# HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows

arXiv: https://arxiv.org/abs/1810.01594 · HTML: https://mlsanity.com/paper/1810.01594/

## Key facts

- Cited by 43 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Oct 2018.

## Built on by (most cited first, 30 of 43)

- [Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems](https://mlsanity.com/paper/2401.05778/) (2024)
- [Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance](https://mlsanity.com/paper/2308.05034/) (2023)
- [threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning](https://mlsanity.com/paper/2111.04333/) (2021)
- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning](https://mlsanity.com/paper/2402.15147/) (2024)
- [OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs](https://mlsanity.com/paper/2510.15188/) (2025)
- [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://mlsanity.com/paper/2605.06812/) (2026)
- [On the Security Risks of Knowledge Graph Reasoning](https://mlsanity.com/paper/2305.02383/) (2023)
- [Reinforcement Learning for Industrial Control Network Cyber Security Orchestration](https://mlsanity.com/paper/2106.05332/) (2021)
- [ANUBIS: A Provenance Graph-Based Framework for Advanced Persistent Threat Detection](https://mlsanity.com/paper/2112.11032/) (2021)
- [OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting](https://mlsanity.com/paper/2503.03108/) (2025)
- [Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systems](https://mlsanity.com/paper/2601.15678/) (2026)
- [Enabling Efficient Attack Investigation via Human-in-the-Loop Security Analysis](https://mlsanity.com/paper/2211.05403/) (2022)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [Deep Learning-based Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2504.07839/) (2025)
- [AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devices](https://mlsanity.com/paper/2510.19462/) (2025)
- [Evidential Cyber Threat Hunting](https://mlsanity.com/paper/2104.10319/) (2021)
- [TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph](https://mlsanity.com/paper/2304.02838/) (2023)
- [Interpreting GNN-based IDS Detections Using Provenance Graph Structural Features](https://mlsanity.com/paper/2306.00934/) (2023)
- [Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Search](https://mlsanity.com/paper/2405.04691/) (2024)
- [PIDSMaker: Building and Evaluating Provenance-based Intrusion Detection Systems](https://mlsanity.com/paper/2601.22983/) (2026)
- [LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations](https://mlsanity.com/paper/2604.05440/) (2026)
- [Observability for Delegated Execution in Agentic AI Systems](https://mlsanity.com/paper/2606.09692/) (2026)
- [Role-based lateral movement detection with unsupervised learning](https://mlsanity.com/paper/2108.02713/) (2021)
- [A Heterogeneous Graph Learning Model for Cyber-Attack Detection](https://mlsanity.com/paper/2112.08986/) (2021)
- [LogShield: A Transformer-based APT Detection System Leveraging Self-Attention](https://mlsanity.com/paper/2311.05733/) (2023)
- [RAPID: Robust APT Detection and Investigation Using Context-Aware Deep Learning](https://mlsanity.com/paper/2406.05362/) (2024)
- [Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries](https://mlsanity.com/paper/2502.05367/) (2025)
- [Modeling Behavioral Preferences of Cyber Adversaries Using Inverse Reinforcement Learning](https://mlsanity.com/paper/2505.03817/) (2025)

## Abstract (arXiv)

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a nutshell, HOLMES aims to produce a detection signal that indicates the presence of a coordinated set of activities that are part of an APT campaign. One of the main challenges addressed by our approach involves developing a suite of techniques that make the detection signal robust and reliable. At a high-level, the techniques we develop effectively leverage the correlation between suspicious information flows that arise during an attacker campaign. In addition to its detection capability, HOLMES is also able to generate a high-level graph that summarizes the attacker's actions in real-time. This graph can be used by an analyst for an effective cyber response. An evaluation of our approach against some real-world APTs indicates that HOLMES can detect APT campaigns with high precision and low false alarm rate. The compact high-level graphs produced by HOLMES effectively summarizes an ongoing attack campaign and can assist real-time cyber-response operations.