# Evidential Cyber Threat Hunting

arXiv: https://arxiv.org/abs/2104.10319 · HTML: https://mlsanity.com/paper/2104.10319/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 21 references that are in the map.
- First posted on arXiv 21 Apr 2021.

## Builds on (most cited first, 4 of 4)

- [UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats](https://mlsanity.com/paper/2001.01525/) (2020)
- [HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows](https://mlsanity.com/paper/1810.01594/) (2018)
- [SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data](https://mlsanity.com/paper/1801.02062/) (2018)
- [Towards an Open Format for Scalable System Telemetry](https://mlsanity.com/paper/2101.10474/) (2021)

## Built on by (most cited first, 1 of 1)

- [Using a Collated Cybersecurity Dataset for Machine Learning and Artificial Intelligence](https://mlsanity.com/paper/2108.02618/) (2021)

## Abstract (arXiv)

A formal cyber reasoning framework for automating the threat hunting process is described. The new cyber reasoning methodology introduces an operational semantics that operates over three subspaces -- knowledge, hypothesis, and action -- to enable human-machine co-creation of threat hypotheses and protective recommendations. An implementation of this framework shows that the approach is practical and can be used to generalize evidence-based multi-criteria threat investigations.