Huang Zhang

Know the Normal, Track the Attack: Context-Grounded and Stateful LLM Investigation over System Provenance

Provenance-based intrusion detection systems (PIDSs) identify suspicious activity in audit streams, but their outputs remain difficult to turn into coherent attack narratives. Direct LLM analyses of local anomalous subgraphs lack deployment-specific normal-behavior knowledge and validated attack state across evidence f...