Large Language Models for Real-Time Threat Detection in Cybersecurity Intelligent Systems

Security Operations Centers are drowning in alerts. Analysts simply cannot keep up, and the old signature-based tools miss too many new attacks. This paper examines whether large language models (LLMs) can actually help. It reviews recent work from AI, network security and SOC operations to see how LLMs are being used for real-time threat detection. The four main areas covered are intrusion detection, log anomaly detection, threat intelligence summarisation and automated SIEM query generation. The evidence shows that LLMs can improve detection and cut response times, especially when they are paired with retrieval-augmented generation or used in ensemble setups. But the gains come from different studies using different datasets, so direct comparison is tricky. Hallucination, adversarial attacks, privacy risks and compute costs are still big problems. The paper closes with a four-part framework for deploying LLMs responsibly and suggests where future research should go.