Omnisec: Llm-Driven Provenance-Based Intrusion Detection Via Retrieval-Augmented Behavior Prompting
Open accessThe claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
OMNISEC adopts a RAG architecture, fusing external threat intelligence and benign behavior knowledge bases into provenance graphs to assist LLMs in judging suspicious behaviors.
“OMNISEC[39] adopts a RAG architecture, fusing external threat intelligence and benign behavior knowledge bases into provenance graphs to assist LLMs in judging suspicious behaviors.”
From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [39]
The Abstract (p. 1) says OMNISEC builds benign-behavior and threat-intelligence knowledge bases and uses RAG to help an LLM decide whether abnormal behavior is an attack. Section 4.3 (p. 5) describes these as external knowledge bases whose retrieved content informs the model; it does not say their contents are fused into the provenance graphs. (LLM, conf=0.86)
Experimental — accuracy not yet measuredOMNISEC and LLM-LADE are constrained by retrieval accuracy and lack the capability to mine high-order event correlations across microservices.
“However, these architectures are constrained by retrieval accuracy and lack the capability to mine high-order event correlations across microservices.”
From From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps (2026) · cites this paper as [39]
The System Design (p. 4) describes OMNISEC’s retrieval-augmented detection and attack-graph reconstruction, while the Discussion (pp. 10–11) identifies hallucination, overhead, and poisoning risks. Our copy does not say that retrieval accuracy constrains OMNISEC or that it cannot mine high-order correlations across microservices; searches for those limitations and LLM-LADE found no supporting passage. (LLM, conf=0.75)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks
Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.-T., Rocktäschel, T., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.11401 · Cited by 3,101 · see citing works
A Comprehensive Overview of Large Language Models
Naveed, H., Khan, A. U., Qiu, S., Saqib, M., Anwar, S., Usman, M., Akhtar, N., Barnes, N., & Mian, A. (2025) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3744746 · Cited by 1,257 · see citing works
On Faithfulness and Factuality in Abstractive Summarization
Maynez, J., Narayan, S., Bohnet, B., & McDonald, R. (2020) · Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2020.acl-main.173 · Cited by 1,185 · see citing works
Retrieval-Augmented Generation for Large Language Models: A Survey
Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., Wang, M., & Wang, H. (2023) · arXiv · doi:10.48550/arxiv.2312.10997 · Cited by 876 · see citing works
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows
Milajerdi, S. M., Gjomemo, R., Eshete, B., Sekar, R., & Venkatakrishnan, V. N. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00026 · Cited by 573 · see citing works
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage
Hassan, W. U., Guo, S., Li, D., Chen, Z., Jee, K., Li, Z., & Bates, A. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23349 · Cited by 375 · see citing works
Milajerdi, S. M., Eshete, B., Gjomemo, R., & Venkatakrishnan, V. N. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363217 · Cited by 314 · see citing works
Tactical Provenance Analysis for Endpoint Detection and Response Systems
Hassan, W. U., Bates, A., & Marino, D. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00096 · Cited by 311 · see citing works
Fast Memory-efficient Anomaly Detection in Streaming Heterogeneous Graphs
Manzoor, E., Milajerdi, S. M., & Akoglu, L. (2016) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2939672.2939783 · Cited by 303 · see citing works
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis
Wang, Q., Hassan, W. U., Li, D., Jee, K., Yu, X., Zou, K., Rhee, J., Chen, Z., Cheng, W. X., Gunter, C. A., et al. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24167 · Cited by 256 · see citing works
Self-citationTHREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning
Wang, S., Wang, Z., Zhou, T., Sun, H., Yin, X., Han, D., Zhang, H., Shi, X., & Yang, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3208815 · Cited by 248 · see citing works
Effects of cyber security knowledge on attack detection
Ben‐Asher, N., & González, C. (2015) · Computers in Human Behavior · doi:10.1016/j.chb.2015.01.039 · Cited by 247 · see citing works
When LLMs meet cybersecurity: a systematic literature review
Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., & Meng, D. (2025) · Cybersecurity · doi:10.1186/s42400-025-00361-w · Cited by 220 · see citing works
ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting
Ma, S., Zhang, X., & Xu, D. (2016) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23350 · Cited by 202 · see citing works
AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports
Li, Z., Zeng, J., Chen, Y., & Liang, Z. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17140-6_29 · Cited by 202 · see citing works
Practical whole-system provenance capture
Pasquier, T., Han, X., Goldstein, M., Moyer, T., Eyers, D. M., Seltzer, M., & Bacon, J. (2017) · Symposium on Cloud Computing · doi:10.1145/3127479.3129249 · Cited by 201 · see citing works
SHADEWATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records
Zengy, J., Wang, X., Liu, J., Chen, Y., Liang, Z., Chua, T., & Chua, Z. L. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833669 · Cited by 194 · see citing works
Extractor: Extracting Attack Behavior from Threat Reports
Satvat, K., Gjomemo, R., & Venkatakrishnan, V. N. (2021) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp51992.2021.00046 · Cited by 178 · see citing works
Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance
Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., & Han, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00005 · Cited by 157 · see citing works
{ATLAS}: A Sequence-based Learning Approach for Attack Investigation
Alsaheel, A., Nan, Y., Ma, S., Yu, L., Walkup, G., Celik, Z. B., Zhang, X., & Xu, D. (2021) · USENIX Security Symposium · Cited by 134 · see citing works
Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning
Rehman, M. U., Ahmadi, H., & Hassan, W. U. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00139 · Cited by 127 · see citing works
Threat detection and investigation with system-level provenance graphs: A survey
Li, Z., Chen, Q. A., Yang, R., Chen, Y., & Ruan, W. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102282 · Cited by 117 · see citing works
Application of Large Language Models in Cybersecurity: A Systematic Literature Review
Hasanov, I. J., Virtanen, S., Hakkala, A., & Isoaho, J. (2024) · IEEE Access · doi:10.1109/access.2024.3505983 · Cited by 114 · see citing works
Large Language Models in Cybersecurity: State-of-the-Art
Motlagh, F. N., Hajizadeh, M., Majd, M., Najafi, P., Cheng, F., & Meinel, C. (2024) · arXiv · doi:10.48550/arxiv.2402.00891 · Cited by 92 · see citing works
Large Language Models in Cybersecurity: State-of-the-Art
Motlagh, F., Hajizadeh, M., Majd, M., Najafi, P., Cheng, F., & Meinel, C. (2025) · Proceedings of the 11th International Conference on Information Systems Security and Privacy · doi:10.5220/0013377600003899 · Cited by 92 · see citing works
AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacksPreprint
Xu, J., Stokes, J. W., McDonald, G., Bai, X., Marshall, D., Wang, S., Swaminathan, A., & Li, Z. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2403.01038 · Cited by 86 · see citing works
A Survey of Anomaly Detection Methods in Networks
Zhang, W., Yang, Q., & Geng, Y. (2009) · International Symposium on Computer Network and Multimedia Technology · doi:10.1109/cnmt.2009.5374676 · Cited by 79 · see citing works
Xie, Y., Feng, D., Hu, Y., Li, Y., Sample, S., & Long, D. D. E. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2018.2867595 · Cited by 76 · see citing works
UniLog: Automatic Logging via LLM and In-Context Learning
Xu, J., Cui, Z., Zhao, Y., Zhang, X., He, S., He, P., Li, L., Kang, Y., Lin, Q., Dang, Y., et al. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3623326 · Cited by 70 · see citing works
UNICORN:Runtime Provenance-Based Detector for Advanced Persistent Threats
Han, X., Pasquier, T., Bates, A., Mickens, J. W., & Seltzer, M. (2020) · Explore Bristol Research · Cited by 69 · see citing works
APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts
Zhu, T., Yu, J., Xiong, C., Cheng, W., Yuan, Q., Ying, J., Chen, T., Zhang, J., Lv, M., Chen, Y., et al. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3243667 · Cited by 69 · see citing works
Self-citationGoyal, A., Han, X., Wang, G., & Bates, A. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24207 · Cited by 67 · see citing works
LogParser-LLM: Advancing Efficient Log Parsing with Large Language Models
Zhong, A., Mo, D., Liu, G., Liu, J., Lu, Q., Zhou, Q., Wu, J., Li, Q., & Wen, Q. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671810 · Cited by 66 · see citing works
The study of APT attack stage model
Li, M., Huang, W., Wang, Y., Fan, W., & Li, J. (2016) · IEEE/ACIS International Conference on Computer and Information Science (ICIS) · doi:10.1109/icis.2016.7550947 · Cited by 61 · see citing works
Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications
Zhang, Q., Zeng, B., Zhou, C.-J., Go, G., Shi, H.-Y., & Jiang, Y. (2024) · SIGSOFT FSE Companion · doi:10.1145/3663529.3663786 · Cited by 57 · see citing works
ShieldGPT: An LLM-based Framework for DDoS Mitigation
Wang, T., Xie, X., Zhang, L., Wang, C., Zhang, L., & Cui, Y. (2024) · Asia-Pacific Workshop on Networking (APNet) · doi:10.1145/3663408.3663424 · Cited by 55 · see citing works
General, Efficient, and Real-Time Data Compaction Strategy for APT Forensic Analysis
Zhu, T., Wang, J., Ruan, L., Xiong, C., Yu, J., Li, Y., Chen, Y., Lv, M., & Chen, T. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3076288 · Cited by 48 · see citing works
Self-citationDeep Adversarial Learning in Intrusion Detection: A Data Augmentation Enhanced FrameworkPreprint
Zhang, H., Yu, X., Ren, P., Luo, C., & Min, G. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.07949 · Cited by 47 · see citing works
ProvG-Searcher: A Graph Representation Learning Approach for Efficient Provenance Graph Search
Altınışık, E., Deniz, F., & Sencar, H. T. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623187 · Cited by 44 · see citing works
LocalIntel: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge
Mitra, S., Neupane, S., Chakraborty, T., Mittal, S., Piplai, A., Gaur, M., & Rahimi, S. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-87496-3_5 · Cited by 35 · see citing works
Hassan, W. U., Li, D., Jee, K., Yu, X., Zou, K., Wang, D., Chen, Z., Li, Z., Rhee, J., Gui, J., et al. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427255 · Cited by 35 · see citing works
TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning
Lv, M., Gao, H., Qiu, X., Chen, T., Zhu, T., Chen, J., & Ji, S. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690221 · Cited by 32 · see citing works
Self-citationIncorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection
Wang, L., Shen, X., Li, W., Li, Z., Sekar, R., Liu, H., & Chen, Y. (2025) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2025.230822 · Cited by 31 · see citing works
Benabderrahmane, S., Valtchev, P., Cheney, J., & Rahwan, T. (2025) · International Symposium on Digital Forensics and Security (ISDFS) · doi:10.1109/isdfs65363.2025.11011912 · Cited by 29 · see citing works
A Review of APT Attack Detection Methods and Defense Strategies
Xing, K., Li, A., Jiang, R., & Jia, Y. (2020) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc50466.2020.00018 · Cited by 26 · see citing works
Quinn, T., & Thompson, O. K. (2024) · Research Square · doi:10.21203/rs.3.rs-4405206/v1 · Cited by 19 · see citing works
RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainer
Deng, J., Li, X., Chen, Y., Bai, Y., Weng, H., Liu, Y., Wei, T., & Xu, W. (2025) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2025.230798 · Cited by 16 · see citing works
Cao, D., & Jun, W. (2024) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps61880.2024.10620804 · Cited by 15 · see citing works
A network audit system for host-based intrusion detection (NASHID) in Linux
Daniels, T. E., & Spafford, E. H. (2002) · Annual Computer Security Applications Conference · doi:10.1109/acsac.2000.898871 · Cited by 9 · see citing works
CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research
Huang, S.-Y., Yang, C., Lin, C.-Y., & Huang, C. (2024) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2024.emnlp-main.1126 · Cited by 6 · see citing works
Leveraging LLM for Zero-Day Exploit Detection in Cloud Networks
(2024) · International Research Journal of Modernization in Engineering Technology and Science · doi:10.56726/irjmets57854 · Cited by 6 · see citing works
CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports
Cheng, W., Zhu, T., Chen, T., Yuan, Q., Ying, J., Li, H., Xiong, C., Li, M., Lv, M., & Chen, Y. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3584826 · Cited by 5 · see citing works
Self-citationSLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
Hossain, M. N., Milajerdi, S. M., Wang, J., Eshete, B., Gjomemo, R., Sekar, R., Stoller, S., & Venkatakrishnan, V. (2018) · arXiv · doi:10.48550/arxiv.1801.02062
Flagged first, then by citations
Research works printed but not linked: 6
- [9][9] Sadegh M Milajerdi et al. Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In CSS , pages 1795-1812, 2019. -
- [14][14] Zhendong Wang, Zeyu Li, Junling Wang, and Dahai Li. Network intrusion detection model based on improved byol self-supervised learning. Security and Communication Networks , 2021(1):9486949, 2021. -
- [16][16] Fan Yang et al. { PROGRAPHER } : An anomaly detection system based on provenance graph embedding. In USENIX , pages 43554372, 2023. -
- [41][41] Patrick Lewis et al. Retrieval-augmented generation for knowledgeintensive nlp tasks. NeurIPS , 33:9459-9474, 2020. -
- [55][55] Zijun Cheng et al. Kairos: Practical intrusion detection and investigation using whole-system provenance. In S & P , pages 3533-3551, 2024. -
- [60][60] Alicia Russell-Gilbert. RAAD-LLM: Adaptive Anomaly Detection Using LLMs and RAG Integration . PhD thesis, Mississippi State University, 2025. -
Cited by
Sorted by citations
OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs
Aly, A., Mansour, E., & Youssef, A. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3765219 · Cited by 13 · see citing works
MGDA: A provenance graph-based framework for threat detection and attack scenario reconstruction
Cui, M., Jiang, Z., Li, S., Ma, C., Zhang, K., Yang, P., & Feng, H. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111806 · Cited by 11 · see citing works
LLM-Driven APT Detection for 6G Wireless Networks: A Systematic Review and Taxonomy
Golec, M., Khamayseh, Y., Melhem, S. B., & Alwarafy, A. (2025) · IEEE Access · doi:10.1109/access.2025.3595665 · Cited by 9 · see citing works
From Correlation to Intervention: A Survey on Log-Based Causal Analysis for Security and AIOps
Zhu, Y., Li, X., Suo, J., Yin, Y., & Huang, C. (2026) · 2026 International Conference on AI in Education Technology and Applications (AIETA) · doi:10.1109/aieta69357.2026.11508946
Yoon, S.-S., Yang, H.-S., & Euom, I.-C. (2025) · ACM Workshop on CPS&IoT Security and Privacy (CPSIoTSec) · doi:10.1145/3733801.3764201
이주영, Oh, J., Lee, S., & Lee, T. (2026) · Research Square · doi:10.21203/rs.3.rs-10595811/v1
- Authors
- Cheng, W., Zhu, T., Jing, S., Mei, J.-P., Ma, M., Jin, J., & Weng, Z.
- Affiliations
- Zhejiang University of Technology (CN)
- Wenzhou University of Technology (CN)
- Corresponding author
- Zhu, Tiantian
- Venue
- SSRN Electronic Journal
- Publisher
- Elsevier BV
- Published
- 2025
- ISSN
- 1556-5068 (ISSN-L)
- OpenAlex
- W4413315942
- Cited by
- 1
- References
- 53
- Citations by year
- 2025: 1
- Type
- posted content
- Language
- en
- Open access
- green
- doi.org
- Locations
- SSRN Electronic Journal (acceptedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- large language models, retrieval-augmented generation, anomaly-based intrusion detection, endpoint security, provenance graphs, false positives, false-negative results
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
