# SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

arXiv: https://arxiv.org/abs/1801.02062 · HTML: https://mlsanity.com/paper/1801.02062/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jan 2018.

## Built on by (most cited first, 28 of 28)

- [Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance](https://mlsanity.com/paper/2308.05034/) (2023)
- [threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning](https://mlsanity.com/paper/2111.04333/) (2021)
- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [EXTRACTOR: Extracting Attack Behavior from Threat Reports](https://mlsanity.com/paper/2104.08618/) (2021)
- [ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation](https://mlsanity.com/paper/2507.14201/) (2025)
- [A Rule Mining-Based Advanced Persistent Threats Detection System](https://mlsanity.com/paper/2105.10053/) (2021)
- [TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning](https://mlsanity.com/paper/2402.15147/) (2024)
- [OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs](https://mlsanity.com/paper/2510.15188/) (2025)
- [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://mlsanity.com/paper/2605.06812/) (2026)
- [ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detection](https://mlsanity.com/paper/2112.11032/) (2021)
- [OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting](https://mlsanity.com/paper/2503.03108/) (2025)
- [DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction](https://mlsanity.com/paper/2608.03591/) (2026)
- [Deep Learning-based Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2504.07839/) (2025)
- [Evidential Cyber Threat Hunting](https://mlsanity.com/paper/2104.10319/) (2021)
- [Principled Data-Driven Decision Support for Cyber-Forensic Investigations](https://mlsanity.com/paper/2211.13345/) (2022)
- [TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph](https://mlsanity.com/paper/2304.02838/) (2023)
- [PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systems](https://mlsanity.com/paper/2601.22983/) (2026)
- [Observability for Delegated Execution in Agentic AI Systems](https://mlsanity.com/paper/2606.09692/) (2026)
- [A Heterogeneous Graph Learning Model for Cyber-Attack Detection](https://mlsanity.com/paper/2112.08986/) (2021)
- [RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learning](https://mlsanity.com/paper/2406.05362/) (2024)
- [DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysis](https://mlsanity.com/paper/2509.26562/) (2025)
- [RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection](https://mlsanity.com/paper/2602.02929/) (2026)
- [TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences](https://mlsanity.com/paper/2606.18651/) (2026)
- [Minos: A Multi-Agent Collaborative Framework for Provenance-Based Backward Tracking](https://mlsanity.com/paper/2607.00440/) (2026)
- [How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection](https://mlsanity.com/paper/2608.01454/) (2026)
- [BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense](https://mlsanity.com/paper/2609.11852/) (2026)
- [Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection](https://mlsanity.com/paper/2609.16462/) (2026)
- [CyberClear: A Benchmark for LLM Agent Systems on APT Attack Chain Provenance](https://mlsanity.com/paper/2609.32424/) (2026)

## Abstract (arXiv)

We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team's attacks on hosts running Windows, FreeBSD and Linux.