An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models | Paper Citation Record

Observation d39dfd20-1f05-4bed-b6b9-ed95906ddfba · outbound

This paper cites https://www.cisa.gov/news-events/ alerts/2020/12/13/active-exploitation- solarwinds-software.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://www.cisa.gov/news-events/ alerts/2020/12/13/active-exploitation- solarwinds-software

Reference 1

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.247889Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 566a70af-17ad-475d-b846-4eae231ec2d6 · outbound

This paper cites https://anonymous.4open.science/r/Themis- LLM-B4EC.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://anonymous.4open.science/r/Themis- LLM-B4EC

Reference 2

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.134545Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation d8421e1a-7f89-4a23-8161-f9d845800ae5 · outbound

This paper cites https://docs.redhat.com/en/ documentation/red_hat_enterprise_linux/6/ html/security_guide/chap-system_auditing.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://docs.redhat.com/en/ documentation/red_hat_enterprise_linux/6/ html/security_guide/chap-system_auditing

Reference 3

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.125651Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation f23285af-18a0-4873-9db4-14a40459aa51 · outbound

This paper cites https://www.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://www

Reference 4

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.116968Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation bf70b4ad-b674-469e-90d9-120c6623cb43 · outbound

This paper cites https://csr.lanl.gov/data/.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://csr.lanl.gov/data/

Reference 5

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.108708Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation c18ca003-851c-455c-b7b6-245d453c52ba · outbound

This paper cites https://community.broadcom.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://community.broadcom

Reference 6

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.099899Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation edfefce7-bbc0-41f7-81ce-81d83f22aa59 · outbound

This paper cites https://github.com/FiveDirections/OpTC- data.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://github.com/FiveDirections/OpTC- data

Reference 7

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.091575Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 0d42a662-790e-449a-a1f5-dde928059aef · outbound

This paper cites https://github.com/ shramos/Awesome-Cybersecurity-Datasets.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://github.com/ shramos/Awesome-Cybersecurity-Datasets

Reference 8

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.082915Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 94eef73f-62d1-4372-b87a-818ee1af2427 · outbound

This paper cites https://milvus.io/zh.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://milvus.io/zh

Reference 9

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.074186Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation b9a97148-4748-42b6-b026-fafd046614d9 · outbound

This paper cites https: //sysdig.com/.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https: //sysdig.com/

Reference 10

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.065735Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation fe329758-00c6-4915-9456-93931d68526b · outbound

This paper cites https:// attack.mitre.org/campaigns/C0024/.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https:// attack.mitre.org/campaigns/C0024/

Reference 11

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.056296Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 5d2d4935-6f49-460b-b6a7-a2143726f9b5 · outbound

This paper cites https://cymulate.com/ cybersecurity-glossary/tactics-techniques- procedures/.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://cymulate.com/ cybersecurity-glossary/tactics-techniques- procedures/

Reference 12

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.047715Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation a70018ae-0d73-4506-8a3f-9eb10b361f66 · outbound

This paper cites https://www.crowdstrike.com/en-us/ platform/threat-intelligence/.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://www.crowdstrike.com/en-us/ platform/threat-intelligence/

Reference 13

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.038485Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6f80c721-3e2e-4785-89a9-218c2d7ed472 · outbound

This paper cites https://en.wikipedia.org/ wiki/WannaCry_ransomware_attack.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://en.wikipedia.org/ wiki/WannaCry_ransomware_attack

Reference 14

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.029504Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 072cbf4c-c251-4748-bfc1-24377dedc1dd · outbound

This paper cites https://www.crowdstrike.com/en-us/ cybersecurity-101/threat-intelligence/.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://www.crowdstrike.com/en-us/ cybersecurity-101/threat-intelligence/

Reference 15

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.020902Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation ebaec913-5dca-4714-97d7-e05bc7799fd0 · outbound

This paper cites https://www.upguard.com/ blog/cyber-incident-reporting? [Accessed 11- 08-2025].

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://www.upguard.com/ blog/cyber-incident-reporting? [Accessed 11- 08-2025]

Reference 16

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.011261Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation a0e59622-8690-4d81-9c33-10e5c5e35844 · outbound

This paper cites https://www.lockheedmartin.com/en-us/ capabilities/cyber/cyber-kill-chain.html,.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models https://www.lockheedmartin.com/en-us/ capabilities/cyber/cyber-kill-chain.html,

Reference 17

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:08.001914Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 4eef9ece-68b5-4d16-968f-c49ceb4e2fa5 · outbound

This paper cites Berkay Celik, Xiangyu Zhang, and Dongyan Xu.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Berkay Celik, Xiangyu Zhang, and Dongyan Xu

Reference 18

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.984303Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 15e8771b-a75f-424a-bd73-0fbf46cf3a77 · outbound

This paper cites ANY.RUN - Interactive Online Malware Sand- box — any.run.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models ANY.RUN - Interactive Online Malware Sand- box — any.run

Reference 19

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.974529Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 1eb6d527-c512-4407-81a2-a25eb9d8acc2 · outbound

This paper cites Kairos: Practical intrusion detection and investigation using whole-system provenance.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Kairos: Practical intrusion detection and investigation using whole-system provenance

Reference 20

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.965833Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 914fa0a4-d1e7-420e-9760-5a68487056ea · outbound

This paper cites How to Use Threat Hunt- ing to Identify and Neutralize Advanced Per- sistent Threats — cloudoptics.ai.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models How to Use Threat Hunt- ing to Identify and Neutralize Advanced Per- sistent Threats — cloudoptics.ai

Reference 21

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.957524Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 853a901b-59a3-45da-a222-b6a44c3c9274 · outbound

This paper cites Cybersecurity study: SolarWinds attack cost affected companies an average of $12 million — techrepublic.com.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Cybersecurity study: SolarWinds attack cost affected companies an average of $12 million — techrepublic.com

Reference 22

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.948944Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 44997b87-e6ac-47db-a9e1-a1cafb6f130b · outbound

This paper cites AIRTAG: Towards automated attack investigation by unsupervised learning with log texts.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models AIRTAG: Towards automated attack investigation by unsupervised learning with log texts

Reference 23

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.940323Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation e669144a-4663-4c7d-b7c1-4da23f8a3ebc · outbound

This paper cites Event Tracing for Windows (ETW) - Windows drivers — learn.microsoft.com.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Event Tracing for Windows (ETW) - Windows drivers — learn.microsoft.com

Reference 24

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.931873Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation b888b42f-b692-40e9-991b-977c1bc7f682 · outbound

This paper cites {DISTDET}: A {Cost-Effective} distributed cyber threat detection system.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models {DISTDET}: A {Cost-Effective} distributed cyber threat detection system

Reference 25

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.924235Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 85f6de31-c33f-4267-953a-b768ae811580 · outbound

This paper cites Deeplog: Anomaly detection and diagnosis from system logs through deep learning.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Deeplog: Anomaly detection and diagnosis from system logs through deep learning

Reference 26

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.916822Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6284939f-372b-443f-8bad-82d90ffd64b9 · outbound

This paper cites {Back-Propagating} system dependency impact for attack investigation.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models {Back-Propagating} system dependency impact for attack investigation

Reference 27

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.909254Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 83b1ab74-8b76-4e2a-8aac-c9e5caacb720 · outbound

This paper cites DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning

Reference 28

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.319845Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 8601ab0e-4514-46d9-a344-f5b8501e39d3 · outbound

This paper cites UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Reference 29

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.322575Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 940a3319-46d5-411d-bf7e-9671b536ff43 · outbound

This paper cites Tac- tical provenance analysis for endpoint detection and response systems.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Tac- tical provenance analysis for endpoint detection and response systems

Reference 30

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.901784Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 4908d3b7-cb86-4426-8ebf-ef6b36f57a51 · outbound

This paper cites Nodoze: Combatting threat alert fatigue with automated provenance triage.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Nodoze: Combatting threat alert fatigue with automated provenance triage

Reference 31

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.894153Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 44551808-0009-4be7-b618-0e73245d5afa · outbound

This paper cites In 26th USENIX Security Symposium (USENIX Security 17), pages 487–504, 2017.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models In 26th USENIX Security Symposium (USENIX Security 17), pages 487–504, 2017

Reference 32

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.886602Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6ba5029e-8021-460b-be67-307e28a55722 · outbound

This paper cites Sellafield apologises after guilty plea over string of cybersecurity failings — theguardian.com.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Sellafield apologises after guilty plea over string of cybersecurity failings — theguardian.com

Reference 33

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.878339Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 185d40a6-1f97-484b-b50b-02851f933121 · outbound

This paper cites Rain: Refinable attack investigation with on- demand inter-process information flow tracking.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Rain: Refinable attack investigation with on- demand inter-process information flow tracking

Reference 34

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.869694Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 74593940-df9f-43cd-9eae-983c0c2d7f32 · outbound

This paper cites {MAGIC}: Detecting advanced per- sistent threats via masked graph representation learning.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models {MAGIC}: Detecting advanced per- sistent threats via masked graph representation learning

Reference 35

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.861894Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 8fcf7285-79b2-4a5b-abb9-302727fc05e0 · outbound

This paper cites Orthrus: Achieving high quality of attribution in provenance-based intrusion de- tection systems.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Orthrus: Achieving high quality of attribution in provenance-based intrusion de- tection systems

Reference 36

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.854057Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation ebd3f98c-83c6-4785-9541-a5f32aea58fd · outbound

This paper cites Temporal decay loss for adaptive log anomaly detection in cloud environments.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Temporal decay loss for adaptive log anomaly detection in cloud environments

Reference 37

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.846345Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 11aad21a-b419-478e-83a6-c1cdc6d25f66 · outbound

This paper cites Prov-gem: Au- tomated provenance analysis framework using graph embeddings.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Prov-gem: Au- tomated provenance analysis framework using graph embeddings

Reference 38

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.838344Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 377460e7-a61c-4408-b004-d4459d32ff21 · outbound

This paper cites Measuring catastrophic forgetting in neural networks.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Measuring catastrophic forgetting in neural networks

Reference 39

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.346137Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3405be81-eaa8-4802-9e60-acd6eb5420a9 · outbound

This paper cites High accuracy attack provenance via binary-based exe- cution partition.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models High accuracy attack provenance via binary-based exe- cution partition

Reference 40

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.825920Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 67e3009d-f64a-4089-acc9-a9c8c13c4491 · outbound

This paper cites LevelBlue Labs Open Threat Exchange — levelblue.com.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models LevelBlue Labs Open Threat Exchange — levelblue.com

Reference 41

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.818146Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6efee85d-0cbf-4456-858e-eeb02c1ccf10 · outbound

This paper cites Retrieval-augmented generation for knowledge- intensive nlp tasks.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Retrieval-augmented generation for knowledge- intensive nlp tasks

Reference 42

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.353626Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 231becc9-b191-4442-9b27-a5d36a799e1e · outbound

This paper cites A hierarchical approach for advanced persis- tent threat detection with attention-based graph neu- ral networks.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models A hierarchical approach for advanced persis- tent threat detection with attention-based graph neu- ral networks

Reference 43

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.805522Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation e442ad01-c6b9-41d4-a5e7-17b44508d8d2 · outbound

This paper cites Log2vec: A heteroge- neous graph embedding based approach for detecting cyber threats within enterprise.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Log2vec: A heteroge- neous graph embedding based approach for detecting cyber threats within enterprise

Reference 44

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.797692Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 8d871bd8-247a-4a75-a61c-82bfcb225c13 · outbound

This paper cites APT28 Cyber Espionage Campaign Targets Logistics and Tech Compa- nies, CISA Warns — reveal.security.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models APT28 Cyber Espionage Campaign Targets Logistics and Tech Compa- nies, CISA Warns — reveal.security

Reference 45

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.789833Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6f42ffc6-917e-4372-b41c-8ea60ce04eca · outbound

This paper cites Pro- tracer: Towards practical provenance tracing by alter- nating between logging and tainting.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Pro- tracer: Towards practical provenance tracing by alter- nating between logging and tainting

Reference 46

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.781920Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation fd4527df-aad0-4547-931e-e308a6dea680 · outbound

This paper cites Sysmon - Sysinternals — learn.microsoft.com.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Sysmon - Sysinternals — learn.microsoft.com

Reference 47

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.774436Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 279c288e-d136-426a-92d6-a7de29592c4d · outbound

This paper cites Poirot: Aligning attack be- havior with kernel audit records for cyber threat hunting.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Poirot: Aligning attack be- havior with kernel audit records for cyber threat hunting

Reference 49

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.766547Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 0dd9298b-2955-4b4b-a81d-909b38f66427 · outbound

This paper cites Holmes: real-time apt detection through correlation of suspicious information flows.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Holmes: real-time apt detection through correlation of suspicious information flows

Reference 50

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.758683Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation a8f0fffc-094d-429e-acb0-f37e8e9f6b73 · outbound

This paper cites Mitre att&ck, 2020.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Mitre att&ck, 2020

Reference 51

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.751027Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 3712e7f3-bb65-4faa-8da5-82be9d03861f · outbound

This paper cites Custos: Practical tamper-evident auditing of operating systems using trusted execution.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Custos: Practical tamper-evident auditing of operating systems using trusted execution

Reference 52

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.743217Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 4934948f-1f05-48e7-84d7-f63155e134ef · outbound

This paper cites Logging to the danger zone: Race condition attacks and defenses on system audit frameworks.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Logging to the danger zone: Race condition attacks and defenses on system audit frameworks

Reference 53

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.734923Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation a85c0ba7-2f2d-4d29-a7d8-9979881c246e · outbound

This paper cites Hercule: Attack story re- construction via community discovery on correlated log graph.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Hercule: Attack story re- construction via community discovery on correlated log graph

Reference 54

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.725726Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 64bd88ab-a129-431c-96a9-a27234b10e16 · outbound

This paper cites No-doubt: Attack attribution based on threat intelligence reports.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models No-doubt: Attack attribution based on threat intelligence reports

Reference 55

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.718021Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 7feceb49-1ae2-4f45-9cfb-6c507b9ec103 · outbound

This paper cites {ATTACK2VEC}: Leveraging temporal word embeddings to understand the evolution of cyberattacks.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models {ATTACK2VEC}: Leveraging temporal word embeddings to understand the evolution of cyberattacks

Reference 56

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.709927Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 2d2eb9ac-2c2b-49a1-8b52-dba7c3edfb38 · outbound

This paper cites APT and financial attacks on industrial organizations in Q4 2024 | Kaspersky ICS CERT — ics-cert.kaspersky.com.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models APT and financial attacks on industrial organizations in Q4 2024 | Kaspersky ICS CERT — ics-cert.kaspersky.com

Reference 57

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.701410Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 879316ac-d833-4932-813e-e9aef8cc8ab3 · outbound

This paper cites Survey on Factuality in Large Language Models: Knowledge, Retrieval and Domain-Specificity.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Survey on Factuality in Large Language Models: Knowledge, Retrieval and Domain-Specificity

Reference 58

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.392732Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 0c5dfbd1-1f29-4326-8193-5c1fbf893a64 · outbound

This paper cites Threatrace: Detecting and tracing host-based threats in node level through provenance graph learn- ing.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Threatrace: Detecting and tracing host-based threats in node level through provenance graph learn- ing

Reference 59

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.692043Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation dfb394dc-7140-4c49-a405-dc11cf2d0382 · outbound

This paper cites Chain-of-thought prompting elicits reasoning in large language models.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Chain-of-thought prompting elicits reasoning in large language models

Reference 60

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.398055Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 0080c2c1-7b22-48a5-a399-f2fca9acf62c · outbound

This paper cites On the ef- fectiveness of log representation for log-based anomaly detection.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models On the ef- fectiveness of log representation for log-based anomaly detection

Reference 61

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.677733Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation c410fdea-c40f-46c4-88e3-0cc947031a2c · outbound

This paper cites Depcomm: Graph sum- marization on system audit logs for attack investigation.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Depcomm: Graph sum- marization on system audit logs for attack investigation

Reference 62

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.669098Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation e04404d3-a97b-4662-9d97-8b4366b5a1f2 · outbound

This paper cites {PROGRAPHER}: An anomaly detection system based on provenance graph embedding.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models {PROGRAPHER}: An anomaly detection system based on provenance graph embedding

Reference 63

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.661294Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation c4e561c6-1196-4bbe-a167-33a5cdf3f7a6 · outbound

This paper cites Shadewatcher: Recommendation-guided cyber threat analysis using system audit records.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Shadewatcher: Recommendation-guided cyber threat analysis using system audit records

Reference 64

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.653064Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 9e7944e7-65e5-4d65-894f-07d4d016cb6c · outbound

This paper cites A Survey of Large Language Models.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models A Survey of Large Language Models

Reference 65

Resolution: unresolved; no resolver link, observed 2026-08-05T12:48:07.410186Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c20d7be6-0d52-471e-aa1e-004deba1e0cd · outbound

This paper cites Attack pattern discovery in forensic inves- tigation of network attacks.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Attack pattern discovery in forensic inves- tigation of network attacks

Reference 66

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.645136Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation d2be9051-687b-4a51-8837-61c68c681660 · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 68

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.637039Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation fd4b94c7-3eda-44ca-8503-e69145080066 · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 69

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.628742Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation eb2c672f-5494-4979-b07a-16728645668b · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 70

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.620451Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 1edb5423-01da-425b-8c05-757af8f3d33c · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 71

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.611827Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 0c48c3c6-1469-4c7c-a5e5-3d747905e3ba · outbound

This paper cites Strictly preserve the original temporal order.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Strictly preserve the original temporal order

Reference 72

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.602086Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 8e3a427b-ba20-4319-9e69-ab4a29588e46 · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 73

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.593664Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 43ca30f1-6b56-4452-a1d8-b0ca31476ac2 · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 74

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.585798Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 57acd3f4-166c-426a-9a2e-9bf0dba643fc · outbound

This paper cites 18 5.evidence_set must fully retain the original log en- tries.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models 18 5.evidence_set must fully retain the original log en- tries

Reference 75

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.575947Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 961782f0-c9fe-47f2-9550-2925ea34090a · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 76

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.567072Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 91595eaa-7e8e-4224-9e43-d953224e29a9 · outbound

This paper cites A.2 Prompt for Causal Reasoning Prompt for Causal Reasoning You are a cyber forensic analyst investigating poten- tial attacks in preprocessed system logs.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models A.2 Prompt for Causal Reasoning Prompt for Causal Reasoning You are a cyber forensic analyst investigating poten- tial attacks in preprocessed system logs

Reference 77

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.557883Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6c32db01-e95f-4a92-8421-9ce618ab31da · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 78

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.548215Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 4a0c8a3e-4017-407e-814e-62db82fe7849 · outbound

This paper cites 3.Infer causality between the current and previous window based on behavioral continuity.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models 3.Infer causality between the current and previous window based on behavioral continuity

Reference 79

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.539658Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 64164020-2bc0-41ed-beb8-3e8639827c05 · outbound

This paper cites 3.Summarize abnormal behaviors and their causal relationships, highlighting how each suspicious entity contributed to the attack progression.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models 3.Summarize abnormal behaviors and their causal relationships, highlighting how each suspicious entity contributed to the attack progression

Reference 80

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.530539Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation beefd86a-2d65-4180-9f36-58f7dba7708f · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 81

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.521374Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 6129fb3d-b32a-42b0-a477-8648a89fab98 · outbound

This paper cites The final report should provide clear forensic evidence for each phase and conclude with a concise explanation of the overall attack chain and its implications for defense.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models The final report should provide clear forensic evidence for each phase and conclude with a concise explanation of the overall attack chain and its implications for defense

Reference 82

Resolution: verified fuzzy; raw_fallback, observed 2026-08-05T12:48:07.512742Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Observation 647f18cd-4095-4cdc-b84d-0f7fc248a68c · outbound

This paper cites an unresolved cited work.

An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models Unresolved cited work

Reference 2025

Resolution: unresolved; raw_fallback, observed 2026-08-05T12:48:07.993286Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.

Coverage vector

Reference resolution

Outbound references

Pith citing papers