arXiv AI

Topological Attribution Distance (TAD): Revealing Segment-Level RAG Influence on LLM Output Geometry for Incident Log Analysis

arXiv:2608. 16775v1 Announce Type: cross Abstract: Large Language Models (LLMs) are increasingly being deployed in cybersecurity operations to assist cybersecurity analysts with rapid decision-making against emerging threats.

arXiv Computation and Language

Aug 31

BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence

arXiv:2608.28394v1 Announce Type: cross Abstract: Cyber threat intelligence (CTI) is foundational to modern cyber defense, yet much of it resides in unstructured reports whose volume and heterogeneit...

By Changze Li, Yutong Cheng, Tsania Camila Finnisa, Qian Cui, Wei Ding, Peng Gao

llms benchmarks safety

arXiv AI

Jun 16

From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents

arXiv:2606. 04990v2 Announce Type: replace-cross Abstract: Large language model (LLM)-based agents are evolving from passive text generators into autonomous systems capable of planning, tool use, retrieval, memory access, environmental interaction, and multi-agent collaboration.

By Yiqi Wang, Jiaqi Zhang, Taotao Cai, Zirui Liu, Qingqiang Sun, Zequn Sun, Zhangkai Wu, Manqing Dong, Mingkai Zhang, Xuefei Yin, Yanming Zhu

llms agents benchmarks safety

arXiv AI

Jul 28

TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs

arXiv:2607. 24563v1 Announce Type: new Abstract: Security Operations Centers increasingly rely on automated mapping of Cyber Threat Intelligence reports to MITRE ATT&CK, yet extractor outputs remain fallible and are often stored without the evidence, provenance, and validation history needed to decide whether an individual mapping should be trusted.

By Federico Valletta, Giacomo Longo, Enrico Russo, Alessio Merlo

arXiv AI

Jul 21

Is "Knowing It's Malicious Enough?" Evaluating LLMs for Fine-Grained Malware Behavior Auditing

arXiv:2509. 14335v2 Announce Type: replace-cross Abstract: Automated malware classifiers achieve strong detection performance, but auditing requires more than flagging a sample: analysts must explain malicious behaviors and justify them with code evidence.

By Xinran Zheng, Xingzhi Qian, Yiling He, Shuo Yang, Lorenzo Cavallaro

llms agents benchmarks

arXiv AI

Jul 23

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

arXiv:2607. 19742v1 Announce Type: cross Abstract: Cyber Threat Intelligence (CTI) reports richly describe real-world attack processes, but their unstructured narratives cannot be directly used for automated attack-path reasoning.

By Wenbo Hou, Ning Hu, Xueping Wang, Jiahao Gu, Wenjian Luo

llms

arXiv AI

Jun 4

From Agent Traces to Trust: Evidence Tracing and Execution Provenance in LLM Agents

arXiv:2606. 04990v1 Announce Type: cross Abstract: Large language model (LLM)-based agents increasingly solve complex tasks by interacting with external tools, retrieval systems, memory modules, environments, and other agents.

By Yiqi Wang, Jiaqi Zhang, Taotao Cai, Zirui Liu, Qingqiang Sun, Zequn Sun, Zhangkai Wu, Mingkai Zhang, Yanming Zhu

llms agents benchmarks safety

arXiv AI

Jul 28

DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense

arXiv:2607. 24348v1 Announce Type: cross Abstract: Advanced Persistent Threats (APTs) are difficult to detect and interpret due to their multi-stage and stealthy nature.

By Trung V. Phan, Tri Gia Nguyen, Thomas Bauschert

llms agents

arXiv AI

Aug 5

DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction

arXiv:2608. 03591v1 Announce Type: cross Abstract: Large Language Model (LLM) agents offer a promising approach to attack chain reconstruction by retrieving and interpreting heterogeneous telemetry to infer ordered attacker actions.

By Xuyang Liu, Yibin Han, Zhenwei Zhang, Kai Chang, Zhiwei Xu, Tian Qiu, Weixian Deng, Jiabao Gao, Xiaolin Peng, Hai Wan, Xibin Zhao

llms rag agents benchmarks

arXiv Machine Learning

Jun 17

Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation

arXiv:2606. 18190v1 Announce Type: cross Abstract: Multi-stage cyberattacks span system, network, and browser logs.

By Abir Ashab Niloy, Ahmed Ryan, Imamul Hossain Rafi, Md Erfan, Md Rayhanur Rahman

llms fine-tuning safety

arXiv AI

Jun 6

From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability

arXiv:2606. 05252v1 Announce Type: cross Abstract: Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder.

By Alexandre Cristov\~ao Maiorano

llms

arXiv Computation and Language

Aug 25

CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild

arXiv:2608.23181v1 Announce Type: cross Abstract: As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention,...

By Jian Yang, Haau-Sing Li, Shawn Guo, Zixi Zhao, Yibo Tan, Jiajun Wu, Aishan Liu, Xianglong Liu, Tianyu Zheng, Bryan Dai, Chengran Yang

llms agents nlp

arXiv AI

Sep 10

Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents

The paper introduces a provenance‑aware execution graph for long‑horizon LLM agents, defining influence distance (DI) as the shortest structural path from an untrusted source to a sensitive action. Compared to the traditional sequence distance (DT), DI is always less than or equal to DT, revealing a median gap of nine hops in 454 injection–sink pairs across multiple models and datasets. The study shows that most pairs exhibit a non‑zero gap, and a deterministic DI‑based gate can block attacks missed by a sequence‑only gate without extra benign blocking.

By Md Jafrin Hossain, Nur Al Hasan Haldar

llms agents

Related stories