infers severity metrics from cyber evidence and combines the resulting assessment with temporally ordered exploitation signals to estimate near-term exploitation likelihood. For mitigation, it links the synthesized threat data to authoritative remediation knowledge and organizes applicable actions according to threat urgency and operational constraints. We evaluate POLAR on real-world vulnerability evidence collected from public resources and compare it with multiple baselines. Across heterogeneous incidents and zero-day settings, POLAR improves threat ranking and mitigation retrieval while producing evidence-linked intermediate assessments that support analyst inspection. The results establish evidence synthesis as a practical foundation for LLM-based cyber decision support across related security tasks.