HIDBench unifies DARPA-E3, DARPA-E5, and NodLink datasets with a data pipeline to benchmark LLMs for host-based intrusion detection, showing high precision on simple logs but sharp drops in MCC and rises in false positives on complex noisy data.
Omnisec: Llm-driven provenance-based intrusion detection via retrieval-augmented behavior prompting
2 Pith papers cite this work. Polarity classification is still indexing.
2
Pith papers citing it
fields
cs.CR 2years
2026 2verdicts
UNVERDICTED 2representative citing papers
Minos uses a two-tiered multi-agent architecture with retrieval-augmented reasoning and FSM-coordinated agents to reconstruct attack scenarios from provenance data, reporting 0.92 recall and 0.64 precision on 14 scenarios.
citing papers explorer
-
HIDBench: Benchmarking Large Language Models for Host-Based Intrusion Detection
HIDBench unifies DARPA-E3, DARPA-E5, and NodLink datasets with a data pipeline to benchmark LLMs for host-based intrusion detection, showing high precision on simple logs but sharp drops in MCC and rises in false positives on complex noisy data.
-
Minos: A Multi-Agent Collaborative Framework for Provenance-Based Backward Tracking
Minos uses a two-tiered multi-agent architecture with retrieval-augmented reasoning and FSM-coordinated agents to reconstruct attack scenarios from provenance data, reporting 0.92 recall and 0.64 precision on 14 scenarios.