PulseAugur
EN
LIVE 08:58:40

New benchmark reveals LLMs struggle with extracting threat intelligence from malware

By PulseAugur Editorial · [1 sources] ·

Researchers have introduced SCRIPTIOC-BENCH, a new benchmark designed to evaluate the capability of large language models (LLMs) in extracting actionable threat intelligence from script-based malware. The benchmark includes 634 manually verified samples of JavaScript, PowerShell, and VBScript, categorizing indicators of compromise (IOCs) such as URLs, domains, IP addresses, and filesystem artifacts. Initial evaluations show that even the most advanced LLMs struggle with static IOC recovery, achieving a maximum F1 score of 65.4%. The study also proposes a taxonomy for false positives to better understand model errors and explores mitigations like deterministic string utilities and task-specific adaptation, which show complementary gains in recovery and precision. AI

IMPACT Highlights limitations in current LLM capabilities for automated malware analysis and threat intelligence extraction.

RANK_REASON The cluster describes a new academic benchmark and evaluation of LLMs on a specific task within AI safety and security. [lever_c_demoted from research: ic=1 ai=1.0]

Read on arXiv cs.AI →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

New benchmark reveals LLMs struggle with extracting threat intelligence from malware

How we ranked this

Signal score
15 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The cluster describes a new academic benchmark and evaluation of LLMs on a specific task within AI safety and security. [lever_c_demoted from research: ic=1 ai=1.0]
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
paper, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. arXiv cs.AI TIER_1 English(EN) · Hanna Kim, Jian Cui, Minkyoo Song, Hwanjo Heo, Seungwon Shin, Kimin Lee, Xiaojing Liao ·

    SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs

    arXiv:2609.06149v1 Announce Type: cross Abstract: Script-based malware remains a prevalent attack technique. These scripts often contain indicators of compromise (IOCs) that provide actionable threat intelligence. However, statically recovering such indicators is challenging, as …

RELATED ENTITIES

RELATED TOPICS