Real-Time Multi-Source Threat Intelligence Fusion Using Large Language Models

Threat Intelligence (TI) is essential in contemporary Security Operations Centers (SOCs), but current TI platforms operate independently and often produce disjointed, inconsistent, or conflicting evaluations of Indicators of Compromise (IOCs). The chaotic organization of the information forces analysts to meticulously link insights from multiple sources, resulting in significant delays and an increased risk of misclassification. This paper presents a real-time framework powered by a Large Language Model (LLM) to integrate multi-source threat intelligence. It skillfully integrates various outputs from VirusTotal, AbuseIPDB, AlienVault OTX, GreyNoise, and MalwareBazaar into a unified, context-aware depiction. The proposed system transforms raw TI responses into a standardized format, employs semantic reasoning via an LLM to address conflicting evidence, and produces a clear Threat Confidence Index (TCI) that measures IOC severity on a scale from 0 to 100. The experimental evaluation conducted on a dataset comprising 250 IOCs reveals that the framework attains a remarkable 90.8% alignment with the majority TI consensus. It also exhibits consistent scores, with a variance of less than 1.5 across multiple iterations, while ensuring an end-to-end latency of 2.75 seconds, thereby fulfilling real-time operational demands. Analyst studies indicate a 66% decrease in investigation time when using the fused assessment compared to conventional multi-source lookup methods. The results suggest that incorporating LLM support significantly improves the consistency, interpretability, and efficiency of TI workflows. The findings highlight the potential of LLM reasoning to enhance upcoming SOC automation and prompt threat evaluation significantly.