mlsanityData to 14 Oct 2026

ProveRAG: Provenance-Driven Vulnerability Analysis with Automated Retrieval-Augmented LLMs

arXiv 2410.17406 ↗First posted 22 Oct 2024cs.CR cs.IRcited by 6

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

In cybersecurity, security analysts constantly face the challenge of mitigating newly discovered vulnerabilities in real-time, with over 300,000 vulnerabilities identified since 1999. The sheer volume of known vulnerabilities complicates the detection of patterns for unknown threats. While LLMs can assist, they often hallucinate and lack alignment with recent threats. Over 40,000 vulnerabilities have been identified in 2024 alone, which are introduced after most popular LLMs' (e.g., GPT-5) training data cutoff. This raises a major challenge of leveraging LLMs in cybersecurity, where accuracy and up-to-date information are paramount. Therefore, we aim to improve the adaptation of LLMs in vulnerability analysis by mimicking how an analyst performs such tasks. We propose ProveRAG, an LLM-powered system designed to assist in rapidly analyzing vulnerabilities with automated retrieval augmentation of web data while self-evaluating its responses with verifiable evidence. ProveRAG incorporates a self-critique mechanism to help alleviate the omission and hallucination common in the output of LLMs applied in cybersecurity applications. The system cross-references data from verifiable sources (NVD and CWE), giving analysts confidence in the actionable insights provided. Our results indicate that ProveRAG excels in delivering verifiable evidence to the user with over 99% and 97% accuracy in exploitation and mitigation strategies, respectively. ProveRAG guides analysts to secure their systems more effectively by overcoming temporal and context-window limitations while also documenting the process for future audits.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 26 of its 44 references that are in the map. First posted on arXiv 22 Oct 2024.

Builds on

26 of 44 references.

References · 26

  1. 2017Attention Is All You Needcited by 60,361
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
  4. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,455
  5. 2023A Survey of Large Language Modelscited by 2,576
  6. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
  7. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
  8. 2021Improving language models by retrieving from trillions of tokenscited by 1,293
  9. 2023Active Retrieval Augmented Generationcited by 516
  10. 2021Recent Advances in Natural Language Processing via Large Pre-Trained Language Models: A Surveycited by 463
  11. 2024Adaptive-RAG: Learning to Adapt Retrieval-Augmented Large Language Models through Question Complexitycited by 451
  12. 2023From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacycited by 143
14 more
  1. 2023The Troubling Emergence of Hallucination in Large Language Models -- An Extensive Definition, Quantification, and Prescriptive Remediationscited by 131
  2. 2023LLMs for Knowledge Graph Construction and Reasoning: Recent Capabilities and Future Opportunitiescited by 97
  3. 2023LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarkscited by 97
  4. 2024Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAGcited by 68
  5. 2024SuRe: Summarizing Retrievals using Answer Candidates for Open-domain QA of LLMscited by 67
  6. 2023Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilitiescited by 59
  7. 2023LogGPT: Exploring ChatGPT for Log-Based Anomaly Detectioncited by 35
  8. 2023Evaluation of ChatGPT Model for Vulnerability Detectioncited by 33
  9. 2023Using Captum to Explain Generative Language Modelscited by 33
  10. 2024TC-RAG:Turing-Complete RAG's Case study on Medical LLM Systemscited by 28
  11. 2024Is Your LLM Outdated? A Deep Look at Temporal Generalizationcited by 26
  12. 2024LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledgecited by 22
  13. 2023Benchmarking Large Language Models for Log Analysis, Security, and Interpretationcited by 19
  14. 2023AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generationcited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 3.

6 papers.

  1. 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
  2. 2025LLM-based Multi-class Attack Analysis and Mitigation Framework in IoT/IIoT Networkscited by 1
  3. 2025RAG-targeted Adversarial Attack on LLM-based Threat Detection and Mitigation Frameworkcited by 0
  4. 2026Tug-of-War within A Decade: Conflict Resolution in Vulnerability Analysis via Teacher-Guided Retrieval-Augmented Generationscited by 0
  5. 2026NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturingcited by 0
  6. 2026Mapping the RAG Landscape: A Four Axis Taxonomy of Efficiency, Defense, Interactivity, and Reasoningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Retrieval-Augmented LLMs for Security Incident Analysis
  2. 2026VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection
  3. 2025LLM-driven Provenance Forensics for Threat Investigation and Detection
  4. 2025LLM Embedding-based Attribution (LEA): Quantifying Source Contributions to Generative Model's Response for Vulnerability Analysis
  5. 2025Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?
  6. 2025Reasoning with LLMs for Zero-Shot Vulnerability Detection
  7. 2025LLMpatronous: Harnessing the Power of LLMs For Vulnerability Detection
  8. 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation