mlsanityData to 7 Oct 2026

HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows

arXiv 1810.01594 ↗First posted 3 Oct 2018cs.CRcited by 43

Not on the map. Why?

Abstract (arXiv)

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a nutshell, HOLMES aims to produce a detection signal that indicates the presence of a coordinated set of activities that are part of an APT campaign. One of the main challenges addressed by our approach involves developing a suite of techniques that make the detection signal robust and reliable. At a high-level, the techniques we develop effectively leverage the correlation between suspicious information flows that arise during an attacker campaign. In addition to its detection capability, HOLMES is also able to generate a high-level graph that summarizes the attacker's actions in real-time. This graph can be used by an analyst for an effective cyber response. An evaluation of our approach against some real-world APTs indicates that HOLMES can detect APT campaigns with high precision and low false alarm rate. The compact high-level graphs produced by HOLMES effectively summarizes an ongoing attack campaign and can assist real-time cyber-response operations.

Key facts. Cited by 43 papers in the map (data through 7 Oct 2026). First posted on arXiv 3 Oct 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 1; 2023: 7; 2024: 5; 2025: 9; 2026: 15.

43 papers.

Sort:

By area:

  1. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
  2. 2023Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenancecited by 30
  3. 2021threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learningcited by 22
  4. 2023MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learningcited by 20
  5. 2023SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detectioncited by 13
  6. 2024TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learningcited by 6
  7. 2025OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMscited by 6
  8. 2023On the Security Risks of Knowledge Graph Reasoningcited by 5
  9. 2026Towards Security-Auditable LLM Agents: A Unified Graph Representationcited by 4
  10. 2021Reinforcement Learning for Industrial Control Network Cyber Security Orchestrationcited by 3
  11. 2021ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detectioncited by 3
  12. 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
31 more
  1. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  2. 2022Enabling Efficient Attack Investigation via Human-in-the-Loop Security Analysiscited by 2
  3. 2025Deep Learning-based Intrusion Detection Systems: A Surveycited by 2
  4. 2021Evidential Cyber Threat Huntingcited by 1
  5. 2023TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graphcited by 1
  6. 2023Interpreting GNN-based IDS Detections Using Provenance Graph Structural Featurescited by 1
  7. 2024Mining Temporal Attack Patterns from Cyberthreat Intelligence Reportscited by 1
  8. 2025AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devicescited by 1
  9. 2026PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systemscited by 1
  10. 2026LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operationscited by 1
  11. 2026Observability for Delegated Execution in Agentic AI Systemscited by 1
  12. 2021Role-based lateral movement detection with unsupervised learningcited by 0
  13. 2021A Heterogeneous Graph Learning Model for Cyber-Attack Detectioncited by 0
  14. 2023LogShield: A Transformer-based APT Detection System Leveraging Self-Attentioncited by 0
  15. 2024Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Searchcited by 0
  16. 2024RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learningcited by 0
  17. 2025Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summariescited by 0
  18. 2025Modeling Behavioral Preferences of Cyber Adversaries Using Inverse Reinforcement Learningcited by 0
  19. 2025DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysiscited by 0
  20. 2025A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detectioncited by 0
  21. 2025PROVEX: Enhancing SOC Analyst Trust with Explainable Provenance-Based IDScited by 0
  22. 2026GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classificationcited by 0
  23. 2026GenAI-Driven Threat Detection with Microsoft Security Copilotcited by 0
  24. 2026Certified Causal Attribution for Real-Time Attack Forensics in 6G Network Slicingcited by 0
  25. 2026TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequencescited by 0
  26. 2026How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detectioncited by 0
  27. 2026BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defensecited by 0
  28. 2026Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detectioncited by 0
  29. 2026On the Effectiveness of Kernel-Level Evidence for Agent Securitycited by 0
  30. 2026CyberClear: A Benchmark for LLM Agent Systems on APT Attack Chain Provenancecited by 0
  31. 2026APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetrycited by 0