Yinong Wang  
China Agricultural University, Beijing 100083, China; [EMAIL_ADDRESS] (Y.B. ); [EMAIL_ADDRESS] (M.S. ); [EMAIL_ADDRESS] (L.Z. ); [EMAIL_ADDRESS] (C.W. ); [EMAIL_ADDRESS] (S.L. ); [EMAIL_ADDRESS] (Y.L. ); [EMAIL_ADDRESS] (J.T. ); [EMAIL_ADDRESS] (Y.Y.) Yinong Wang  
China Agricultural University, Beijing 100083, China; [EMAIL_ADDRESS] (Y.B. ); [EMAIL_ADDRESS] (M.S. ); [EMAIL_ADDRESS] (L.Z. ); [EMAIL_ADDRESS] (C.W. ); [EMAIL_ADDRESS] (S.L. ); [EMAIL_ADDRESS] (Y.L. ); [EMAIL_ADDRESS] (J.T. ); [EMAIL_ADDRESS] (Y.Y.) Yin Wang  
China Agricultural Universitythe increasingly complex and diversified cyberattack methods. [PERSON] and colleagues [6] analyzed 25 collaborative filtering recommendation system (CFRS) research samples from 2009 to 2019, finding that many studies merely attempt to detect attacks, while the models are lacking in robustness and fail to integrate implicit features and social information for the detection of malicious users. In recent years, with the advancement of deep learning technology, textual analysis methods based on these technologies have been widely applied to the automatic detection of attack behaviors [7], achieving a certain effectiveness. However, these methods continue to face challenges in understanding the deep meaning and context of texts; especially when dealing with complex language features such as sarcasm, puns, or metaphors, their effectiveness remains limited. For instance, [PERSON] and colleagues [8] used machine learning and user behavior analysis to detect cyberattacks, with their experimental results showing that RNN-LSTM achieved the highest accuracy of 97%; yet, their model's accuracy was affected when detecting internal attacks. In response, [PERSON] and colleagues [9] proposed an enhanced anomaly-based intrusion detection deep learning multi-class classification model to detect Internet of Things (IoT) intrusions. They classified fifteen behaviors, including fourteen types of attacks, achieving 95% accuracy; however, the model's accuracy and complexity came at the cost of increased time. [PERSON] and colleagues [10] proposed a stacked autoencoder approach for intrusion detection systems (IDS) in Mobile Ad Hoc Networks (MANET), with empirical experiments showing that Stacked-IDS (a DNN with a stacked auto-encoder) exhibited higher accuracy than Deep-IDS (a DNN with a deep auto-encoder) in detecting malicious nodes. The authors noted that the complexity of attacks and imbalanced datasets require further research for validation. [PERSON] and colleagues [11] developed a deep learning-based model for replay attack detection in smart cities. The model featured four hidden layers, a global average pooling layer, and an output layer, and achieved satisfactory performance in soil management and environmental monitoring. Modeling for environmental monitoring posed more challenges than soil management due to the complex nature of environmental monitoring datasets, testing the overall performance of the model. Moreover, in the financial sector, [PERSON] and colleagues [12] discussed various fraud methods by investigating the financial cybercrime ecosystem, including how graph-based techniques and neural network models can be used to counter financial cybercrime. Large language models, such as OpenAI's GPT (Generative Pre-training Transformer) series [13], have demonstrated their powerful capabilities in understanding and generating text through pretraining on large-scale textual data. These models can capture the deep semantics and rich contextual information present in text, offering the possibility of deeply understanding human language. [PERSON] and colleagues [14] applied large language models to construct knowledge graphs from unstructured open-source threat intelligence, with their proposed LLM-TIKG method showing good results in named entity recognition and TTP classification, achieving accuracies of 87.88% and 96.53%, respectively.