{"total":20,"rows":[{"id":"2510.15188","title":"OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs","created":"2025-10-16","cited_by_count":6,"area":null},{"id":"2503.03108","title":"OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting","created":"2025-03-05","cited_by_count":3,"area":null},{"id":"2504.07839","title":"Deep Learning-based Intrusion Detection Systems: A Survey","created":"2025-04-10","cited_by_count":2,"area":null},{"id":"2606.10281","title":"Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations","created":"2026-06-09","cited_by_count":2,"area":null},{"id":"2405.04691","title":"Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Search","created":"2024-05-07","cited_by_count":1,"area":null},{"id":"2507.20967","title":"PROVCREATOR: Synthesizing Complex Heterogenous Graphs with Node and Edge Attributes","created":"2025-07-28","cited_by_count":1,"area":null},{"id":"2601.22983","title":"PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systems","created":"2026-01-30","cited_by_count":1,"area":null},{"id":"2605.21773","title":"HIDBench: Benchmarking Large Language Models for Host-Based Intrusion Detection","created":"2026-05-20","cited_by_count":1,"area":null},{"id":"2406.05362","title":"RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learning","created":"2024-06-08","cited_by_count":0,"area":null},{"id":"2501.02981","title":"CONTINUUM: Detecting APT Attacks through Spatial-Temporal Graph Neural Networks","created":"2025-01-06","cited_by_count":0,"area":null},{"id":"2512.18199","title":"PROVEX: Enhancing SOC Analyst Trust with Explainable Provenance-Based IDS","created":"2025-12-20","cited_by_count":0,"area":null},{"id":"2603.17100","title":"An End-to-End Framework for Functionality-Embedded Provenance Graph Construction and Threat Interpretation","created":"2026-03-17","cited_by_count":0,"area":null},{"id":"2605.07812","title":"GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification","created":"2026-05-08","cited_by_count":0,"area":null},{"id":"2607.20832","title":"Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models","created":"2026-07-23","cited_by_count":0,"area":null},{"id":"2608.01454","title":"How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection","created":"2026-08-02","cited_by_count":0,"area":null},{"id":"2608.02518","title":"Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation","created":"2026-08-03","cited_by_count":0,"area":null},{"id":"2608.15012","title":"SysEvolve: An AI-native, safe, autonomous adversarial attack-defense co-evolutionary system","created":"2026-08-15","cited_by_count":0,"area":null},{"id":"2609.12841","title":"A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK","created":"2026-09-11","cited_by_count":0,"area":null},{"id":"2609.16462","title":"Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection","created":"2026-09-15","cited_by_count":0,"area":null},{"id":"2609.38954","title":"APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetry","created":"2026-09-30","cited_by_count":0,"area":null}],"next_cursor":null}