SHIELD: APT Detection and Intelligent Explanation Using LLM

Asaf Shabtai; Parth Atulbhai Gandhi; Prasanna N. Wudali; Yonatan Amaru; Yuval Elovici

REVIEW 5 major objections 5 minor 33 references

SHIELD: APT Detection and Intelligent Explanation Using LLM

T0 review · 5 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SHIELD, a pipeline of anomaly detection, graph pruning, and LLM reasoning, claims near-perfect APT detection with zero false positives on a key test sequence.

desk verdict SHIELD's architecture is worth a close look, but its headline SOTA claim is contradicted by its own Table 3 and its event-level comparison is apples-to-oranges. read the letter →

arxiv 2502.02342 v1 pith:V3ZIHVAM submitted 2025-02-04 cs.CR

Parth Atulbhai Gandhi , Prasanna N. Wudali , Yonatan Amaru , Yuval Elovici , Asaf Shabtai This is my paper · ORCID

classification cs.CR

keywords advancedpersistentthreatdetectionprovenancegraphlargelanguagemodelanomalylocaloutlierfactorLouvaincommunitychain-of-thoughtkillchainmapping

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces SHIELD, a detection-and-investigation pipeline that claims to find advanced persistent threats (APTs) in system audit logs while generating plain-language, kill-chain-mapped explanations for analysts. Its claimed contribution is that combining unsupervised statistical anomaly detection with provenance graph analysis and a locally run large language model can cut millions of log events down to a few concise, high-confidence alerts, reducing false positives and alert fatigue. On the DARPA CADETS dataset the paper reports perfect precision on all three attacks, including a key sequence with 25 true positives and zero false positives, where baseline systems generated over 4,000 false events. A sympathetic reader would take away that an LLM's implicit knowledge can serve as the interpretability layer that prior provenance-based detectors lack.

What carries the argument

The carrying object is a four-module pipeline with a feedback loop. The deviation analyzer uses LOF with a contamination threshold of 0.1 and 20 neighbors on the standardized features $\langle p_i, e_i, o_i \rangle$, flagging each log entry whose score exceeds the threshold and keeping each anomalous process plus its one-hop ancestors and descendants. The graph analyzer marks external sockets as initial infection points, propagates suspicious tags along data-relay paths until a socket or a non-relaying node stops them, prunes untagged nodes, and applies Louvain community detection to form candidate attack groups. The LLM analyzer runs a three-stage chain-of-thought, first identifying unknown or deviant processes, then analyzing temporal behavior of flagged processes, then checking inter-process chains for a cohesive attack; it scores communities on a 0–1 scale and, at $\delta = 0.8$, generates an alert plus a kill-chain summary. The temporal correlation engine merges attack sets, applies decay and reinforcement to confidence scores over sliding 30-minute windows with 15-minute steps, and prunes low-confidence or merged sets to keep memory bounded.

What would settle it

Run SHIELD on the CADETS and THEIA datasets with an independently verified ground truth, such as multiple analysts labeling the attack events from the DARPA reports without seeing SHIELD's output, and recompute precision and recall; if the CADETS sequences no longer show 25 true positives with zero false positives, the central performance claim fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that APT detection does not require supervised training on labeled attack examples: an unsupervised pipeline can do the heavy lifting and an off-the-shelf LLM can supply the contextual judgment. SHIELD first uses local outlier factor (LOF) on sparse numeric log features to flag anomalous events, then builds a provenance graph, propagates 'suspicious' tags from network socket entry points, prunes untagged nodes, and clusters the survivors with the Louvain community-detection algorithm. The LLM then applies three-stage chain-of-thought reasoning to each community, assigns a confidence score, and, when the score reaches 0.8, emits an alert with a kill-chain narrative. The temporal correlation engine maintains a rolling attack set whose confidence scores decay when behavior turns benign and reinforce when new attack stages appear, which the paper argues handles slow, multi-day attacks. The stated result is state-of-the-art precision and recall on four datasets, with perfect precision on CADETS and high recall across all datasets.

Load-bearing premise

The reported precision and recall numbers rest on a self-built ground truth for CADETS and THEIA: the authors wrote a script to pull logs matching DARPA's indicators of compromise and then hand-labeled each attack event, so a flawed or incomplete labeling would change every performance number, including the perfect precision.

Editorial extensions

If this is right

If SHIELD's results hold, security operations centers can replace thousands of triage alerts per campaign with a handful of summarized, kill-chain-mapped reports, directly reducing alert fatigue.
Because the LLM is off-the-shelf and only prompting changes, the system can adapt to organizational change without retraining, avoiding the concept drift that plagues deep learning detectors.
The paper's decay and reinforcement confidence mechanism, if correct, lets a single attack set persist across days, so a process that goes dormant and later resumes is recognized as the same campaign rather than a new alert.
Event-level comparisons imply that graph pruning plus LLM judgment, rather than raw anomaly scoring alone, is what removes false positives, since baselines with similar anomaly detection still emitted thousands of false events.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The central performance numbers rest on a ground truth constructed by the paper's own IoC-retrieval script and manual labeling of the CADETS and THEIA datasets, so an independent re-labeling of those attack events could change the claimed perfect precision.
The approach's dependence on complete, well-structured audit logs, which the paper notes as a limitation with high-level logs, means deployments with logging gaps or misconfigurations may lose the events that LOF needs, so practical systems would need log-quality checks.
SHIELD's 15-minute detection delay and 32GB GPU requirement for the local LLM imply it is better suited as a forensic investigation aid or SOC back-end than as an endpoint real-time sensor, following from the paper's stated operational constraints.
Because the LLM is used only on small pruned communities, the same graph-pruning step could be plugged into other provenance-based detectors as a false-positive filter independent of LOF, though the paper does not claim this compositionality.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's my take on SHIELD. The architecture is genuinely interesting: LOF anomaly detection, provenance graph pruning, Louvain clustering, and LLM chain-of-thought with a decay/reinforcement temporal correlation engine. I haven't seen that exact combination for APT detection, and the kill-chain summaries are a step toward addressing alert fatigue. The paper deserves a serious referee.

But the headline claim doesn't survive contact with its own tables. Table 3 shows KAIROS with higher precision and recall than SHIELD on CADETS (0.64/0.75 vs 0.29/0.58). The abstract says SHIELD outperforms state-of-the-art, but that's contradicted by their own numbers. The paper waves this off by saying KAIROS missed one attack, but that doesn't change the comparison on the attacks both detect. Table 4 is even more problematic: SHIELD's output is a curated set of high-confidence alerts after LLM filtering, while KAIROS, UNICORN, and DeepLog output raw anomaly scores. Comparing those as 'false events' conflates anomaly detection with attack detection, and it inflates SHIELD's precision. A fair comparison would apply the same LLM filter to the baselines, or set a confidence threshold to match recall. Even on its own event-level results, SHIELD's recall is 0.93 on CADETS Attack 1 and 2 vs KAIROS's 1.00, so the 'higher recall' claim is also off.

The bigger issue is the evaluation basis. For CADETS and THEIA, the ground truth is self-constructed: the authors wrote a script to retrieve logs with IoCs and manually annotated attack events. That's a lot of room for error, and the perfect precision numbers on CADETS rest entirely on that annotation. The paper also doesn't ship code, prompts, or repeated-run statistics for the LLM, and several thresholds (tau, k, confidence bands) are tuned on the same datasets used for evaluation. These are fixable, but they mean the absolute numbers should be read with suspicion.

On the positive side, the paper is honest about its limitations: the 15-minute delay, the 32GB GPU requirement, and the dependence on complete log capture. The temporal correlation engine's decay/reinforcement behavior is described clearly and the THEIA scenario is a decent illustration. This is not a trivial paper and it's not a desk reject. It needs major revision: fix the abstract, provide a controlled comparison, release artifacts, report variance, and be explicit about the ground-truth construction. If the authors do that, the result could be a useful contribution. I'd recommend sending it to peer review with the expectation of heavy revision.

Referee Report

5 major / 5 minor

Summary. The paper introduces SHIELD, an APT detection and investigation framework that combines local outlier factor (LOF) anomaly detection, provenance graph construction and pruning, Louvain community detection, and a chain-of-thought LLM analyzer with a temporal correlation engine for tracking slow-evolving attacks. The authors evaluate SHIELD on the DARPA CADETS and THEIA datasets, the Public Arena dataset, and an in-house Blind Eagle dataset, reporting high precision and recall, interpretable kill-chain summaries, and a claimed ability to outperform state-of-the-art methods. The central claims are that SHIELD achieves perfect precision on CADETS, maintains high recall across all datasets, reduces false positives relative to baselines, and supports zero-day detection through LLM reasoning over kernel-level attack traces.

Significance. If the evaluation were sound, SHIELD would be a practically relevant contribution: it is an unsupervised, training-free pipeline (using an off-the-shelf LLM) that produces human-readable attack narratives mapped to the cyber kill chain, and the temporal correlation engine addresses a real need for detecting multi-day APT campaigns. The use of a 30-minute sliding window and explicit attention to alert fatigue are also sensible design goals. However, the significance is currently impaired by the internal inconsistency between the abstract's superiority claim and the paper's own Table 3, by the non-equivalent baseline comparison in Table 4, and by the self-constructed ground truth for the two DARPA datasets. These issues must be resolved before the reported performance numbers can be taken as evidence of a state-of-the-art result.

major comments (5)

[Abstract and §5, Table 3] The abstract's claim that 'SHIELD was shown to outperform state-of-the-art methods, achieving higher precision and recall' is contradicted by Table 3. On the CADETS dataset, SHIELD achieves precision 0.29, recall 0.58, and F1 0.39, while KAIROS achieves 0.64, 0.75, and 0.69 respectively. The text's explanation that KAIROS missed one attack is a coverage argument, not a precision/recall argument; as stated, the claim of higher precision and recall is false. The authors should either correct the abstract and the comparative discussion, or define and justify a different metric (e.g., attack-level coverage) on which SHIELD is superior.
[§5, Table 4] The event-level comparison in Table 4 is not like-for-like. SHIELD's reported events are the output of a multi-stage pipeline that includes an LLM-based attack classification and a confidence threshold δ=0.8, while UNICORN and DeepLog outputs are raw anomaly scores or flags. The 'over 4000 false events' attributed to baselines are therefore anomalous events, not false attack alerts; comparing these quantities as equivalent false events conflates anomaly detection with attack detection and inflates SHIELD's apparent precision advantage. A fair comparison would apply SHIELD's attack-classification filter to the baselines' anomaly outputs, or would set each method's threshold to match a common recall level before comparing precision.
[§4, Evaluation Setup (Ground Truth)] The evaluation numbers on CADETS and THEIA rest on self-constructed ground truth: the authors state that DARPA provides IoCs but not specific attack events, and that they developed a custom script to retrieve logs containing these IoCs and then manually annotated each attack event. This procedure is load-bearing for the central claims of perfect precision and zero false positives on CADETS. If the IoC-based retrieval or the manual annotation is incomplete, or if benign events are mislabeled as attacks, then every reported precision and recall value is affected. The authors should describe the annotation protocol in detail, report inter-annotator agreement or another validation step, and make the resulting ground-truth event sets available for independent checking.
[§3 and §5 (Hyperparameter selection)] Several key parameters appear to be tuned on the same datasets used for evaluation: the LOF contamination threshold τ=0.1 and number of neighbors k=20 (Eq. 1), the LLM confidence bands 0.7/0.8/0.9, the sliding window interval of 30 minutes with 15-minute step, and the training split fractions. The paper says these values were 'set based on an empirical study' but does not describe a held-out validation procedure. Without such a procedure, the reported metrics may reflect overfitting to the specific evaluation datasets. The authors should either demonstrate that the parameters were selected on a separate validation set or provide a sensitivity analysis showing that the main conclusions are robust to reasonable parameter variations.
[§6 (Zero-day detection claim)] The zero-day detection claim is not sufficiently supported. SHIELD's zero-day capability is attributed to 'the invariant nature of kernel-level attack traces' and the LLM's 'comprehensive understanding of system behavior patterns,' but Qwen 2.5 (32B) is a pretrained model that may have been exposed to public benchmark datasets such as DARPA CADETS and THEIA, or to public descriptions of the corresponding attacks. The paper does not control for this possible memorization. The authors should either provide evidence that the LLM was not trained on these attack descriptions (e.g., a temporal split or a paraphrased/novel attack test) or soften the claim to generalization to 'similar, previously unseen variants' rather than true zero-day detection.

minor comments (5)

[§1 and §5] The introduction and Section 5 state that SHIELD 'maintained high recall (0.93-1.00) across all datasets,' but Table 2 reports Blind Eagle Attack 1 recall as 0.86. The stated range should be corrected to 0.86-1.00 or the text should explicitly exclude the Blind Eagle proof-of-concept.
[§5 (Performance Analysis of Graph Analyzer)] There is a duplicated word in 'while while significantly reducing the number of logs'; this should be corrected.
[Table 1] The table header 'T rain T estDuration' and the split columns are formatted in a way that makes them difficult to read; the table would benefit from clearer column separation and consistent units.
[§4 (Datasets)] The sentence beginning 'For training, we used 28%...' ends with 'ensures both consistency across datasets...' which is a subject-verb disagreement; the sentence should be rephrased.
[General] The manuscript would benefit from a link to the implementation, the customized IoC-retrieval script, and the generated ground-truth annotations; none of these artifacts are currently provided, which limits reproducibility of the evaluation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SHIELD's detection pipeline is empirically benchmarked rather than derived from its own outputs; the main concerns are evaluation fairness and tuning transparency, not circular reasoning.

full rationale

SHIELD's derivation chain is LOF anomaly scoring, one-hop provenance lineage, tag propagation with pruning, Louvain clustering, and LLM chain-of-thought analysis. None of these components is defined in terms of the attack labels or the final precision/recall numbers, and the LLM is an off-the-shelf model rather than a model trained on the evaluation ground truth. The claimed '25 true positives, zero false positives' result on CADETS is a measurement against manually annotated, IoC-derived ground truth; it is not a quantity that the pipeline produces by construction. The only tuned parameters mentioned (tau=0.1, k=20, confidence threshold 0.8) are hyperparameters, and even if they were tuned on the same datasets, they do not by themselves force the reported attack-event predictions, so the concern is possible overfitting or selection bias rather than circularity. The paper contains no load-bearing self-citations: the confidence-scoring design cites Freitas et al. and Zhuang et al., external works, and the Louvain choice cites Blondel et al. and Hercule, also external. The abstract's claim that SHIELD outperforms state-of-the-art methods is inconsistent with the paper's own Table 3, where KAIROS achieves higher precision and recall on CADETS, and Table 4 compares SHIELD's filtered high-confidence attack alerts with baselines' raw anomaly flags; however, these are evaluation-validity and reporting problems, not circular reductions of the claimed result to its inputs.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The system contributes no new physical entities. Its cost is in assumptions: attack entry via sockets, one-hop lineage sufficiency, LLM reliability without calibration, and self-constructed ground truth. The numeric thresholds (LOF k=20, tau=0.1, confidence bands 0.7/0.8/0.9) are chosen by hand on the same evaluation datasets, which is a mild circularity burden for the reported performance numbers.

free parameters (5)

LOF contamination threshold = 0.1
Set in Eq. 1 based on an empirical study the authors performed; controls how many events are flagged anomalous and therefore affects all downstream results.
LOF number of neighbors k = 20
Set in Eq. 1 based on an empirical study; affects density estimation and anomaly assignment.
Alert confidence threshold delta = 0.8
Used in Eq. 5 to decide whether to raise an alert; 0.7 and 0.9 define the partial and complete attack bands used by the LLM analyzer.
Sliding window interval and step = 30-minute interval, 15-minute step
Defined in Section 5 and used for all time-window evaluations; changes detection latency and event grouping.
Training split fraction = 28-35% per dataset
Chosen to avoid leakage and provide historical context; affects the LOF baseline and all evaluation comparisons.

assumptions (5)

domain assumption Attacks originate from external socket objects, defined as initial infection points.
Graph analyzer marks all external sockets as starting points for tag propagation in Section 3(a); attacks that begin without a socket, such as local privilege escalation through an already compromised local process, may be pruned before LLM analysis.
domain assumption One-hop lineage around an anomalous process is sufficient to preserve attack context.
Deviation analyzer extracts only direct ancestors and descendants through fork events, citing a provenance property from [16]; if attack data flow spans more than one hop, context can be lost.
domain assumption The LLM's pretrained implicit knowledge of system behavior is reliable for flagging suspicious processes and scoring attack chains.
The LLM analyzer uses three-stage chain-of-thought with no fine-tuning and no calibration in Section 3; if the LLM hallucinates or is unfamiliar with an environment's normal behavior, the confidence scores are unvalidated.
domain assumption The IoC-derived manual annotations are complete and correct event-level ground truth.
Section 4 Datasets describes retrieving logs containing IoCs and manually annotating attack events; all precision and recall numbers are computed against these annotations.
domain assumption Attack-related activities form dense, interconnected communities in provenance graphs.
Used to justify Louvain community detection in Section 3(d), citing prior observation [2]; if malicious activities are not densely clustered, the graph analyzer may split or miss them.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SHIELD: APT Detection and Intelligent Explanation Using LLM." pith.science (2026). https://pith.science/paper/V3ZIHVAM

@misc{pith2026250202342,
  author       = {Pith},
  title        = {Pith review of: SHIELD: APT Detection and Intelligent Explanation Using LLM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V3ZIHVAM}},
  note         = {Machine review of arXiv:2502.02342}
}

read the original abstract

Advanced persistent threats (APTs) are sophisticated cyber attacks that can remain undetected for extended periods, making their mitigation particularly challenging. Given their persistence, significant effort is required to detect them and respond effectively. Existing provenance-based attack detection methods often lack interpretability and suffer from high false positive rates, while investigation approaches are either supervised or limited to known attacks. To address these challenges, we introduce SHIELD, a novel approach that combines statistical anomaly detection and graph-based analysis with the contextual analysis capabilities of large language models (LLMs). SHIELD leverages the implicit knowledge of LLMs to uncover hidden attack patterns in provenance data, while reducing false positives and providing clear, interpretable attack descriptions. This reduces analysts' alert fatigue and makes it easier for them to understand the threat landscape. Our extensive evaluation demonstrates SHIELD's effectiveness and computational efficiency in real-world scenarios. SHIELD was shown to outperform state-of-the-art methods, achieving higher precision and recall. SHIELD's integration of anomaly detection, LLM-driven contextual analysis, and advanced graph-based correlation establishes a new benchmark for APT detection.

Figures

Figures reproduced from arXiv: 2502.02342 by the authors.

**Figure 1.** Overview of the SHIELD pipeline, with an example demonstrating the interaction between the four modules. Deviation Analyzer. The deviation analyzer serves as the foundation of SHIELD’s detection capabilities by identifying behavioral deviations in system logs (see example in [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗

**Figure 2.** Deviation analyzer: Detection of event-level anomalies, followed by the addition of the processes and their first-level ancestors and descendants for further analysis. which are standardized using StandardScaler to ensure uniform feature scaling. A(li) = ( 1 if LOFk(li) > τ, 0 otherwise (1) where τ is the contamination threshold set at 0.1 and k is the number of neighbors set at 20 used for density estimation by th… view at source ↗

**Figure 3.** Graph analyzer: Detection of infection points, followed by tag-propagation and iterative pruning of benign entities, resulting in a reduced graph structure optimized for further analysis. LLM Analyzer. The LLM analyzer module constitutes the third module of the SHIELD pipeline. Building on the communities identified by the graph analyzer, the LLM analyzer processes the system events corresponding to the community no… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: LLM analyzer: An illustration of the CoT reasoning. quence of actions associated with each flagged process, identifying suspicious patterns that could indicate compromise (e.g., a web server process making unexpected file system modifications or establishing unusual n…

**Figure 5.** Figure 5: LLM analyzer and temporal correlation engine: Analyzes system logs, tags malicious nodes, performs graph traversal, adds the tagged nodes to the attack set, and maintains historical context of attack evolution while considering memory constraints. Temporal Correlation …

**Figure 6.** Figure 6: An illustration of attack summary generated for the attack in THEIA dataset [PITH_FULL_IMAGE:figures/full_fig_p021_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 23 canonical work pages

[1]

In: 30th USENIX security symposium (USENIX security 21)

Alsaheel, A., Nan, Y., Ma, S., Yu, L., Walkup, G., Celik, Z.B., Zhang, X., Xu, D.: {ATLAS}: A sequence-based learning approach for attack investigation. In: 30th USENIX security symposium (USENIX security 21). pp. 3005–3022 (2021)

work page 2021
[2]

Journal of statistical mechanics: theory and experiment 2008(10), P10008 (2008)

Blondel, V.D., Guillaume, J.L., Lambiotte, R., Lefebvre, E.: Fast unfolding of com- munities in large networks. Journal of statistical mechanics: theory and experiment 2008(10), P10008 (2008)

2008
[3]

Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., Han, X.: Kairos: Prac- tical intrusion detection and investigation using whole-system provenance (2023), https://arxiv.org/abs/2308.05034

arXiv 2023
[4]

In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

Dong, F., Li, S., Jiang, P., Li, D., Wang, H., Huang, L., Xiao, X., Chen, J., Luo, X., Guo, Y., et al.: Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp. 2396–2410 (2023)

work page 2023
[5]

In: 32nd USENIX Security Symposium (USENIX Security 23)

Dong, F., Wang, L., Nie, X., Shao, F., Wang, H., Li, D., Luo, X., Xiao, X.: {DISTDET}: A {Cost-Effective} distributed cyber threat detection system. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 6575–6592 (2023)

work page 2023
[6]

In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security

Du, M., Li, F., Zheng, G., Srikumar, V.: Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. pp. 1285–1298 (2017)

work page 2017
[7]

Freitas, S., Kalajdjieski, J., Gharib, A., McCann, R.: Ai-driven guided response for security operation centers with microsoft copilot for security (2024), https: //arxiv.org/abs/2407.09017

arXiv 2024
[8]

In: 2021 international joint conference on neural networks (IJCNN)

Guo, H., Yuan, S., Wu, X.: Logbert: Log anomaly detection via bert. In: 2021 international joint conference on neural networks (IJCNN). pp. 1–8. IEEE (2021)

work page 2021

Show all 33 references

[9]

Hagberg, A., Swart, P., S Chult, D.: Exploring network structure, dynamics, and function using networkx. Tech. rep., Los Alamos National Lab.(LANL), Los Alamos, NM (United States) (2008)

2008
[10]

Han, X., Yuan, S., Trabelsi, M.: Loggpt: Log anomaly detection via gpt (2023), https://arxiv.org/abs/2309.14482

2023 arXiv
[11]

arXiv preprint arXiv:2001.01525 (2020)

Han, X., Pasquier, T., Bates, A., Mickens, J., Seltzer, M.: Unicorn: Run- time provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525 (2020)

2020 arXiv
[12]

In: 2020 IEEE Symposium on Security and Privacy (SP)

Hassan, W.U., Bates, A., Marino, D.: Tactical provenance analysis for endpoint detection and response systems. In: 2020 IEEE Symposium on Security and Privacy (SP). pp. 1172–1189. IEEE (2020)

2020
[13]

In: network and distributed systems security symposium (2019)

Hassan, W.U., Guo, S., Li, D., Chen, Z., Jee, K., Li, Z., Bates, A.: Nodoze: Com- batting threat alert fatigue with automated provenance triage. In: network and distributed systems security symposium (2019)

2019
[14]

In: 26th USENIX Security Symposium (USENIX Security 17)

Hossain, M.N., Milajerdi, S.M., Wang, J., Eshete, B., Gjomemo, R., Sekar, R., Stoller, S., Venkatakrishnan, V.:{SLEUTH}: Real-time attack scenario reconstruc- tion from {COTS} audit data. In: 26th USENIX Security Symposium (USENIX Security 17). pp. 487–504 (2017)

2017
[15]

In: 2020 IEEE Symposium on Security and Privacy (SP)

Hossain, M.N., Sheikhi, S., Sekar, R.: Combating dependence explosion in forensic analysis using alternative tag propagation semantics. In: 2020 IEEE Symposium on Security and Privacy (SP). pp. 1139–1155. IEEE (2020)

2020
[16]

In: 2023 IEEE Symposium on Security and Privacy (SP)

Inam, M.A., Chen, Y., Goyal, A., Liu, J., Mink, J., Michael, N., Gaur, S., Bates, A., Hassan, W.U.: Sok: History is a vast early warning system: Auditing the provenance of system intrusions. In: 2023 IEEE Symposium on Security and Privacy (SP). pp. 2620–2638. IEEE (2023) SHIEL...

2023
[17]

arXiv preprint arXiv:2310.09831 (2023)

Jia, Z., Xiong, Y., Nan, Y., Zhang, Y., Zhao, J., Wen, M.: Magic: Detecting ad- vanced persistent threats via masked graph representation learning. arXiv preprint arXiv:2310.09831 (2023)

2023 arXiv
[18]

In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P)

van der Kouwe, E., Heiser, G., Andriesse, D., Bos, H., Giuffrida, C.: Sok: Bench- marking flaws in systems security. In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P). pp. 310–325. IEEE (2019)

2019
[19]

Computers & Security 121, 102828 (2022)

Kurniawan, K., Ekelhart, A., Kiesling, E., Quirchmayr, G., Tjoa, A.M.: Krys- tal: Knowledge graph-based framework for tactical attack discovery in audit data. Computers & Security 121, 102828 (2022)

2022
[20]

Computer Fraud & Security 2021(6), 17–19 (2021)

Lazarovitz, L.: Deconstructing the solarwinds breach. Computer Fraud & Security 2021(6), 17–19 (2021)

2021
[21]

CoRR abs/2111.09564 (2021), https://arxiv

Lee, Y., Kim, J., Kang, P.: Lanobert : System log anomaly detection based on BERT masked language model. CoRR abs/2111.09564 (2021), https://arxiv. org/abs/2111.09564

2021 arXiv
[22]

In: Proceedings 2024 Network and Distributed System Security Symposium

Li, S., Dong, F., Xiao, X., Wang, H., Shao, F., Chen, J., Guo, Y., Chen, X., Li, D.: Nodlink: An online system for fine-grained apt attack detection and investigation. In: Proceedings 2024 Network and Distributed System Security Symposium. NDSS 2024, Internet Society (2024)

2024
[23]

Liu, Y., Tao, S., Meng, W., Wang, J., Ma, W., Zhao, Y., Chen, Y., Yang, H., Jiang, Y., Chen, X.: Interpretable online log analysis using large language models with prompt strategies (2024), https://arxiv.org/abs/2308.07610

2024 arXiv
[24]

In: 2019 IEEE Symposium on Security and Privacy (SP)

Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.: Holmes: real-time apt detection through correlation of suspicious information flows. In: 2019 IEEE Symposium on Security and Privacy (SP). pp. 1137–1152. IEEE (2019)

2019
[25]

In: Proceedings of the 32nd Annual Conference on Computer Security Applications

Pei, K., Gu, Z., Saltaformaggio, B., Ma, S., Wang, F., Zhang, Z., Si, L., Zhang, X., Xu, D.: Hercule: attack story reconstruction via community discovery on correlated log graph. In: Proceedings of the 32nd Annual Conference on Computer Security Applications. p. 583–595. ACSAC...

2016
[26]

In: NDSS (2020)

Wang, Q., Hassan, W.U., Li, D., Jee, K., Yu, X., Zou, K., Rhee, J., Chen, Z., Cheng, W., Gunter, C.A., et al.: You are what you do: Hunting stealthy malware via data provenance analysis. In: NDSS (2020)

2020
[27]

IEEE Transactions on Information Forensics and Se- curity 17, 3972–3987 (2022)

Wang, S., Wang, Z., Zhou, T., Sun, H., Yin, X., Han, D., Zhang, H., Shi, X., Yang, J.: Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning. IEEE Transactions on Information Forensics and Se- curity 17, 3972–3987 (2022)

2022
[28]

In: 32nd USENIX Security Symposium (USENIX Security 23)

Yang, F., Xu, J., Xiong, C., Li, Z., Zhang, K.: {PROGRAPHER}: An anomaly de- tection system based on provenance graph embedding. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 4355–4372 (2023)

2023
[29]

In: 2019 IEEE 19th International Conference on Communication Technology (ICCT)

Yu, H., Li, A., Jiang, R.: Needle in a haystack: attack detection from large-scale system audit. In: 2019 IEEE 19th International Conference on Communication Technology (ICCT). pp. 1418–1426. IEEE (2019)

2019
[30]

In: 2022 IEEE Symposium on Security and Privacy (SP)

Zengy, J., Wang, X., Liu, J., Chen, Y., Liang, Z., Chua, T.S., Chua, Z.L.: Shade- watcher: Recommendation-guided cyber threat analysis using system audit records. In: 2022 IEEE Symposium on Security and Privacy (SP). pp. 489–506. IEEE (2022)

2022
[31]

In: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engi- neering Conference and Symposium on the Foundations of Software Engineering

Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al.: Robust log-based anomaly detection on unstable log data. In: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engi- neering Conference and Symposium on t...

2019
[32]

Zhuang, H., Qin, Z., Hui, K., Wu, J., Yan, L., Wang, X., Bendersky, M.: Beyond yes and no: Improving zero-shot llm rankers via scoring fine-grained relevance labels (2024), https://arxiv.org/abs/2310.14122

2024 arXiv
[33]

Zipperle, M., Gottwalt, F., Chang, E., Dillon, T.: Provenance-based intrusion de- tection systems: A survey. ACM Computing Surveys 55(7), 1–36 (2022) A Chain-of-Thought Detection Algorithm Algorithm 1 Chain-of-Thought detection Input: Communities C, LLM model M Output: Attack ...

2022

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.

[1] [1]

In: 30th USENIX security symposium (USENIX security 21)

Alsaheel, A., Nan, Y., Ma, S., Yu, L., Walkup, G., Celik, Z.B., Zhang, X., Xu, D.: {ATLAS}: A sequence-based learning approach for attack investigation. In: 30th USENIX security symposium (USENIX security 21). pp. 3005–3022 (2021)

work page 2021

[2] [2]

Journal of statistical mechanics: theory and experiment 2008(10), P10008 (2008)

Blondel, V.D., Guillaume, J.L., Lambiotte, R., Lefebvre, E.: Fast unfolding of com- munities in large networks. Journal of statistical mechanics: theory and experiment 2008(10), P10008 (2008)

2008

[3] [3]

Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., Han, X.: Kairos: Prac- tical intrusion detection and investigation using whole-system provenance (2023), https://arxiv.org/abs/2308.05034

arXiv 2023

[4] [4]

In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

Dong, F., Li, S., Jiang, P., Li, D., Wang, H., Huang, L., Xiao, X., Chen, J., Luo, X., Guo, Y., et al.: Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp. 2396–2410 (2023)

work page 2023

[5] [5]

In: 32nd USENIX Security Symposium (USENIX Security 23)

Dong, F., Wang, L., Nie, X., Shao, F., Wang, H., Li, D., Luo, X., Xiao, X.: {DISTDET}: A {Cost-Effective} distributed cyber threat detection system. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 6575–6592 (2023)

work page 2023

[6] [6]

In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security

Du, M., Li, F., Zheng, G., Srikumar, V.: Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. pp. 1285–1298 (2017)

work page 2017

[7] [7]

Freitas, S., Kalajdjieski, J., Gharib, A., McCann, R.: Ai-driven guided response for security operation centers with microsoft copilot for security (2024), https: //arxiv.org/abs/2407.09017

arXiv 2024

[8] [8]

In: 2021 international joint conference on neural networks (IJCNN)

Guo, H., Yuan, S., Wu, X.: Logbert: Log anomaly detection via bert. In: 2021 international joint conference on neural networks (IJCNN). pp. 1–8. IEEE (2021)

work page 2021