Enterprise security faces escalating threats from sophisticated malware, compounded by expanding digital operations. This paper presents the first systematic evaluation of large language models (LLMs) to proactively identify indicators of compromise (IOCs) from unstructured web-based threat intelligence sources, distinguishing it from reactive malware detection approaches. We developed an automated system that pulls IOCs from 15 web-based threat report sources to evaluate six LLM models (Gemini, Qwen, and Llama variants). Our evaluation of 479 webpages containing 2,658 IOCs (711 IPv4 addresses, 502 IPv6 addresses, 1,445 domains) reveals significant performance variations. Gemini 1.5 Pro achieved 0.958 precision and 0.788 specificity for malicious IOC identification, while demonstrating perfect recall (1.0) for actual threats.

翻译：企业安全面临着日益复杂的恶意软件威胁，而数字化业务的扩张加剧了这一挑战。本文首次系统性地评估了利用大语言模型从非结构化的网络威胁情报源中主动识别入侵指标的方法，这区别于传统的被动恶意软件检测策略。我们开发了一个自动化系统，从15个网络威胁报告源中提取入侵指标，并评估了六种大语言模型（包括Gemini、Qwen和Llama的变体）。通过对包含2,658个入侵指标（711个IPv4地址、502个IPv6地址、1,445个域名）的479个网页进行评估，我们发现模型性能存在显著差异。其中，Gemini 1.5 Pro在恶意入侵指标识别方面达到了0.958的精确率和0.788的特异性，同时对实际威胁实现了完美的召回率（1.0）。