mlsanityData to 7 Oct 2026

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

arXiv 1801.02062 ↗First posted 6 Jan 2018cs.CRcited by 28

Not on the map. Why?

Abstract (arXiv)

We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team's attacks on hosts running Windows, FreeBSD and Linux.

Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Jan 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 1; 2023: 3; 2024: 2; 2025: 5; 2026: 11.

28 papers.

Sort:

By area:

  1. 2023Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenancecited by 30
  2. 2021threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learningcited by 22
  3. 2023MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learningcited by 20
  4. 2021EXTRACTOR: Extracting Attack Behavior from Threat Reportscited by 19
  5. 2025ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigationcited by 15
  6. 2021A Rule Mining-Based Advanced Persistent Threats Detection Systemcited by 8
  7. 2024TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learningcited by 6
  8. 2025OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMscited by 6
  9. 2026Towards Security-Auditable LLM Agents: A Unified Graph Representationcited by 4
  10. 2021ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detectioncited by 3
  11. 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
  12. 2026DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstructioncited by 3
16 more
  1. 2025Deep Learning-based Intrusion Detection Systems: A Surveycited by 2
  2. 2021Evidential Cyber Threat Huntingcited by 1
  3. 2022Principled Data-Driven Decision Support for Cyber-Forensic Investigationscited by 1
  4. 2023TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graphcited by 1
  5. 2026PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systemscited by 1
  6. 2026Observability for Delegated Execution in Agentic AI Systemscited by 1
  7. 2021A Heterogeneous Graph Learning Model for Cyber-Attack Detectioncited by 0
  8. 2024RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learningcited by 0
  9. 2025DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysiscited by 0
  10. 2026RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detectioncited by 0
  11. 2026TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequencescited by 0
  12. 2026Minos: A Multi-Agent Collaborative Framework for Provenance-Based Backward Trackingcited by 0
  13. 2026How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detectioncited by 0
  14. 2026BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defensecited by 0
  15. 2026Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detectioncited by 0
  16. 2026CyberClear: A Benchmark for LLM Agent Systems on APT Attack Chain Provenancecited by 0