Provenance system uses lllm to track cyberattacks with context and state
Know the Normal, Track the Attack: Context-Grounded and Stateful LLM Investigation over System Provenance
Cryptography and Security
Summary
Cyberattacks leave behind many clues in system logs, but it can be hard to tell what’s normal and what’s suspicious, and how different clues fit together into an attack story. The authors present ANCHOR, a system that helps investigate attacks by combining clues with knowledge about normal computer behavior and prior findings. It uses a large language model (LLM) to link evidence across time and organize it by attack stages, improving accuracy in identifying malicious actions. They tested ANCHOR on real datasets from multiple operating systems and found it better recovers attack indicators and sequences than existing methods.
What this means in practice
- •For security operations teams: Improve cyberattack investigations by automatically organizing and tracking suspicious events over time with context-aware evidence linking.
- •For cloud security engineers: Monitor and analyze cloud system audit logs more accurately by incorporating environment-specific normal behavior and cross-window attack state.
Authors
Lijie Zheng, Ji He, Ying Wang, Huang Zhang, Yulong Shen
Abstract
Provenance-based intrusion detection systems (PIDSs) identify suspicious activity in audit streams, but their outputs remain difficult to turn into coherent attack narratives. Direct LLM analyses of local anomalous subgraphs lack deployment-specific normal-behavior knowledge and validated attack state across evidence fragments. This can cause unsupported attack interpretations of routine activities and incorrect attribution of temporally dispersed evidence to attack stages. We present ANCHOR, an investigation-oriented provenance system that combines evidence curation with context-grounded LLM reasoning. It calibrates anomaly judgments by relation type and links anomalous windows through rare relation-role patterns. The resulting evidence queues preserve causal structure, temporal boundaries, and cross-window continuity. The investigator interprets process-centered evidence using two complementary forms of context. Deployment Context combines environment-specific interaction and object baselines with high-risk security knowledge. Case Context uses a confidence-gated Attack-Tracking Cache to maintain investigation state across windows. Correlating current evidence with high-confidence prior findings, ANCHOR incrementally reconstructs attack narratives organized by kill-chain stages. We evaluate ANCHOR on six DARPA Transparent Computing E3/E5 datasets across three operating systems. Controlled evidence-level and end-to-end comparisons show improved overall IoC recovery and attack-stage attribution over state-of-the-art provenance-based baselines. These gains persist under a fixed LLM backbone in our evaluation. ANCHOR processes a full audit day at dollar-level API cost, supporting practical, context-grounded investigation across windows.