CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis

Jianyi Liu; Jingwen Li; Ru Zhang; Wanguo Zhao

REVIEW 5 major objections 6 minor 54 references

CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read CLIProv claims that APT threat hunting can be reduced to semantic search: contrastively aligning provenance logs with natural-language threat intelligence so that each attack segment is labeled by its nearest TTP description.

desk verdict A genuinely new idea for linking threat intel text to provenance logs, but the evaluation doesn't yet prove the alignment is semantic rather than entity-name memorization; an anonymization test is essential. read the letter →

arxiv 2507.09133 v1 pith:Y2FVTVVV submitted 2025-07-12 cs.CR

Jingwen Li , Ru Zhang , Jianyi Liu , Wanguo Zhao This is my paper · ORCID

classification cs.CR

keywords threatintelligenceprovenancelogscontrastivelearninghuntingsemanticsearchTTPidentificationattackscenarioreconstructionmultimodal

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CLIProv tries to establish that threat hunting in system provenance logs can be reduced to a semantic search: instead of hand-converting threat intelligence into query graphs, an analyst can match raw log segments against natural-language descriptions of attack techniques. The system trains a log encoder and a text encoder together with contrastive learning so that a log sequence and the threat-intelligence sentence describing the same attack pattern land close together in one vector space. Detection then becomes nearest-neighbor retrieval from a MITRE ATT&CK database, with each retrieved description supplying a TTP (Tactics, Techniques, and Procedures) label and a temporal-causal stitching step reconstructing the full attack scenario. If this works as reported, it removes the most labor-intensive part of provenance-based threat hunting and makes coverage of new attacks a matter of adding or updating intelligence text. The evaluation across four datasets reports high precision and query times of seconds per scenario.

What carries the argument

The load-bearing mechanism is a dual-encoder contrastive alignment: a RoBERTa text encoder and a RoBERTa log encoder, with a two-layer residual projection network, trained by a bidirectional InfoNCE loss (equations (5)-(7)) to map matching log sequences and intelligence sentences to nearby points in a shared space. Detection is then a nearest-neighbor lookup against threat-intelligence descriptions from MITRE ATT&CK (equation (8)), where the retrieved description's TTP label is the detection result. Supporting machinery includes graph reduction (merging redundant network connections, cascade directory events, and similar file objects via Levenshtein distance), DFS-based subgraph partitioning with a time-density threshold $\theta_{\max} = 20$ minutes, and a temporal causal reasoning step that uses virtual nodes and a time-dependent Dijkstra algorithm to stitch isolated attack subgraphs into a single attack graph.

What would settle it

Take a trained CLIProv model and anonymize every process name, file path, and IP address in the CADETS and THEIA test scenarios, replacing them with random tokens, then re-run node-level detection. If precision drops far below the reported 76.67% and 82.14%, the model was matching surface identifiers rather than behavior semantics.

Watch

Extended reading notes

Core claim

CLIProv's central claim is that the semantic gap between high-level threat intelligence and low-level provenance logs can be bridged by multimodal contrastive learning, making attack detection a retrieval problem. Log sequences are formed from system behavior subgraphs, each a series of process-file-socket operation triples, and encoded by RoBERTa as if they were sentences. A bidirectional InfoNCE loss pulls matched log-text pairs together and pushes unmatched pairs apart, while a two-layer residual projection maps both modalities into a shared space. At query time the same encoders embed every log subgraph and the ATT&CK text database, and each subgraph receives the TTP label whose description is closest in embedding space. The paper reports that this identifies attacks across scenarios, vulnerabilities, and datasets; labels them with technique IDs such as T1071 and T1189; and reconstructs complete attack scenarios through temporal causal reasoning over virtual nodes.

Load-bearing premise

The whole method rests on the assumption that a log segment and a threat-intelligence sentence land close together in the learned space because they describe the same behavior, not because the log happens to contain the same process names, file paths, or IP addresses that appeared in the training text.

Editorial extensions

If this is right

If the reported results hold, security analysts can hunt for threats by writing or importing natural-language descriptions of attack techniques, with no query graphs to maintain.
Every detected behavior receives an ATT&CK TTP label, so the output is interpretable at the level of tactics and techniques rather than raw system events.
Adding coverage of a new attack requires adding or updating threat-intelligence text, rather than hand-authoring new graph patterns.
Because detection is a nearest-neighbor search over precomputed embeddings, the paper reports per-subgraph query time of 8.27 ms, which would make interactive investigation of large provenance graphs practical.
The method remains knowledge-based: techniques far outside the training intelligence, such as Wi-Fi Discovery in the CICAPT-IIoT test, are missed or confused with normal behavior, a limitation the paper acknowledges.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A test the paper does not run is entity anonymization: replace process names, file paths, and IP addresses in the test logs with random tokens and re-measure precision. If precision collapses, the model is partly memorizing identifiers from training scenarios rather than learning behavior semantics.
The same contrastive alignment could be applied to other audit sources, such as Windows ETW and Linux Audit, and to alert triage, where natural-language descriptions of past incidents would serve as the query database.
If the alignment is genuinely semantic, threat-intelligence reports could be fed into the query database as soon as they are written, turning publication into detection capability without engineering effort.
The paper notes but does not evaluate the risk of fake or poisoned threat intelligence; adversarial training with fake samples as negatives is suggested as future work, not tested.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take on CLIProv (arXiv:2507.09133). The central idea is worth your attention: it replaces query-graph construction with a contrastive dual-encoder that aligns raw provenance log sequences to natural-language threat intelligence, then hunts by semantic search against MITRE ATT&CK. As far as I can tell from the cited literature, that combination is new—Poirot, DeepHunter, and ProvG-Searcher all still rely on query templates or graph structures. The individual components (RoBERTa, InfoNCE) are standard, but the system-level framing is a real contribution.

It also does some things well. The subgraph partitioning and virtual-node-based scenario reconstruction are pragmatic. The ablation study is honest—it shows that single-modal training and contrastive-plus-classifier both do worse, which supports the semantic-search design. The efficiency numbers compared to Poirot's 19+ hours are plausible, and the authors clearly state limitations around knowledge scope and fake threat intel.

But there is a load-bearing soft spot. In Section 5.2.4, positive training pairs are created by taking the ground-truth attack's intelligence text and the log sequence from that same attack. Those pairs share exact entity names: process names like 'nginx', file paths like '/tmp/vUgefal', IP addresses like '78.205.235.65'. Since a log sequence is just a concatenation of (src, edge, dst) triples, RoBERTa can minimize the InfoNCE loss by aligning those surface tokens without learning any behavioral semantics. The paper never runs an entity-anonymization test. The cross-dataset result on CICAPT-IIoT—node-level precision dropping to 52%—is exactly the signature you'd predict for entity-memorization. Section 7.1 blames knowledge gaps, but it never considers this confound. That is the main thing I want a revision to address.

A second, smaller issue: Section 6.4.1 varies n_aug and reports TPR on CICAPT-IIoT, which looks like test-set-based parameter selection. There are also no error bars, no code or data release, and the perfect 100% graph-level precision on small held-out sets should be read cautiously. The comparison with Threatrace is roughly fair (they do adjust for the 2-hop label protocol), so I don't want to overstate that.

Overall: if anonymized retraining preserves precision, the paper's claim stands and this is a solid systems contribution. If it collapses, the method needs a different representation to actually encode behavior. Either way, it deserves a serious referee. My recommendation: accept for review, but require an entity-anonymization experiment, variance estimates, and artifact release before final acceptance.

I'd bring it to a reading group as a case study of shortcut learning in multimodal security ML, but I wouldn't cite its core claim until the confound is resolved.

Referee Report

5 major / 6 minor

Summary. CLIProv proposes a multimodal contrastive-learning framework that aligns provenance log sequences with natural-language threat intelligence in a shared embedding space, then treats threat detection as a nearest-neighbor semantic search over MITRE ATT&CK technique descriptions, outputting TTP labels and reconstructed attack scenarios. The paper details preprocessing (graph reduction, subgraph partitioning, sequence construction), a dual RoBERTa encoder with a projection layer and bidirectional InfoNCE loss, and evaluates on CADETS, THEIA, ATLAS, and CICAPT-IIoT, comparing against query-graph-based (Poirot, ProvG-Searcher) and anomaly-based (Threatrace, KAIROS) methods. The central claims are that CLIProv achieves higher precision and significantly improved detection efficiency, and that it generalizes across attack scenarios, vulnerabilities, and datasets.

Significance. If the semantic-alignment claim holds, CLIProv is a valuable step toward replacing hand-crafted query graphs with flexible natural-language semantic search over threat intelligence, while also producing interpretable TTP-labeled attack scenarios. The paper includes a full prototype, experiments on four public datasets, a cross-dataset zero-shot evaluation on CICAPT-IIoT, and low per-subgraph query latency (8.27 ms), which are strengths. However, the central claim that the alignment is semantic rather than surface-form based is currently not supported: the training pairs are manually constructed from ground-truth text and the corresponding log sequences, which share exact entity identifiers, and no experiment controls for entity-name memorization. The within-dataset results may therefore overstate generalization, and the lower CICAPT-IIoT precision (52.38% node-level in Table 3) is consistent with the confound. A second protocol issue is the apparent selection of the augmentation hyperparameter n_aug using the CICAPT-IIoT test set. These issues are load-bearing for the paper's main claims and require additional experiments and protocol corrections.

major comments (5)

[§5.2.4, §5.3.3] The positive pairs are created by manually splitting ground-truth threat intelligence to match specific attack log sequences (Section 5.2.4), and the log sequences are serializations of typed triples that contain the exact process names, file paths, and IP addresses also present in the paired text (e.g., 'nginx', '/tmp/vUgefal', '78.205.235.65'). Because the InfoNCE loss (Eqs. 5–7) only requires the two embeddings to be close, the dual encoders can minimize the loss by aligning these shared surface tokens without learning behavior-level semantics. This confound is not addressed anywhere in the paper, and the drop in node-level precision from 76.67% (CADETS) to 52.38% (CICAPT-IIoT) in Table 3 is the expected signature of entity-overlap dependence. Please run an experiment in which all entity identifiers (process names, file paths, IP addresses) are anonymized or replaced with generic placeholders before both training and testing; if detection precision and alignment scores remain comparable, the semantic-alignment claim is supported, and if they collapse, the claim must be substantially revised.
[§6.1.1, §6.4.1] The CICAPT-IIoT dataset is described as used solely to test generalization, with no ground truth for attack processes (Section 6.1.1), yet Figure 5 reports TPR and FPR on CICAPT-IIoT under different values of n_aug, and the text states that the TPR of the CICAPT-IIoT dataset rises with more augmented samples. This indicates that n_aug was selected using the held-out test set, which leaks test information into hyperparameter selection and invalidates the cross-dataset generalization claim. The authors should select n_aug (and all other hyperparameters) using a validation split from the training datasets only, and then report the CICAPT-IIoT result for the chosen value.
[Table 3, §6.2] No error bars or variance are reported for any detection metric, even though Section 6.4.2 describes random sampling of benign sequences with averaging over five experiments. Without a measure of variance it is impossible to assess whether the differences observed between datasets or between CLIProv and the baselines are statistically meaningful. Additionally, since CICAPT-IIoT is stated to lack ground truth for attack processes, the computation of node-level and graph-level precision/recall on this dataset needs to be clarified: what is used as ground truth for the 58 attack graphs and 6,222 benign graphs, and how were the corresponding intelligence labels (e.g., T1546, T1055 in Table 4) assigned?
[§6.3.2, Table 6] The comparison with Threatrace is reported under both the original DARPA ground truth and a '2-hop' labeling protocol, and the paper emphasizes that Threatrace produces many false positives under the original labels. Reporting both protocols is fair, but the narrative that CLIProv is superior to anomaly detection is weakened by the fact that Threatrace's design explicitly treats 2-hop neighbors as part of the attack; the original-label protocol is not the one Threatrace was designed for. Furthermore, Threatrace is trained on 11 days of CADETS data while CLIProv uses 3 days, and no error bars are given for any method. The comparison should be presented as indicative rather than conclusive, or the methods should be evaluated under comparable conditions (e.g., same training data split and same labeling protocol with variance estimates).
[§5.3.1] Treating log sequences as sentences and encoding them with RoBERTa raises an untested load-bearing premise: that the similarity between log-sequence embeddings and text embeddings reflects shared behavior semantics rather than overlap of entity names and paths. The manual construction of positive pairs in Section 5.2.4 provides supervision for the specific entity combinations in the training scenarios, so the model is a supervised aligner rather than an unsupervised semantic discovery mechanism. The paper should explicitly acknowledge this and provide the anonymization experiment from the first major comment to justify the 'semantic' terminology, as well as a brief discussion of how RoBERTa's subword tokenization handles domain-specific tokens such as IP addresses and file paths.

minor comments (6)

[§6.6] The section heading 'Runtime Performanc' is missing the final 'e'.
[§1, Figure 1] The text refers to the 'DRAPA TC' dataset; the correct acronym is DARPA TC, and this should be consistent throughout the paper (Section 6.1.1 already uses DARPA).
[Tables 3 and 7] Table 3 reports CADETS node-level precision of 76.67%, while Table 7 reports graph-level precision of 100% for CLIProv on CADETS; the relationship between node-level and graph-level metrics should be explained explicitly so readers do not perceive a contradiction.
[§5.2.4] The prompt template for GPT-3 augmentation is given as a single sentence ('Please rewrite the following sentence, keeping the original meaning intact.'); more detail on how semantic preservation was verified, and whether any augmented outputs were manually filtered, would improve reproducibility.
[§6.3.1, Table 5] The 'Alignment Score' is taken from Poirot's methodology, but the paper does not define it or state whether it is computed automatically or with human annotation; please add a definition or a reference to the original scoring procedure.
[General] The paper does not state whether the source code, trained models, or processed datasets will be released; providing these would substantially strengthen the reproducibility of the results and the ability of other researchers to apply the anonymization test suggested above.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the derivation is a standard supervised contrastive-learning pipeline with held-out test scenarios, though an entity-overlap confound remains an unaddressed validity risk.

full rationale

CLIProv's derivation chain is a supervised contrastive learning pipeline: positive log-text pairs are manually constructed from ground truth (§5.2.4), encoders are trained with InfoNCE (§5.3.3), and held-out scenarios from CADETS, THEIA, ATLAS and CICAPT-IIoT are evaluated (§6.2). The test scenarios are not the same as training scenarios, so the reported detection results are not equal to the training objective by construction. The paper does not fit a parameter to a test quantity and then rename it a prediction; the fitted quantities are encoder weights and standard hyperparameters, and the query database (MITRE ATT&CK) is external to the training pairs. There is no load-bearing self-citation or imported uniqueness theorem. A genuine validity concern exists: log sequences are strings of entity names, and positive texts (e.g., 'nginx', '78.205.235.65') share those exact tokens, so the model may exploit lexical overlap rather than abstract behavior semantics; the paper does not run an anonymization control. But this is an empirical confound, not a definitional equivalence, so under the circularity standard it does not warrant a positive score.

Assumptions & free parameters 5 free parameters · 6 assumptions · 1 invented entities

The central claim rests on multiple hand-set preprocessing thresholds, a temporal locality assumption, supervised pair construction from ground truth, and an untested assumption that RoBERTa tokenization preserves log semantics. These are not fatal individually, but collectively they explain why the reported results may not generalize.

free parameters (5)

theta_max (behavior boundary time threshold) = 20 minutes
Hand-set in Section 6.1.2; controls subgraph granularity and therefore the content of every log sequence fed to the encoder.
n_aug (number of GPT-3 augmented threat intelligence texts) = 3
Chosen empirically; Figure 5 shows CICAPT-IIoT TPR changes with n_aug, indicating selection on a dataset used otherwise only as a test set.
Levenshtein similarity threshold for merging file nodes = 0.7
Manual preprocessing threshold in Section 5.2.1 without sensitivity analysis.
Network merge time window = 1 second
Hand-set in Section 5.2.1 for combining same-IP connections; no ablation.
Training hyperparameters (learning rate, dropout, hidden units, batch size, epochs) = 1e-5, 0.5, 128, 64, 100
Selected via grid search in Section 6.1.2; no variance reported across seeds.

assumptions (6)

domain assumption Provenance logs are complete and unmodified by the attacker
Section 4 assumes provenance data is complete and not forged; anti-forensic attackers can violate this.
domain assumption Similar attack techniques leave similar log sequences
Section 4 states 'Similar attack techniques are reflected in similar attack sequences', which underpins the semantic alignment.
ad hoc to paper Events within one behavior are separated by intervals no larger than theta_max (20 min)
Equation (4) partitions subgraphs using theta_max; APT actors intentionally vary timing, so 20 minutes is fragile.
ad hoc to paper GPT-3 augmentation preserves threat-intelligence semantics
Section 5.2.4 uses a single prompt 'Please rewrite... keeping the original meaning intact' with no semantic-preservation check.
ad hoc to paper RoBERTa tokenization of serialized log triples yields meaningful behavior representations
Section 5.3.1 treats log sequences as sentences; no evidence that entity-name tokenization captures behavior semantics rather than surface forms.
standard math Contrastive loss (InfoNCE) is an appropriate alignment objective
Equations (5)-(7) use InfoNCE; standard tool, no issue.

invented entities (1)

Virtual node v'_i per behavior subgraph
purpose: Connects isolated attack subgraphs into one attack scenario via time-dependent shortest paths (Equation 9)
Algorithmic construct for graph reconstruction; it is not claimed to exist in the system.

how reviews work

0 comments

Cite this review

Pith. "Pith review of CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis." pith.science (2026). https://pith.science/paper/Y2FVTVVV

@misc{pith2026250709133,
  author       = {Pith},
  title        = {Pith review of: CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Y2FVTVVV}},
  note         = {Machine review of arXiv:2507.09133}
}

read the original abstract

With the increasing complexity of cyberattacks, the proactive and forward-looking nature of threat intelligence has become more crucial for threat detection and provenance analysis. However, translating high-level attack patterns described in Tactics, Techniques, and Procedures (TTP) intelligence into actionable security policies remains a significant challenge. This challenge arises from the semantic gap between high-level threat intelligence and low-level provenance log. To address this issue, this paper introduces CLIProv, a novel approach for detecting threat behaviors in a host system. CLIProv employs a multimodal framework that leverages contrastive learning to align the semantics of provenance logs with threat intelligence, effectively correlating system intrusion activities with attack patterns. Furthermore, CLIProv formulates threat detection as a semantic search problem, identifying attack behaviors by searching for threat intelligence that is most semantically similar to the log sequence. By leveraging attack pattern information in threat intelligence, CLIProv identifies TTPs and generates complete and concise attack scenarios. Experimental evaluations on standard datasets show that CLIProv effectively identifies attack behaviors in system provenance logs, offering valuable references for potential techniques. Compared to state-of-the-art methods, CLIProv achieves higher precision and significantly improved detection efficiency.

Figures

Figures reproduced from arXiv: 2507.09133 by the authors.

**Figure 1.** An attack scenario example in the DRAPA TC dataset. behavior patterns, which poses a challenge to computational resources. Limitation 2. Threat hunting rely on structured query templates. These templates often require manual design, which is time-consuming and labor-intensive. Moreover, the exact matching approach lacks flexibility and struggles to identify unknown attacks. Limitation 3. The scale of provenance logs… view at source ↗

**Figure 2.** Comparison of query graph-based method and CLIProv. 3.1. Data provenance and threat intelligence Provenance logs are typically generated by system auditing tools such as Windows ETW and Linux Audit, which record activities such as system calls, file accesses, and user logins in detail. Data provenance is modeled as a directed graph based on the flow of information in these logs, as shown in [PITH_FULL_IMAGE:figure… view at source ↗

**Figure 3.** Overview of CLIProv’ architecture [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Process flow diagram of an alpine email client operation. check and subsequently connects to the local mail server via port 25 to send emails. These two actions happened within one second and before and after each other, so we think that these two actions can be combin…

**Figure 5.** Figure 5: TPR and FPR under different levels of data augmentation. by generating diverse attack descriptions, which helped the model learn a more fine-grained representation of attack behaviors in the semantic space, so as to better distinguish attacks from normal behaviors. As …

**Figure 6.** Figure 6: Impact of benign sequence sampling scale on TPR and FPR [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

**Figure 7.** Figure 7: An interpretable attack graphs example generated by CLIProv [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 49 canonical work pages

[1]

C. Gan, J. Lin, D.-W. Huang, Q. Zhu, L. Tian, Advanced persistent threats and their defense methods in industrial internet of things: A survey, Mathematics 11 (2023)

work page 2023
[2]

Z. Chen, J. Liu, Y. Shen, M. Simsek, B. Kantarci, H. T. Mouftah, P. Djukic, Machine learning-enabled iot security: Open issues and challenges under advanced persistent threats, ACM Comput. Surv. 55 (2022)

work page 2022
[3]

D. He, H. Gu, S. Zhu, S. Chan, M. Guizani, A comprehensive detection method for the lateral movement stage of apt attacks, IEEE Internet of Things Journal 11 (2024) 8440–8447

work page 2024
[4]

L. Yu, Y. Ye, Z. Zhang, X. Zhang, Cost-effective attack forensics by recording and correlating file system changes, in: 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 1705–1722

work page 2024
[5]

U. S. D. of Justice, Justice department announces actions to disrupt advanced persistent threat 28 botnet of infected routers and network storage devices, 2018. URL: https://www.justice.gov/opa/pr/ justice-department-announces-actions-disrupt-advanced-persistent\ -threat-28-botnet-infected, accessed 2024.7.15

work page 2018
[6]

Z. Zhao, Z. Li, J. Yu, F. Zhang, X. Xie, H. Xu, B. Chen, Cmd: Co-analyzed iot malware detection and forensics via network and hardware domains, IEEE Transactions on Mobile Computing 23 (2024) 5589–5603

work page 2024
[7]

F. Yang, J. Xu, C. Xiong, Z. Li, K. Zhang, PROGRAPHER: an anomaly detection system based on provenance graph embedding, in: J. A. Calandrino, C. Troncoso (Eds.), 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, USENIX Association, 2023, pp. 4355–4372

work page 2023
[8]

T. Chen, C. Dong, M. Lv, Q. Song, H. Liu, T. Zhu, K. Xu, L. Chen, S. Ji, Y. Fan, Apt-kgl: An intelligent apt detection system based on threat knowledge and heterogeneous provenance graph learning, IEEE Transactions on Dependable and Secure Computing (2022)

work page 2022

Show all 54 references

[9]

Altinisik, F

E. Altinisik, F. Deniz, H. T. Sencar, Provg-searcher: A graph repre- sentationlearningapproachforefficientprovenancegraphsearch, in: Proceedingsofthe2023ACMSIGSACConferenceonComputerand Communications Security, 2023, pp. 2247–2261

2023
[10]

Cheng, Q

Z. Cheng, Q. Lv, J. Liang, Y. Wang, D. Sun, T. Pasquier, X. Han, Kairos: Practical intrusion detection and investigation using whole- system provenance, in: 2024 IEEE Symposium on Security and Privacy(SP),IEEEComputerSociety,LosAlamitos,CA,USA,2024, pp. 9–9. doi:10.1109/SP5426...

2024
[11]

H. Ding, J. Zhai, Y. Nan, S. Ma, AIRTAG: Towards automated attackinvestigationbyunsupervisedlearningwithlogtexts, in:32nd USENIX Security Symposium (USENIX Security 23), USENIX Association, Anaheim, CA, 2023, pp. 373–390

2023
[12]

1795–1812

S.M.Milajerdi,B.Eshete,R.Gjomemo,V.Venkatakrishnan, Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting, in: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1795–1812

2019
[13]

URL: https://github.com/darpa-i2o/Transparent-Computing/blob/master/ README-E3.md, accessed 2024.7.15

DARPA, Transparent computing (archived), 2018. URL: https://github.com/darpa-i2o/Transparent-Computing/blob/master/ README-E3.md, accessed 2024.7.15

2018
[14]

Radford, J

A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G.Sastry,A.Askell,P.Mishkin,J.Clark,etal., Learningtransferable visual models from natural language supervision, in: International conference on machine learning, PMLR, 2021, pp. 8748–8763

2021
[15]

Manzoor, S

E. Manzoor, S. M. Milajerdi, L. Akoglu, Fast memory-efficient anomaly detection in streaming heterogeneous graphs, in: Pro- ceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1035–1044

2016
[16]

X.Han,T.F.J.Pasquier,A.Bates,J.Mickens,M.I.Seltzer, Unicorn: Runtime provenance-based detector for advanced persistent threats, in: 27th Annual Network and Distributed System Security Sympo- sium, NDSS 2020, San Diego, California, USA, February 23-26, 2020, The Internet Society, 2020

2020
[17]

F. Liu, Y. Wen, D. Zhang, X. Jiang, X. Xing, D. Meng, Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise, in: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, 2019, pp. 1777–1794

2019
[18]

S. Wang, Z. Wang, T. Zhou, H. Sun, X. Yin, D. Han, H. Zhang, X. Shi, J. Yang, Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning, IEEE Transactions on Information Forensics and Security 17 (2022) 3972–3987

2022
[19]

Mahmoud, M

M. Mahmoud, M. Mannan, A. Youssef, Apthunter: Detecting ad- vanced persistent threats in early stages, Digital Threats: Research and Practice 4 (2023) 1–31

2023
[20]

P. Gao, F. Shao, X. Liu, X. Xiao, Z. Qin, F. Xu, P. Mittal, S. R. Kulkarni,D.Song, Enablingefficientcyberthreathuntingwithcyber threat intelligence, in: 2021 IEEE 37th International Conference on Data Engineering (ICDE), IEEE, 2021, pp. 193–204

2021
[21]

Kulkarni, D

P.Gao,F.Shao,X.Liu,X.Xiao,H.Liu,Z.Qin,F.Xu,P.Mittal,S.R. Kulkarni, D. Song, A system for efficiently hunting for cyber threats in computer systems using threat intelligence, in: 2021 IEEE 37th International Conference on Data Engineering (ICDE), IEEE, 2021, pp. 2705–2708

2021
[22]

A. Aly, S. Iqbal, A. Youssef, E. Mansour, Megr-apt: A memory- efficient apt hunting system based on attack representation learning, IEEE Transactions on Information Forensics and Security (2024)

2024
[23]

B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pen- nington, C. B. Thomas, MITRE ATT&CK: Design and Philosophy, Technical Report, MITRE Corporation, 2020. URL:https://attack. mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf. First Author et al.:Preprin...

2020
[24]

S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, V. Venkatakrish- nan,Holmes:real-timeaptdetectionthroughcorrelationofsuspicious informationflows,in:2019IEEESymposiumonSecurityandPrivacy (SP), IEEE, 2019, pp. 1137–1152

2019
[25]

W. U. Hassan, A. Bates, D. Marino, Tactical provenance analysis for endpointdetection andresponse systems, in: 2020IEEE Symposium on Security and Privacy (SP), IEEE, 2020, pp. 1172–1189

2020
[26]

R.Wei,L.Cai,L.Zhao,A.Yu,D.Meng, Deephunter:Agraphneural network based approach for robust cyber threat hunting, in: Security and Privacy in Communication Networks: 17th EAI International Conference,SecureComm2021,VirtualEvent,September6–9,2021, Proceedings, Part I 17, Springer...

2021
[27]

Satvat, R

K. Satvat, R. Gjomemo, V. Venkatakrishnan, Extractor: Extracting attackbehaviorfromthreatreports, in:2021IEEEEuropeanSympo- sium on Security and Privacy (EuroS&P), IEEE, 2021, pp. 598–615

2021
[28]

Z. Li, J. Zeng, Y. Chen, Z. Liang, Attackg: Constructing technique knowledgegraphfromcyberthreatintelligencereports, in:European Symposium on Research in Computer Security, Springer, 2022, pp. 589–609

2022
[29]

Schultmann, Y

F.K.Kaiser,U.Dardik,A.Elitzur,P.Zilberman,N.Daniel,M.Wiens, F. Schultmann, Y. Elovici, R. Puzis, Attack hypotheses generation based on threat intelligence knowledge graph, IEEE Transactions on Dependable and Secure Computing 20 (2023) 4793–4809

2023
[30]

Kurniawan, A

K. Kurniawan, A. Ekelhart, E. Kiesling, G. Quirchmayr, A. M. Tjoa, Krystal: Knowledge graph-based framework for tactical attack dis- covery in audit data, Computers & Security 121 (2022) 102828

2022
[31]

Y. Ren, Y. Xiao, Y. Zhou, Z. Zhang, Z. Tian, Cskg4apt: A cyber- security knowledge graph for advanced persistent threat organization attribution, IEEE Transactions on Knowledge and Data Engineering 35 (2022) 5695–5709

2022
[32]

Gartner, Market guide for security threat intelligence services, 2014.URL: https://www.gartner.com/en/documents/2874317,accessed 2024.7.15

2014
[33]

N.Sun,M.Ding,J.Jiang,W.Xu,X.Mo,Y.Tai,J.Zhang,Cyberthreat intelligence mining for proactive cybersecurity defense: a survey and new perspectives, IEEE Communications Surveys & Tutorials 25 (2023) 1748–1774

2023
[34]

Mitchell, A

R.Brown,A.Sfakianakis,F.Akar,S.Benton,T.Bussa,A.Grayland, E. Mitchell, A. Nash, Sans 2024 cti survey: Managing the evolving threat landscape, 2024. URL: https://www.sans.org/webcasts/ sans-2024-cti-survey-managing-the-evolving-threat-landscape/ , accessed 2024.7.15

2024
[35]

Baltrušaitis, C

T. Baltrušaitis, C. Ahuja, L.-P. Morency, Multimodal machine learn- ing: A survey and taxonomy, IEEE transactions on pattern analysis and machine intelligence 41 (2018) 423–443

2018
[36]

Frome, G

A. Frome, G. S. Corrado, J. Shlens, S. Bengio, J. Dean, M. Ranzato, T. Mikolov, Devise: A deep visual-semantic embedding model, Advances in neural information processing systems 26 (2013)

2013
[37]

Andrew, R

G. Andrew, R. Arora, J. Bilmes, K. Livescu, Deep canonical cor- relation analysis, in: International conference on machine learning, PMLR, 2013, pp. 1247–1255

2013
[38]

Zettlemoyer, V

Y.Liu,M.Ott,N.Goyal,J.Du,M.Joshi,D.Chen,O.Levy,M.Lewis, L. Zettlemoyer, V. Stoyanov, Roberta: A robustly optimized bert pretraining approach, arXiv preprint arXiv:1907.11692 (2019)

2019 arXiv
[39]

URL:https://attack.mitre.org/, ac- cessed 2024.7.15

MITRE, Mitre att&ck, 2024. URL:https://attack.mitre.org/, ac- cessed 2024.7.15

2024
[40]

V.I.Levenshtein,etal., Binarycodescapableofcorrectingdeletions, insertions, and reversals, in: Soviet physics doklady, volume 10, Soviet Union, 1966, pp. 707–710

1966
[41]

Tarjan, Depth-first search and linear graph algorithms, SIAM journal on computing 1 (1972) 146–160

R. Tarjan, Depth-first search and linear graph algorithms, SIAM journal on computing 1 (1972) 146–160

1972
[42]

Y. Hu, F. Zou, J. Han, X. Sun, Y. Wang, Llm-tikg: Threat intelli- gence knowledge graph construction utilizing large language model, Computers & Security 145 (2024) 103999

2024
[43]

Latif, J

A. Latif, J. Kim, Evaluation and analysis of large language models forclinicaltextaugmentationandgeneration, IEEEAccess12(2024) 48987–48996

2024
[44]

Brown, B

T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhari- wal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D.Ziegler,J.Wu,C.Winter,C.Hesse,M.Chen,E.Sigler,M.Litwin, S. Gray, B. Chess, J. Clar...

2020
[45]

A. v. d. Oord, Y. Li, O. Vinyals, Representation learning with con- trastive predictive coding, arXiv preprint arXiv:1807.03748 (2018)

2018 arXiv
[46]

Z. Wu, Y. Xiong, S. X. Yu, D. Lin, Unsupervised feature learning via non-parametric instance discrimination, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 3733–3742

2018
[47]

B.Ding,J.X.Yu,L.Qin, Findingtime-dependentshortestpathsover large graphs, in: Proceedings of the 11th international conference onExtendingdatabasetechnology:Advancesindatabasetechnology, 2008, pp. 205–216

2008
[48]

Paszke, S

A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al., Pytorch: An imperative style, high-performance deep learning library, Advances in neural information processing systems 32 (2019)

2019
[49]

Xu, {ATLAS}: A sequence-based learning approach for attack investigation, in: 30th USENIX security symposium (USENIX security 21), 2021, pp

A.Alsaheel,Y.Nan,S.Ma,L.Yu,G.Walkup,Z.B.Celik,X.Zhang, D. Xu, {ATLAS}: A sequence-based learning approach for attack investigation, in: 30th USENIX security symposium (USENIX security 21), 2021, pp. 3005–3022

2021
[50]

Ghiasvand, S

E. Ghiasvand, S. Ray, S. Iqbal, S. Dadkhah, A. A. Ghorbani, Cicapt- iiot:Aprovenance-basedaptattackdatasetforiiotenvironment,arXiv preprint arXiv:2407.11278 (2024)

2024 arXiv
[51]

Ranade, A

P. Ranade, A. Piplai, S. Mittal, A. Joshi, T. Finin, Generating fake cyber threat intelligence using transformer-based models, in: 2021 International Joint Conference on Neural Networks (IJCNN), IEEE, 2021, pp. 1–9

2021
[52]

Z. Song, Y. Tian, J. Zhang, Y. Hao, Generating fake cyber threat intelligence using the gpt-neo model, in: 2023 8th International Conference on Intelligent Computing and Signal Processing (ICSP), IEEE, 2023, pp. 920–924

2023
[53]

Mahlangu, S

T. Mahlangu, S. January, T. Mashiane, M. Dlamini, S. Ngobeni, N. Ruxwana, Data poisoning: Achilles heel of cyber threat intelli- gencesystems, in:ProceedingsoftheICCWS201914thInternational Conference on Cyber Warfare and Security: ICCWS, 2019, pp. 220– 230

2019
[54]

Mitra, A

S. Mitra, A. Piplai, S. Mittal, A. Joshi, Combating fake cyber threat intelligenceusingprovenanceincybersecurityknowledgegraphs, in: 2021 IEEE International Conference on Big Data (Big Data), IEEE, 2021, pp. 3316–3323. First Author et al.:Preprint submitted to Elsevier Page 18 of 18

2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

C. Gan, J. Lin, D.-W. Huang, Q. Zhu, L. Tian, Advanced persistent threats and their defense methods in industrial internet of things: A survey, Mathematics 11 (2023)

work page 2023

[2] [2]

Z. Chen, J. Liu, Y. Shen, M. Simsek, B. Kantarci, H. T. Mouftah, P. Djukic, Machine learning-enabled iot security: Open issues and challenges under advanced persistent threats, ACM Comput. Surv. 55 (2022)

work page 2022

[3] [3]

D. He, H. Gu, S. Zhu, S. Chan, M. Guizani, A comprehensive detection method for the lateral movement stage of apt attacks, IEEE Internet of Things Journal 11 (2024) 8440–8447

work page 2024

[4] [4]

L. Yu, Y. Ye, Z. Zhang, X. Zhang, Cost-effective attack forensics by recording and correlating file system changes, in: 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 1705–1722

work page 2024

[5] [5]

U. S. D. of Justice, Justice department announces actions to disrupt advanced persistent threat 28 botnet of infected routers and network storage devices, 2018. URL: https://www.justice.gov/opa/pr/ justice-department-announces-actions-disrupt-advanced-persistent\ -threat-28-botnet-infected, accessed 2024.7.15

work page 2018

[6] [6]

Z. Zhao, Z. Li, J. Yu, F. Zhang, X. Xie, H. Xu, B. Chen, Cmd: Co-analyzed iot malware detection and forensics via network and hardware domains, IEEE Transactions on Mobile Computing 23 (2024) 5589–5603

work page 2024

[7] [7]

F. Yang, J. Xu, C. Xiong, Z. Li, K. Zhang, PROGRAPHER: an anomaly detection system based on provenance graph embedding, in: J. A. Calandrino, C. Troncoso (Eds.), 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, USENIX Association, 2023, pp. 4355–4372

work page 2023

[8] [8]

T. Chen, C. Dong, M. Lv, Q. Song, H. Liu, T. Zhu, K. Xu, L. Chen, S. Ji, Y. Fan, Apt-kgl: An intelligent apt detection system based on threat knowledge and heterogeneous provenance graph learning, IEEE Transactions on Dependable and Secure Computing (2022)

work page 2022