DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense
2026-07-27 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors developed DeepFaith, a system that turns complex data from advanced cyberattack defenses into easy-to-understand reports for human analysts. Unlike typical AI reports that might include mistakes or unsupported claims, DeepFaith ensures every statement is backed by actual evidence from the defense system. Their tests showed that DeepFaith produces more accurate, consistent, and trustworthy reports than previous methods, making it easier for security teams to understand and act on threats.
Advanced Persistent Threatsprovenance graphslarge language modelsevidence-grounded generationfaithfulness in AIincident reportingcybersecurityexplainabilitytemporal consistency
Authors
Trung V. Phan, Tri Gia Nguyen, Thomas Bauschert
Abstract
Advanced Persistent Threats (APTs) are difficult to detect and interpret due to their multi-stage and stealthy nature. While recent autonomous defense systems leverage provenance graphs and learning-based models for detection and mitigation, their outputs remain largely machine-oriented and difficult for analysts to interpret. Large language models (LLMs) offer a promising interface for report generation, but often produce hallucinated or weakly grounded content. In this paper, we propose DeepFaith, an evidence-grounded framework for faithful incident reporting in multi-stage APT defense. DeepFaith transforms structured outputs from autonomous defense and explainability modules into natural-language reports that are explicitly aligned with underlying system evidence. The framework integrates a unified evidence representation, evidence-grounded prompting, faithfulness-aware generation, and post-generation verification to ensure that all generated statements are supported. Experiments in a realistic enterprise testbed demonstrate that DeepFaith improves faithfulness from 0.68 to 0.92, reduces unsupported claims from 0.32 to 0.08, and increases temporal consistency from 0.6 to 0.88, while maintaining concise reports and lower error rates than existing template-based and LLM-based solutions. These results show that evidence-grounded generation enables reliable, interpretable, and actionable reporting for security operations centers.