Pith. sign in

REVIEW 5 major objections 5 minor 91 references

Attack Effect Model based Malicious Behavior Detection

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read FEAD claims that extracting security-critical monitoring items from attack reports and weighting provenance-graph vertices by attack locality raises detection F1 by 8.23% over existing solutions at 5.4% overhead.

desk verdict A promising monitoring-framework paper whose detection claim rests on an undefined anomaly score S(v), making the headline result unverifiable as published. read the letter →

arxiv 2506.05001 v1 pith:XRCYKE44 submitted 2025-06-05 cs.CR

Limin Wang , Lei Bu , Muzimiao Zhang , Shihong Cang , Kai Ye This is my paper
classification cs.CR
keywords provenancegraphanomalydetectionattackeffectmodelmonitoringitemextractiontaskdecompositionattentionnetworklocalityfalsepositivereduction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that attack detection improves when both data collection and anomaly scoring are focused on the attack itself rather than applied uniformly. FEAD first uses an Attack Effect Model, with a large language model reading online attack reports, to derive a list of security-critical monitoring items; it then decomposes those monitoring tasks across existing collectors; and finally it weights provenance-graph vertices by the locality of suspicious activity before running a graph attention network. The authors report that this focus-based design beats the comparison baseline by 8.23% in average F1-score while adding only 5.4% overhead, and their ablation attributes a 12.63% gain to the monitoring framework and a 9.52% gain to locality awareness. A reader should care because the claim, if true, points to a cheaper route to better detection: monitor what real attacks touch and concentrate analysis where attacks cluster.

What carries the argument

The load-bearing object is the Attack Effect Model, an ordered sequence $T = [(T_1,E_1),\ldots,(T_n,E_n)]$ in which each step $T_i = \langle actor_i, action_i, target_i\rangle$ names who did what to what and $E_i$ names the system impact; each step maps to monitoring items $M_i$. From that model the framework derives 85 monitoring items, represents monitoring capabilities as triples $\langle V_c, O_c, T_c\rangle$, and uses a recursive decomposition algorithm, with a large language model proposing integration logic, to spread monitoring subtasks over existing collectors. For detection, the central mechanism is the vertex feature $h_v = [f_{in}(v) \| f_{out}(v) \| S(v)]$ feeding a two-layer graph attention network; $f_{in}$ and $f_{out}$ are edge-type frequency counts, and $S(v)$ is the anomaly score that carries the locality-aware weighting. A post-processing step computes a benign-density score over the 2-hop neighborhood and corrects isolated anomaly predictions, which is how the framework lowers false positives.

What would settle it

Inspect the implementation of Equation (5) and recompute the reported F1 scores with $S(v)$ removed or set to a constant: if the 8.23% gain disappears, the claimed advantage comes from that score; if $S(v)$ is derived from ground-truth labels or from the baseline detector's output, rerun the comparison on unlabelled graphs to see whether the gain survives.

Watch

Extended reading notes

Core claim

The central claim is that a detection framework built around an Attack Effect Model—an ordered sequence of attack steps, each an actor-action-target triple with a system impact—can identify the monitoring items that real attacks require, deploy those items by decomposing them onto tools that already exist, and then detect attacks with a locality-aware graph attention network. In this design, every provenance-graph vertex carries the feature vector $h_v = [f_{in}(v) \| f_{out}(v) \| S(v)]$, where $f_{in}$ and $f_{out}$ count incoming and outgoing behavior types and $S(v)$ is an anomaly score that concentrates attention on dense clusters of malicious activity. The paper reports that on the five benchmark and two reproduced attack scenarios, this combination reaches an average F1-score of 96.76% versus 88.53% for the comparison baseline, with average false positive rate 0.03% rather than 1.57%, and that the monitoring task decomposition adds only 5.4% CPU overhead.

Load-bearing premise

The load-bearing premise is that the anomaly score $S(v)$ used in every vertex's feature vector is a well-defined quantity that does not already encode the labels the detector is trying to predict, yet the paper points to a section that never defines it.

Editorial extensions

If this is right

  • Security monitoring can be derived systematically from attack reports, closing blind spots such as environment-variable manipulation that system-call tracers miss.
  • New monitoring requirements can often be met by decomposing them onto existing collectors, cutting development effort and overhead instead of adding new modules.
  • Locality-aware vertex weighting can suppress false positives in provenance graphs, since isolated anomalies surrounded by benign nodes are corrected.
  • Across the evaluated scenarios, the combined design achieves an average F1 gain of 8.23 percentage points over the comparison baseline at 5.4% overhead.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If $S(v)$ is obtained from ground-truth labels or from another detector, the reported gains would partly reflect that external signal rather than the locality-aware architecture, so the comparison's fairness depends on an unstated implementation detail.
  • Because monitoring items are extracted from a fixed corpus of reports, attacks whose techniques are absent from that corpus would likely remain blind spots, so the reported coverage and F1 may not transfer to novel attack families.
  • The locality-weighting idea is not tied to the specific graph attention network, so applying it to other provenance-graph detectors would be a cheap way to test whether the precision gains generalize beyond the single baseline compared.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes FEAD, a provenance-based attack detection framework with three components: LLM-based extraction of security monitoring items from attack reports using an Attack Effect Model; a task decomposition mechanism that distributes monitoring subtasks across existing collectors; and locality-aware anomaly detection on provenance graphs using a GAT with vertex features and benign-density post-processing. The authors evaluate on DARPA TC, CSE-CIC-IDS2018, and two custom Log4j/OpenSMTPD datasets, reporting an average 8.23 percentage-point F1 improvement over ThreaTrace and 5.4% overhead, with ablations for the monitoring framework and locality awareness.

Significance. If the claims hold, the framework would be a useful practical contribution: it addresses monitoring blind spots, reuses existing collectors, and provides a concrete detection pipeline. The paper's strengths include the use of public benchmark datasets for the locality ablation, detailed algorithm pseudocode for task decomposition, and a clear attempt to separate monitoring coverage from detection effectiveness. However, the central detection claim is currently not fully verifiable because the vertex feature S(v) in Eq. (5) is undefined, and the headline comparison rests on a single baseline plus two in-house datasets that overlap with the report corpus used to derive the monitoring items. The contribution is therefore conditional on substantial clarification and additional evaluation.

major comments (5)
  1. [Section III-F, Eq. (5)] The feature vector h_v = [f_in(v) || f_out(v) || S(v)] is defined with S(v) as "the anomaly score of node v as described in Section II-A"; however, Section II-A contains no anomaly score definition, and none is supplied elsewhere in the paper. This is load-bearing because the GAT's input includes S(v), so the F1 gains in Table VI and the "with/without locality" ablation in Table VIII cannot be attributed to the locality mechanism without knowing what S(v) is and how it is computed. Please define S(v) precisely, state whether it is computed from labels, from a separate detector, or from the GAT's own output, and if the latter, explain how the training procedure avoids circularity. Until this is provided, the central detection claim is not fully verifiable.
  2. [Section IV-B, Table VI] The headline improvement of 8.23% average F1 is computed against a single baseline (ThreaTrace). Provenance-based detection has multiple published methods, and no variance or error bars are reported. In addition, the two custom datasets are built from Log4j and OpenSMTPD attack scenarios whose monitoring items were extracted from the same report corpus used to derive the FEAD monitoring framework, so their inclusion in the average inflates the apparent gain. Please add at least one or two additional baselines, report per-seed or per-run variance, and present the independent-benchmark results (DARPA TC and CSE-CIC-IDS2018) separately from the custom-scenario results.
  3. [Section IV-C, Table VIII] The "monitoring framework" ablation compares FEAD's custom-collector datasets with and without FEAD monitoring items. Since the test scenarios are the very Log4j/OpenSMTPD attacks from which the monitoring items were derived, the 12.63% F1 improvement is partly a test-set/monitoring-set overlap artifact. The "without monitoring framework" condition also appears to change the data collection, not just the detection algorithm, so the comparison conflates data quality with detector quality. Please evaluate the monitoring framework on attack scenarios that were not used to derive the monitoring items, or otherwise control for this overlap. The DARPA locality ablation is more convincing on this point.
  4. [Section III-F and Section IV-B] The detection protocol is not specified sufficiently for reproduction. The paper does not state how ground-truth anomalous vertices are defined for DARPA TC and CSE-CIC-IDS2018, how benign training graphs are selected, or how the "multi-class classification" labels (predicted entity type vs. actual type) are obtained. Without these details, the reported precision, recall, and F1 values cannot be reproduced. Please provide the exact vertex-label construction, train/test split, and anomaly labeling criteria.
  5. [Section IV-D, Table IX] The deployment-cost evaluation is not adequately specified. The "Baseline" and "Non-FEAD" columns in Table IX are not defined in the text, and the cost-function weights in Section III-D are set by four co-authors and two industry experts via majority voting without sensitivity analysis. Because the headline "5.4% overhead" depends on the chosen task decomposition, please specify the exact baseline environment, describe how "Non-FEAD" is implemented, and provide a sensitivity analysis of the weights.
minor comments (5)
  1. [Section II-C] The phrase "with an study" should be "with a study," and the formatting of "FEAD" is inconsistent in several places.
  2. [Section IV-B] The text states that "Theia" shows up to 9.25% higher F1-scores, but Table VI shows the 9.25-point F1 gap occurs on Trace, not Theia; please correct this data citation.
  3. [Abstract and Section I] The claim of "8.23% higher F1-score" is expressed in percentage points (96.76% vs. 88.53%); please use percentage points consistently to avoid ambiguity.
  4. [Figure 2] The attack report text mentions IP 104.223.34.198, but the surrounding text and figure use 104.223.34.98; please reconcile the IP address.
  5. [Section IV-C] The claim that the two ablations create "multiplicative rather than merely additive" improvement is not demonstrated, since the monitoring-framework ablation and the locality ablation are evaluated on different datasets.

Circularity Check

1 steps flagged · score 6.0 of 10

The monitoring-framework ablation is partly circular: monitoring items are built from the Log4Shell/EnvVar case study and then validated on a Log4j+ENV dataset that reproduces that same case, inflating the headline F1 gain; the DARPA/CSE-CIC results remain independent.

  1. fitted input called prediction [Section III-E (case study) and Section IV-C / Table VIII (monitoring framework ablation)]
    "Consider a Log4Shell zero-to-root attack scenario (Figure 4), where attackers exploit the Log4Shell vulnerability for initial access and then manipulate environment variables (EnvVar) for privilege escalation. A critical monitoring requirement is tracking environment variable modifications. ... Log4j+ENV Attack Dataset: This dataset simulates attacks related to the Log4j vulnerability, covering scenarios like initial access to the target, privilege escalation via environment variables, and the establishment of reverse shell connections."

    The EnvVar modification monitor is constructed from the Log4Shell+EnvVar case study in Section III-E, and the custom Log4j+ENV evaluation dataset is built from the same scenario. Thus Table VIII's 12.63% F1 improvement 'with our monitoring framework' measures whether the framework recognizes the exact attack description used to define the monitoring items. The improvement is an in-sample check of the extraction, not an independent generalization result. Because the custom-dataset rows of Table VI contribute to the claimed 8.23% average F1 gain over ThreaTrace, part of the headline claim reduces to the input reports by construction; the DARPA TC and CSE-CIC-IDS2018 rows are unaffected and remain independent.

full rationale

We identified one partial circularity: the monitoring-framework ablation in Table VIII is validated on attack scenarios that are derived from the same corpus and case study used to generate the monitoring items in Sections III-A and III-E. The paper builds an environment-variable modification monitor from a Log4Shell/PwnKit zero-to-root case study and then evaluates that monitor on a Log4j+ENV dataset containing the same privilege-escalation-via-environment-variables mechanism, so the reported 12.63% F1 improvement is an in-sample match rather than an external prediction. This also contaminates the custom-dataset rows of Table VI, which contribute to the headline 8.23% average improvement over ThreaTrace. We did not score higher because substantial independent evidence remains: the DARPA TC and CSE-CIC-IDS2018 comparisons, the DARPA-based locality ablation, and the overhead measurements do not depend on the attack-report extraction. We also note a serious reproducibility gap: Eq. (5) defines the GAT vertex feature as h_v = [f_in(v) || f_out(v) || S(v)], where S(v) is called 'the anomaly score of node v as described in Section II-A,' but Section II-A defines no anomaly score. Without a definition we cannot establish that S(v) is label-derived or a fed-back model output, so we do not count it as a circular step, but it is a load-bearing unverifiable component of the detection claim.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The framework rests on a modest number of free parameters. The benign density threshold (80%, k=2) directly produces the precision and FPR gains in the locality ablation, so its hand-chosen value is part of the claimed improvement. The cost-function weights (set by expert majority vote) determine the deployment choices behind the 5.4% overhead figure. The largest unaccounted input is the anomaly score S(v) in Eq. (5), which is asserted but never computed. Domain assumptions are standard for this literature: trusted kernel and logs, and the empirical premise that malicious activity clusters in provenance graphs. One ad-hoc assumption is the completeness of the 85 LLM-extracted monitoring items, which also serve as the ground truth for the tool-coverage comparison in Table VII. No new physical or ontological entities are introduced; the attack-effect model and symbolic capability triples are formalisms rather than entities.

free parameters (5)
  • Benign density threshold = 80%
    Post-processing rule in Eq. (9): a vertex whose 2-hop neighborhood is over 80% benign is reclassified as benign. This hand-chosen threshold drives the precision and FPR gains in the locality ablation (Table VIII).
  • Neighborhood radius k = 2
    k in Eq. (9), set to 2 in implementation; the choice is not justified or swept in the evaluation.
  • Cost function weights = alpha=0.2; beta_user=0.7, beta_kernel=0.5, beta_hw=0.3; gamma_user=10, gamma_kernel=25, gamma_hw=50
    Set by majority vote of four co-authors and two industry experts (Section IV). These weights determine which decomposition is chosen as optimal, hence the reported 5.4% overhead and 59,203 LoC.
  • GAT hyperparameters = 2 layers, 8 heads, hidden 128, batch 500, lr 0.01, weight decay 5e-4, dropout 0.5
    Section IV deployment environment; standard choices but not swept, and no variance is reported across runs.
  • LLM temperature = 0.4
    GPT-3.5-16K extraction temperature (Section IV); extraction quality is not quantified against a gold set.
assumptions (6)
  • domain assumption The OS kernel and security monitoring components are trusted and collected provenance data is reliable
    Threat model, Section II-B. Standard for provenance-based detection, inherited from prior work [13]-[19].
  • domain assumption CoT-prompted GPT-3.5 extraction is accurate enough that the derived 85 monitoring items are correct and complete
    Section III-A.2: no human-validated precision or recall of the extraction is reported; completeness is asserted from 260 APT reports and 7,098 ATT&CK cases.
  • ad hoc to paper The 85 extracted monitoring items are the correct benchmark for tool coverage evaluation
    Table VII coverage rates (Auditd 49.40%, Camflow 40.00%) are computed against a ground-truth set defined by the paper's own LLM pipeline; coverage percentages are author-assessed.
  • domain assumption Malicious activities form dense clusters in provenance graphs during active phases and are sparse otherwise
    Section III-F motivates the benign-density post-processing. It is an empirical premise validated only indirectly through the ablation.
  • ad hoc to paper An anomaly score S(v) per vertex exists and is available as a detection input
    Eq. (5) includes S(v) in the feature vector, but no computation is given anywhere; the cross-reference to Section II-A is dangling.
  • domain assumption Custom attack reproductions by two industry experts faithfully represent real Log4j and OpenSMTPD attacks
    Section IV custom datasets; ground-truth labels and reproduction fidelity rest on expert judgment, with no release for independent verification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attack Effect Model based Malicious Behavior Detection." pith.science (2026). https://pith.science/paper/XRCYKE44

@misc{pith2026250605001,
  author       = {Pith},
  title        = {Pith review of: Attack Effect Model based Malicious Behavior Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XRCYKE44}},
  note         = {Machine review of arXiv:2506.05001}
}
read the original abstract

Traditional security detection methods face three key challenges: inadequate data collection that misses critical security events, resource-intensive monitoring systems, and poor detection algorithms with high false positive rates. We present FEAD (Focus-Enhanced Attack Detection), a framework that addresses these issues through three innovations: (1) an attack model-driven approach that extracts security-critical monitoring items from online attack reports for comprehensive coverage; (2) efficient task decomposition that optimally distributes monitoring across existing collectors to minimize overhead; and (3) locality-aware anomaly analysis that leverages the clustering behavior of malicious activities in provenance graphs to improve detection accuracy. Evaluations demonstrate FEAD achieves 8.23% higher F1-score than existing solutions with only 5.4% overhead, confirming that focus-based designs significantly enhance detection performance.

Figures

Figures reproduced from arXiv: 2506.05001 by the authors.

Figure 1
Figure 1. The workflow of FEAD. • A unified monitoring framework that systematically cov￾ers security-relevant operations to eliminate blind spots and enhance the quality of collected data and resulting provenance graphs, thereby improving attack detection accuracy. • A lightweight deployment solution that consolidates es￾sential monitoring capabilities while minimizing resource consumption, enabling organizations to adapt to… view at source ↗
Figure 2
Figure 2. The workflow of monitoring items generation. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The workflow of Lightweight Collaborative Security Monitoring [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: SMART method Log4Shell Zero-to-Root Attack example. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Security-focused monitoring items from real-world attacks. [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

91 extracted references · 72 canonical work pages

  1. [1]

    Lazarus apt continues to exploit log4j vulnerability,

    “Lazarus apt continues to exploit log4j vulnerability,” 2024, https://www. secureworld.io/industry-news/lazarus-continues-exploit-log4j

    2024

  2. [2]

    General, efficient, and real-time data compaction strategy for apt forensic analysis,

    T. Zhu, J. Wang, L. Ruan, C. Xiong, J. Yu, Y . Li, Y . Chen, M. Lv, and T. Chen, “General, efficient, and real-time data compaction strategy for apt forensic analysis,”IEEE TIFS, vol. 16, 2021

    2021

  3. [3]

    Aptshield: A stable, efficient and real-time apt detection system for linux hosts,

    T. Zhu, J. Yu, C. Xiong, W. Cheng, Q. Yuan, J. Ying, T. Chen, J. Zhang, M. Lv, Y . Chenet al., “Aptshield: A stable, efficient and real-time apt detection system for linux hosts,”IEEE TDSC, vol. 20, no. 6, 2023

    2023

  4. [4]

    A systematic literature review of methods and datasets for anomaly-based network intrusion detection,

    Z. Yang, X. Liu, T. Li, D. Wu, J. Wang, Y . Zhao, and H. Han, “A systematic literature review of methods and datasets for anomaly-based network intrusion detection,”Comput. Secur., vol. 116, 2022

    2022

  5. [5]

    Prographer: An anomaly detection system based on provenance graph embedding,

    F. Yang, J. Xu, C. Xiong, Z. Li, and K. Zhang, “Prographer: An anomaly detection system based on provenance graph embedding,” inUSENIX Security ’23, 2023

    2023

  6. [6]

    Airtag: Towards automated attack investigation by unsupervised learning with log texts,

    H. Ding, J. Zhai, Y . Nan, and S. Ma, “Airtag: Towards automated attack investigation by unsupervised learning with log texts,” inUSENIX Security ’23, 2023

    2023

  7. [7]

    auditd(8) - linux man page,

    “auditd(8) - linux man page,” 2024, https://linux.die.net/man/8/auditd

    2024

  8. [8]

    On the forensic validity of approximated audit logs,

    N. Michael, J. Mink, J. Liu, S. Gaur, W. U. Hassan, and A. Bates, “On the forensic validity of approximated audit logs,” inACSAC ’20, 2020

    2020

Show all 91 references
  1. [9]

    Krystal: Knowledge graph-based framework for tactical attack discovery in audit data,

    K. Kurniawan, A. Ekelhart, E. Kiesling, G. Quirchmayr, and A. M. Tjoa, “Krystal: Knowledge graph-based framework for tactical attack discovery in audit data,”Comput. Secur., vol. 121, 2022

    2022

  2. [10]

    eaudit: A fast, scalable and deployable audit data collection system,

    R. Sekar, H. Kimm, and R. Aich, “eaudit: A fast, scalable and deployable audit data collection system,” in2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 3571–3589

    2024

  3. [11]

    Trace: Enterprise-wide provenance tracking for real-time apt detection,

    H. Irshad, G. Ciocarlie, A. Gehani, V . Yegneswaran, K. H. Lee, J. Patel, S. Jha, Y . Kwon, D. Xu, and X. Zhang, “Trace: Enterprise-wide provenance tracking for real-time apt detection,”IEEE TIFS, vol. 16, 2021

    2021

  4. [12]

    Auditbeat: Lightweight shipper for audit data,

    “Auditbeat: Lightweight shipper for audit data,” 2024, https://www. elastic.co/cn/beats/auditbeat

    2024

  5. [13]

    Atlas: A sequence-based learning approach for attack investigation,

    A. Alsaheel, Y . Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, “Atlas: A sequence-based learning approach for attack investigation,” inUSENIX Security ’21, 2021

    2021

  6. [14]

    Alchemist: Fusing application and audit logs for precise attack provenance without instrumentation

    L. Yu, S. Ma, Z. Zhang, G. Tao, X. Zhang, D. Xu, V . E. Urias, H. W. Lin, G. F. Ciocarlie, V . Yegneswaranet al., “Alchemist: Fusing application and audit logs for precise attack provenance without instrumentation.” inNDSS ’21, 2021

    2021

  7. [15]

    Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools,

    F. Dong, S. Li, P. Jiang, D. Li, H. Wang, L. Huang, X. Xiao, J. Chen, X. Luo, Y . Guoet al., “Are we there yet? an industrial viewpoint on provenance-based endpoint detection and response tools,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communica- tions ...

    2023

  8. [16]

    {ATTACK2VEC}: Leveraging temporal word embeddings to understand the evolution of cyberattacks,

    Y . Shen and G. Stringhini, “{ATTACK2VEC}: Leveraging temporal word embeddings to understand the evolution of cyberattacks,” in28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 905–921

    2019

  9. [17]

    Shadewatcher: Recommendation-guided cyber threat analysis using system audit records,

    J. Zengy, X. Wang, J. Liu, Y . Chen, Z. Liang, T.-S. Chua, and Z. L. Chua, “Shadewatcher: Recommendation-guided cyber threat analysis using system audit records,” inS&P ’22. IEEE, 2022

    2022

  10. [18]

    Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning,

    S. Wang, Z. Wang, T. Zhou, H. Sun, X. Yin, D. Han, H. Zhang, X. Shi, and J. Yang, “Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning,”IEEE TIFS, vol. 17, 2022

    2022

  11. [19]

    Unicorn: Runtime provenance-based detector for advanced persistent threats,

    X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” arXiv:2001.01525, 2020

    2001 arXiv

  12. [20]

    Cyber threat intelligence sharing in nigeria,

    M. A. Nainna, J. Bass, and L. Speakman, “Cyber threat intelligence sharing in nigeria,”Communications of the IIMA, vol. 22, no. 1, p. 1, 2024

    2024

  13. [21]

    A literature review on mining cyberthreat intelligence from unstructured texts,

    M. R. Rahman, R. Mahdavi-Hezaveh, and L. Williams, “A literature review on mining cyberthreat intelligence from unstructured texts,” in 2020 International Conference on Data Mining Workshops (ICDMW). IEEE, 2020, pp. 516–525

    2020

  14. [22]

    Omegalog: High-fidelity attack investigation via transparent multi-layer log analy- sis,

    W. U. Hassan, M. A. Noureddine, P. Datta, and A. Bates, “Omegalog: High-fidelity attack investigation via transparent multi-layer log analy- sis,” inNDSS ’20, 2020

    2020

  15. [23]

    Forensic analysis of configuration-based attacks,

    M. A. Inam and W. Ul, “Forensic analysis of configuration-based attacks,” inNDSS ’22, 2022

    2022

  16. [24]

    Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,

    S. M. Milajerdi, B. Eshete, R. Gjomemo, and V . Venkatakrishnan, “Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting,” inCCS ’19, 2019

    2019

  17. [25]

    Combating dependence ex- plosion in forensic analysis using alternative tag propagation semantics,

    M. N. Hossain, S. Sheikhi, and R. Sekar, “Combating dependence ex- plosion in forensic analysis using alternative tag propagation semantics,” inS&P ’20. IEEE, 2020

    2020

  18. [26]

    {CLARION}: Sound and clear provenance tracking for microservice deployments,

    X. Chen, H. Irshad, Y . Chen, A. Gehani, and V . Yegneswaran, “{CLARION}: Sound and clear provenance tracking for microservice deployments,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3989–4006

    2021

  19. [27]

    You are what you do: Hunting stealthy malware via data provenance analysis

    Q. Wang, W. U. Hassan, D. Li, K. Jee, X. Yu, K. Zou, J. Rhee, Z. Chen, W. Cheng, C. A. Gunteret al., “You are what you do: Hunting stealthy malware via data provenance analysis.” inNDSS, 2020

    2020

  20. [28]

    Holmes: real-time apt detection through correlation of suspicious information flows,

    S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V . Venkatakrish- nan, “Holmes: real-time apt detection through correlation of suspicious information flows,” in2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1137–1152

    2019

  21. [29]

    Tactical provenance analysis for endpoint detection and response systems,

    W. U. Hassan, A. Bates, and D. Marino, “Tactical provenance analysis for endpoint detection and response systems,” inS&P ’20. IEEE, 2020

    2020

  22. [30]

    Runtime analysis of whole-system provenance,

    T. Pasquier, X. Han, T. Moyer, A. Bates, O. Hermant, D. Eyers, J. Bacon, and M. Seltzer, “Runtime analysis of whole-system provenance,” inCCS ’18. ACM, 2018

    2018

  23. [31]

    From here to provtopia,

    T. Pasquier, D. Eyers, and M. Seltzer, “From here to provtopia,” in VLDB Workshop on Data Management and Analytics for Medicine and Healthcare. Springer, 2019, pp. 54–67

    2019

  24. [32]

    R-caid: Embedding root cause analysis within provenance-based intrusion detection,

    A. Goyal, G. Wang, and A. Bates, “R-caid: Embedding root cause analysis within provenance-based intrusion detection,” in2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2024, pp. 257–257

    2024

  25. [33]

    Kairos: Practical intrusion detection and investigation using whole- system provenance,

    Z. Cheng, Q. Lv, J. Liang, Y . Wang, D. Sun, T. Pasquier, and X. Han, “Kairos: Practical intrusion detection and investigation using whole- system provenance,” in2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 3533–3551

    2024

  26. [34]

    Dispro- track: Distributed provenance tracking over serverless applications,

    U. Satapathy, R. Thakur, S. Chattopadhyay, and S. Chakraborty, “Dispro- track: Distributed provenance tracking over serverless applications,” in IEEE INFOCOM 2023-IEEE Conference on Computer Communications. IEEE, 2023, pp. 1–10

    2023

  27. [35]

    Cost-effective attack forensics by recording and correlating file system changes,

    L. Yu, Y . Ye, Z. Zhang, and X. Zhang, “Cost-effective attack forensics by recording and correlating file system changes,” in33rd USENIX Se- curity Sym@inproceedingsshen2019attack2vec, title={ATTACK2VEC}: Leveraging temporal word embeddings to understand the evolution of cy- b...

    2019

  28. [36]

    {MAGIC}: Detecting advanced persistent threats via masked graph representation learning,

    Z. Jia, Y . Xiong, Y . Nan, Y . Zhang, J. Zhao, and M. Wen, “{MAGIC}: Detecting advanced persistent threats via masked graph representation learning,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 5197–5214

    2024

  29. [37]

    Pagoda: A hybrid approach to enable efficient realtime provenance based intrusion,

    Y . Xie, D. Feng, and Y . Hu, “Pagoda: A hybrid approach to enable efficient realtime provenance based intrusion,”IEEE Transactions on Dependable and Secure Computing, 17 (6), 2020

    2020

  30. [38]

    Event tracing for windows (etw),

    “Event tracing for windows (etw),” 2024, https://learn. microsoft.com/en-us/windows-hardware/drivers/devtest/ event-tracing-for-windows--etw-

    2024

  31. [39]

    Ratscope: Recording and reconstructing missing rat semantic behaviors for forensic analysis on windows,

    R. Yang, X. Chen, H. Xu, Y . Cheng, C. Xiong, L. Ruan, M. Kavousi, Z. Li, L. Xu, and Y . Chen, “Ratscope: Recording and reconstructing missing rat semantic behaviors for forensic analysis on windows,”IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 3, pp. 162...

    2020

  32. [40]

    Validating the integrity of audit logs against execution reparti- tioning attacks,

    C. Yagemann, M. A. Noureddine, W. U. Hassan, S. Chung, A. Bates, and W. Lee, “Validating the integrity of audit logs against execution reparti- tioning attacks,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 3337–3351

    2021

  33. [41]

    Palant ´ır: Optimizing attack provenance with hardware-enhanced system observability,

    J. Zeng, C. Zhang, and Z. Liang, “Palant ´ır: Optimizing attack provenance with hardware-enhanced system observability,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 3135–3149

    2022

  34. [42]

    Spade: Support for provenance auditing in distributed environments,

    A. Gehani and D. Tariq, “Spade: Support for provenance auditing in distributed environments,” inACM/IFIP/USENIX International Confer- ence on Distributed Systems Platforms and Open Distributed Processing. Springer, 2012, pp. 101–120

    2012

  35. [43]

    Paradise: real-time, generalized, and distributed provenance- based intrusion detection,

    Y . Wu, Y . Xie, X. Liao, P. Zhou, D. Feng, L. Wu, X. Li, A. Wildani, and D. Long, “Paradise: real-time, generalized, and distributed provenance- based intrusion detection,”IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 2, pp. 1624–1640, 2022

    2022

  36. [44]

    Towards reproducible ran- somware analysis,

    S. Hussain, M. Musa, T. Neeshat, R. Batool, O. Ahmed, F. Zaffar, A. Gehani, A. Poggio, and M. K. Yadav, “Towards reproducible ran- somware analysis,” inProceedings of the 16th Cyber Security Experi- mentation and Test Workshop, 2023, pp. 1–9

    2023

  37. [45]

    Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics

    J. Zeng, Z. L. Chua, Y . Chen, K. Ji, Z. Liang, and J. Mao, “Watson: Abstracting behaviors from audit logs via aggregation of contextual semantics.” inNDSS, 2021

    2021

  38. [46]

    Layering in provenance systems,

    K.-K. Muniswamy-Reddy, U. J. Braun, D. A. Holland, P. Macko, D. Maclean, D. W. Margo, M. I. Seltzer, and R. Smogor, “Layering in provenance systems,” inProceedings of the 2009 USENIX Annual Technical Conference (USENIX’09). USENIX Association, 2009

    2009

  39. [47]

    P-gaussian: provenance-based gaussian distribution for detecting intrusion behavior variants using high efficient and real time memory databases,

    Y . Xie, Y . Wu, D. Feng, and D. Long, “P-gaussian: provenance-based gaussian distribution for detecting intrusion behavior variants using high efficient and real time memory databases,”IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 6, pp. 2658–2674, 2019

    2019

  40. [48]

    Pagoda: A hybrid approach to enable efficient real-time provenance based intrusion detection in big data environments,

    Y . Xie, D. Feng, Y . Hu, Y . Li, S. Sample, and D. Long, “Pagoda: A hybrid approach to enable efficient real-time provenance based intrusion detection in big data environments,”IEEE Transactions on Dependable and Secure Computing, vol. 17, no. 6, pp. 1283–1296, 2018

    2018

  41. [49]

    “Sysdig,” https://sysdig.com/, 2025, (Accessed on 02/05/2025)

    2025

  42. [50]

    Back-propagating system dependency impact for attack investigation,

    P. Fang, P. Gao, C. Liu, E. Ayday, K. Jee, T. Wang, Y . F. Ye, Z. Liu, and X. Xiao, “Back-propagating system dependency impact for attack investigation,” inUSENIX Security ’22, 2022

    2022

  43. [51]

    “strace,” https://strace.io/, 2025, (Accessed on 02/05/2025)

    2025

  44. [52]

    {ALASTOR}: Reconstructing the provenance of serverless intrusions,

    P. Datta, I. Polinsky, M. A. Inam, A. Bates, and W. Enck, “{ALASTOR}: Reconstructing the provenance of serverless intrusions,” in31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 2443–2460

    2022

  45. [53]

    Analyzing the hidden danger of environment variables for keeping secrets,

    “Analyzing the hidden danger of environment variables for keeping secrets,” 2022, https://www.trendmicro.com/en hk/research/22/h/ analyzing-hidden-danger-of-environment-variables-for-keeping-secrets. html

    2022

  46. [54]

    Auditbeat reference:,

    “Auditbeat reference:,” 2025, https://www.elastic.co/guide/en/beats/ auditbeat/current/auditbeat-modules.html

    2025

  47. [55]

    Fast memory-efficient anomaly detection in streaming heterogeneous graphs,

    E. Manzoor, S. M. Milajerdi, and L. Akoglu, “Fast memory-efficient anomaly detection in streaming heterogeneous graphs,” inKDD ’16, 2016

    2016

  48. [56]

    Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise,

    F. Liu, Y . Wen, D. Zhang, X. Jiang, X. Xing, and D. Meng, “Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise,”CCS ’19, 2019. [Online]. Available: https://api.semanticscholar.org/CorpusID:207958857

    2019

  49. [57]

    Deeplog: Anomaly detection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V . Srikumar, “Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” inCCS ’17, 2017

    2017

  50. [58]

    Robust log-based anomaly detection on unstable log data,

    X. Zhang, Y . Xu, Q. Lin, B. Qiao, H. Zhang, Y . Dang, C. Xie, X. Yang, Q. Cheng, Z. Liet al., “Robust log-based anomaly detection on unstable log data,” inESEC/FSE ’19, 2019

    2019

  51. [59]

    Graph neural networks in network neuroscience,

    A. Bessadok, M. A. Mahjoub, and I. Rekik, “Graph neural networks in network neuroscience,”IEEE TPAMI, vol. 45, no. 5, 2022

    2022

  52. [60]

    Gadbench: Revisiting and benchmarking supervised graph anomaly detection,

    J. Tang, F. Hua, Z. Gao, P. Zhao, and J. Li, “Gadbench: Revisiting and benchmarking supervised graph anomaly detection,”NeurIPS ’23, vol. 36, 2023

    2023

  53. [61]

    Cybersecurity threat intelligence augmentation and embedding improvement-a healthcare usecase,

    M. Sills, P. Ranade, and S. Mittal, “Cybersecurity threat intelligence augmentation and embedding improvement-a healthcare usecase,” inISI ’20. IEEE, 2020

    2020

  54. [62]

    Sok: Taxonomy of attacks on open-source software supply chains,

    P. Ladisa, H. Plate, M. Martinez, and O. Barais, “Sok: Taxonomy of attacks on open-source software supply chains,” inS&P ’23. IEEE, 2023

    2023

  55. [63]

    Attackg: Constructing technique knowledge graph from cyber threat intelligence reports,

    Z. Li, J. Zeng, Y . Chen, and Z. Liang, “Attackg: Constructing technique knowledge graph from cyber threat intelligence reports,” inESORICS ’22. Springer, 2022

    2022

  56. [64]

    “Snyk,” 2024, https://snyk.io/blog/

    2024

  57. [65]

    Microsoft security intelligence center,

    “Microsoft security intelligence center,” 2024, https://www.microsoft. com/en-us/security/blog/topic/threat-intelligence/

    2024

  58. [66]

    The cybersecurity and infrastructure security agency,

    “The cybersecurity and infrastructure security agency,” 2024, https:// www.cisa.gov/

    2024

  59. [67]

    Homepage of fead,

    “Homepage of fead,” 2024, https://sites.google.com/view/feadx

    2024

  60. [68]

    Att&ck tactics, techniques, and procedures,

    “Att&ck tactics, techniques, and procedures,” 2024, https://attack.mitre. org/matrices/enterprise/

    2024

  61. [69]

    Semi-automatic data enhancement for document-level relation extraction with distant supervision from large language models,

    J. Li, Z. Jia, and Z. Zheng, “Semi-automatic data enhancement for document-level relation extraction with distant supervision from large language models,”arXiv:2311.07314, 2023

    2023 arXiv

  62. [70]

    Umie: Unified multimodal information extraction with instruction tuning,

    L. Sun, K. Zhang, Q. Li, and R. Lou, “Umie: Unified multimodal information extraction with instruction tuning,” inAAAI ’24, vol. 38, no. 17, 2024

    2024

  63. [71]

    Knowprompt: Knowledge-aware prompt-tuning with synergistic optimization for relation extraction,

    X. Chen, N. Zhang, X. Xie, S. Deng, Y . Yao, C. Tan, F. Huang, L. Si, and H. Chen, “Knowprompt: Knowledge-aware prompt-tuning with synergistic optimization for relation extraction,” inWWW ’22, 2022

    2022

  64. [72]

    Survey of hallucination in natural language generation,

    Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y . Xu, E. Ishii, Y . J. Bang, A. Madotto, and P. Fung, “Survey of hallucination in natural language generation,”ACM Comput. Surv., vol. 55, no. 12, 2023

    2023

  65. [73]

    Siren’s song in the ai ocean: a survey on hallucination in large language models,

    Y . Zhang, Y . Li, L. Cui, D. Cai, L. Liu, T. Fu, X. Huang, E. Zhao, Y . Zhang, Y . Chenet al., “Siren’s song in the ai ocean: a survey on hallucination in large language models,”arXiv:2309.01219, 2023

    2023 arXiv

  66. [74]

    Towards revealing the mystery behind chain of thought: a theoretical perspective,

    G. Feng, B. Zhang, Y . Gu, H. Ye, D. He, and L. Wang, “Towards revealing the mystery behind chain of thought: a theoretical perspective,” NeurIPS ’24, vol. 36, 2024

    2024

  67. [75]

    Chain-of-thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V . Le, D. Zhouet al., “Chain-of-thought prompting elicits reasoning in large language models,”NeurIPS ’22, vol. 35, 2022

    2022

  68. [76]

    A survey of chain of thought reasoning: Advances, frontiers and future,

    Z. Chu, J. Chen, Q. Chen, W. Yu, T. He, H. Wang, W. Peng, M. Liu, B. Qin, and T. Liu, “A survey of chain of thought reasoning: Advances, frontiers and future,”arXiv:2309.15402, 2023

    2023 arXiv

  69. [77]

    Graph attention networks,

    “Graph attention networks,” inICLR ’18, 2018

    2018

  70. [78]

    Darpa tc dataset,

    “Darpa tc dataset,” 2024, https://github.com/darpa-i2o/ Transparent-Computing

    2024

  71. [79]

    Cse-cic-ids2018,

    “Cse-cic-ids2018,” 2024, https://www.unb.ca/cic/datasets/ids-2018.html

    2024

  72. [80]

    E-graphsage: A graph neural network based intrusion detection system for iot,

    W. W. Lo, S. Layeghy, M. Sarhan, M. Gallagher, and M. Portmann, “E-graphsage: A graph neural network based intrusion detection system for iot,” inNOMS ’22. IEEE, 2022

    2022

  73. [81]

    How effective are neural networks for fixing security vulnerabilities,

    Y . Wu, N. Jiang, H. V . Pham, T. Lutellier, J. Davis, L. Tan, P. Babkin, and S. Shah, “How effective are neural networks for fixing security vulnerabilities,” inISSTA ’23, 2023

    2023

  74. [82]

    Exploiting library vulnerability via migration based automating test generation,

    Z. Chen, X. Hu, X. Xia, Y . Gao, T. Xu, D. Lo, and X. Yang, “Exploiting library vulnerability via migration based automating test generation,” in ICSE ’24, 2024

    2024

  75. [83]

    Sok: A comprehensive analysis and evaluation of docker container attack and defense mechanisms,

    M. S. Haq, T. D. Nguyen, A. S ¸. Tosun, F. V ollmer, T. Korkmaz, and A.- R. Sadeghi, “Sok: A comprehensive analysis and evaluation of docker container attack and defense mechanisms,” inS&P ’24. IEEE, 2024

    2024

  76. [84]

    Vulzoo: A comprehensive vulnerability intelligence dataset,

    B. Ruan, J. Liu, W. Zhao, and Z. Liang, “Vulzoo: A comprehensive vulnerability intelligence dataset,”arXiv:2406.16347, 2024

    2024 arXiv

  77. [85]

    Research on automated anomaly localization in the power internet of things based on fuzzing and semantic analysis,

    G. Wang, W. Zhang, L. Yan, L. Tang, H. Qu, K. Liu, Y . Zhao, and H. Li, “Research on automated anomaly localization in the power internet of things based on fuzzing and semantic analysis,” inIoTML ’23, vol. 12937. SPIE, 2023

    2023

  78. [86]

    Evaluation of reinforcement learning for autonomous penetration test- ing using a3c, q-learning and dqn,

    N. Becker, D. Reti, E. V . Ntagiou, M. Wallum, and H. D. Schotten, “Evaluation of reinforcement learning for autonomous penetration test- ing using a3c, q-learning and dqn,”arXiv:2407.15656, 2024

    2024 arXiv

  79. [87]

    Azure openai service,

    “Azure openai service,” 2024, https://azure.microsoft.com/en-us/ products/ai-services/openai-service

    2024

  80. [88]

    Spec2006,

    “Spec2006,” 2024, https://www.spec.org/cpu2006/

    2024

  81. [89]

    A reusable characteriza- tion of the memory system behavior of spec2017 and spec2006,

    M. Hassan, C. H. Park, and D. Black-Schaffer, “A reusable characteriza- tion of the memory system behavior of spec2017 and spec2006,”ACM TACO, vol. 18, no. 2, 2021

    2021

  82. [90]

    Stream benchmark,

    “Stream benchmark,” 2024, https://www.amd.com/en/developer/ zen-software-studio/applications/spack/stream-benchmark.html

    2024

  83. [91]

    On the memory underutilization: Exploring disaggregated memory on hpc systems,

    I. Peng, R. Pearce, and M. Gokhale, “On the memory underutilization: Exploring disaggregated memory on hpc systems,” inSBAC-PAD ’20. IEEE, 2020

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.