HunterAgent: Neuro-Symbolic Forensics

• HunterAgent is a neuro-symbolic framework that reconstructs causal attack chains by integrating LLM semantic hypothesis generation with deterministic evidence verification.
• It recasts trace reconstruction as a cost-bounded heuristic graph search over partially observable, heterogeneous telemetry data, ensuring evidential integrity.
• Evaluation shows significant F1 improvements and drastically reduced path hallucination, supporting forensic admissibility and conservative investigation practices.

Searching arXiv for HunterAgent and closely related papers to ground the article. HunterAgent most commonly denotes the neuro-symbolic framework introduced in "HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics," a system for reconstructing causal attack chains during post-alert investigation when telemetry is heterogeneous, partially corrupted, and deliberately damaged by anti-forensic activity. It targets the gap between deterministic provenance-graph methods, which stall when critical edges are removed, and unconstrained LLM agents, which can produce fluent but forensically inadmissible narratives. The framework recasts reconstruction as cost-bounded heuristic graph search under partial observability, using an asymmetric Generator-Verifier architecture in which semantic hypotheses are proposed by an LLM but grounded by identifier-level collisions on surviving orthogonal telemetry. Under strict leave-one-family-out evaluation on three public benchmarks and an in-house 40-trace dataset, it reports 86.1 mean F1, a 26.7 F1 gain over the top agentic baseline, a 17.1 F1 gain over KAIROS, and a reduction in path-level hallucination from 61.5% to 6.4%, under the assumption that at least one orthogonal telemetry source survives (Zhao et al., 28 May 2026).

1. Terminology, scope, and problem setting

In the relevant arXiv literature, the name "HunterAgent" is used in more than one cybersecurity context. The explicitly titled system "HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics" denotes the trace-reconstruction framework described here (Zhao et al., 28 May 2026). Separately, "Towards Agentic Honeynet Configuration" uses HunterAgent as the name of an LLM-backed controller for adaptive honeypot exposure based on IDS and network telemetry, with the defender choosing a subset $\mathcal{E}_t \subseteq \mathcal{H}$ under a budget constraint $|\mathcal{E}_t| \le K$ and using $K=1$ in simulation (Mirra et al., 14 Mar 2026). The two systems share an agentic cybersecurity orientation but address distinct tasks.

The trace-reconstruction HunterAgent is situated in the post-alert phase of SOC operations. Its input is a high-confidence anchor event and a fragmented provenance graph. Its objective is not alerting, initial detection, or CTI-query matching, but reconstructing a causal attack chain across telemetry sources after an anti-forensic adversary has severed direct provenance. The motivating anti-forensic tactics are parent-PID spoofing, log wiping, fileless execution, and timestomping. The paper’s central criticism is dual: deterministic provenance systems such as SLEUTH, MAGIC, and OmegaLog preserve precision but fail when even one causal record is removed, जबकि unconstrained LLM agents can continue the narrative by fabricating links that violate OS physics (Zhao et al., 28 May 2026).

A common misconception is that HunterAgent is an LLM forensics narrator. It is not designed to let the model directly author the attack story. Its novelty lies in constraining model use to semantic hypothesis generation and forcing all physically defensible links through deterministic verification.

2. Reconstruction as bounded search under partial observability

HunterAgent models the enterprise as a temporally unrolled directed graph $G=(V,E)$, with time ordering used to collapse cycles into a DAG suitable for search. The reconstruction target is a path from an alert anchor $v_A$ to a target $v_B$:

$$\pi = v_A \to \tilde v_1 \to \dots \to \tilde v_m \to v_B$$

The intermediate nodes $\tilde v_i$ may cross missing regions where original causal records were deleted or distorted. This is the core reframing: instead of treating the task as graph completion or unconstrained narrative generation, HunterAgent performs heuristic search in which every hop is either physically grounded or admitted only as a bounded latent inference (Zhao et al., 28 May 2026).

The search procedure is beam-search-like and cost-bounded. Each proposed hop is handled in one of two ways. If it is grounded by surviving orthogonal telemetry, it becomes verified evidence. If it cannot be grounded but still passes schema constraints, it is treated as a latent hop and charged against an epistemic budget. Search continues only while the cumulative path cost remains admissible. This shifts the operative question from “what is the most plausible missing edge?” to “how far may inference proceed before it becomes evidentially unjustified.”

Algorithmically, the paper describes a cost-bounded beam search with frontier width $w=6$. States are ranked by normalized cost and number of verified hops. If the target is reached within budget, the path is returned. If not, HunterAgent halts with an explicit INSUFFICIENT_EVIDENCE result rather than emitting a speculative chain. The stated complexity is

$\mathcal{O}(w\cdot k\cdot L_{lat}^{\max}),$

with generator invocations plus one verifier query per candidate, and empirical latent-depth bounds around 6–9 hops across datasets (Zhao et al., 28 May 2026).

This search formulation is significant because it preserves a distinction that provenance tools and free-form LLM agents typically conflate: the difference between an evidentially grounded continuation and an investigative lead.

3. Asymmetric Generator-Verifier architecture and typed ontology

HunterAgent’s neuro-symbolic core is an asymmetric Generator-Verifier pipeline. The Generator is an LLM, but it is restricted to proposing semantic hypotheses within a typed ontology. It never invents physical identifiers directly. The Verifier is deterministic and attempts to ground each hypothesis through identifier-level collisions in surviving orthogonal telemetry (Zhao et al., 28 May 2026).

The ontology $|\mathcal{E}_t| \le K$0 contains four node types. Process nodes use identifier tuples $|\mathcal{E}_t| \le K$1 and carry attributes such as image path, command line, and user SID. File nodes use $|\mathcal{E}_t| \le K$2 with path and SHA256 as attributes. Network nodes use $|\mathcal{E}_t| \le K$3. Registry nodes use $|\mathcal{E}_t| \le K$4. Edges are typed OS actions such as ProcessCreate, FileWrite, and NetConnect. The ontology prevents free-form entity invention and makes schema validity a hard requirement rather than a soft preference.

The Generator is RAG-driven. HunterAgent maintains a threat-intelligence repository $|\mathcal{E}_t| \le K$5 of ATT&CK-aligned graphlets built offline from MITRE ATT&CK, Atomic Red Team, and public APT reports. For an anchor node $|\mathcal{E}_t| \le K$6, the system serializes its $|\mathcal{E}_t| \le K$7-hop neighborhood $|\mathcal{E}_t| \le K$8 with $|\mathcal{E}_t| \le K$9, embeds it using the frozen dense retriever text-embedding-3-large, and retrieves the top $K=1$0 graphlets by cosine similarity. The LLM is then prompted under a strict JSON grammar to emit candidate bridging edges. The node type is fixed by the retrieved graphlet; only the attributes are generated (Zhao et al., 28 May 2026).

Verification is governed by the hard condition

$K=1$1

where $K=1$2 denotes surviving orthogonal telemetry. The paper gives NetFlow, ETW callbacks, EDR kernel callbacks, and hypervisor/VMI traces as examples. SchemaValid checks type bounds such as valid port range, SID format, path syntax, and host-consistent attributes. FlowDep grounds a hypothesis by type-specific identifier collisions. For network nodes, the verifier checks 5-tuple agreement within a temporal threshold $K=1$3; for files, path-to-inode linkage and host consistency; for processes, image and user matching, spawn-start temporal proximity, and PPID-chain consistency; for registry nodes, KeyPath equality within a temporal threshold (Zhao et al., 28 May 2026).

The asymmetry is essential. The LLM contributes semantic generalization over incomplete traces, while the Verifier enforces physical correctness. The paper’s ablations show that replacing the deterministic Verifier with LLM self-critique materially harms soundness.

4. Deviation cost, temporal potential, and epistemic budget

When a candidate hop cannot be grounded but is not invalid, HunterAgent assigns a calibrated deviation cost rather than treating it as fact. The cost excludes schema violations because those are hard-pruned. It is defined as

$K=1$4

where the hats denote z-score normalization against a benign baseline (Zhao et al., 28 May 2026).

The semantic term compares the generated hop payload to the retrieved threat-intelligence prior:

$K=1$5

This is not generic text similarity. The generated payload is canonicalized, the retrieved graphlet is projected to the same hop scope, and both are embedded in a matched representation space. The term therefore measures divergence from a hop-level ATT&CK-like prior rather than from unrestricted prose.

The temporal term is based on an empirical log-normal fit to 15 million benign I/O latency samples:

$K=1$6

Negative time gaps are therefore forbidden, not merely discouraged. Small plausible positive gaps are inexpensive, whereas unusually large or chronologically strained hops accumulate cost. The temporal penalty is crucial: the paper reports that setting $K=1$7 causes precision to collapse because chronological inversions are no longer suppressed (Zhao et al., 28 May 2026).

To prevent inferential drift, HunterAgent uses a length-discounted epistemic budget:

$K=1$8

where $K=1$9 is the number of latent hops and $G=(V,E)$0. The calibration of $G=(V,E)$1 is central. It is set to the 99th percentile of benign leave-one-edge-out reconstruction cost: the empirical cost of reconstructing a single missing benign edge. This means the system is explicitly bounded by what missing benign evidence would ordinarily justify.

A second common misconception concerns admissibility. HunterAgent does not claim that every returned path is forensically equivalent to an observed provenance chain. The paper is explicit that only the verified layer should be treated as court-admissible evidence; latent edges are investigative leads. The framework is conservative by design: it prefers an explicit halt to a fabricated continuation.

5. Evaluation protocol, datasets, and reported performance

The evaluation covers four datasets spanning public benchmarks and an in-house corpus (Zhao et al., 28 May 2026):

Dataset	Scale	Telemetry
DARPA TC E3 (D1)	17 hosts, ~38.5M events, 14 attack scenarios	SysMon + CamFlow
DARPA OpTC (D2)	32 Windows 10 hosts, ~24.7M events, 11 scenarios	SysMon + ETW
ATLAS (D3)	10 scenarios, ~4.2M events, 4 hosts	SysMon
APT-Eval-Trace (D4)	28 VMs over 14 days, 40 red-team APT campaigns, 15.2M benign events	ETW + NetFlow + VMI ground truth

The reported protocol is strict leave-one-family-out cross-validation. LOFO excludes the attack family in the test scenario from the threat-intelligence retrieval corpus $G=(V,E)$2, from calibration, and from any few-shot exemplars. This is materially stronger than random $G=(V,E)$3-fold because it prevents family leakage. The paper also applies anti-forensic perturbations to D1–D3 using EvadeKit, with four profiles corresponding to APT29, FIN7, Wizard Spider, and Sandworm. D4 realizes these profiles through red-team operations rather than synthetic rewriting (Zhao et al., 28 May 2026).

The baselines span deterministic provenance methods, learned provenance systems, graph-based link prediction, and agentic LLM systems: SLEUTH, MAGIC, NODLINK, KAIROS, GNN-LinkPredict, Zero-Shot LLM, GraphRAG, Tool-Augmented ReAct, and an internal ablation called HunterAgent$G=(V,E)$4 in which the deterministic Verifier is replaced by LLM self-critique. Evaluation uses edge-level precision, recall, and F1 under causal equivalence, plus Path-level Hallucination Rate (PHR), where a path is counted as hallucinated if any edge violates OS physics (Zhao et al., 28 May 2026).

At the default 30% log-suppression setting under LOFO, HunterAgent reports mean F1 of 86.1, mean precision of 91.3, mean recall of 82.7, and D4 F1 of 86.8. Against the strongest agentic baseline, Tool-Augmented ReAct, the paper reports a mean F1 advantage of about +26.7 to +28.4 points and a PHR reduction from about 61.5% to 6.4%. Against the strongest non-agentic baseline, KAIROS, the reported F1 advantage is about +17.1 to +19.0 points. On D4 specifically, the main table gives KAIROS F1 at 66.5, Tool-Augmented ReAct at 58.1, and HunterAgent at 86.8 (Zhao et al., 28 May 2026).

The robustness results under increasing missing-rate conditions on D2 are deliberately asymmetric. At 10% missing, the paper reports F1 90.7, precision 93.1, and PHR 4.8. At 30% missing, F1 85.7, precision 90.4, and PHR 7.0. At 50% missing, F1 70.9, precision 87.2, and PHR 9.9. At 70% missing, F1 falls to 41.1 while precision remains 84.0 and PHR rises to 12.4. The intended interpretation is that HunterAgent degrades by losing recall and halting safely rather than by fabricating unsupported chains. In severe-to-blind regimes, 95.7% of investigations reportedly halt safely instead of inventing a path (Zhao et al., 28 May 2026).

The framework is also evaluated across backbones—GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct, and Qwen2.5-72B-Instruct. The ranking remains stable. Open models reduce recall somewhat, but the Verifier protects precision, supporting the claim that soundness is architectural rather than merely a function of model scale (Zhao et al., 28 May 2026).

6. Relation to provenance hunting, adaptive defense, and practical limits

HunterAgent occupies a distinct place within agentic cyber-defense research. A nearby line of work is provenance-based APT hunting, exemplified by "ProHunter: A Comprehensive APT Hunting System Based on Whole-System Provenance" (Qiu et al., 20 Mar 2026). ProHunter converts audit logs into a compact Pure Provenance Graph, samples threat graphs around points of interest through heuristic BFS, and performs approximate matching against CTI-derived query graphs using adaptive graph representation. It reports daily memory usage of about 3–25 MB, reductions of 47%–75% versus Sleuth, and on OpTC a Recall of 1.00 with FPR 0.07. The conceptual difference is sharp: ProHunter is a CTI-driven graph-matching hunter over compact whole-system provenance, whereas HunterAgent is a post-alert causal reconstructor that explicitly traverses anti-forensic gaps by combining semantic hypotheses with telemetry grounding (Qiu et al., 20 Mar 2026).

The other prominent use of the name appears in adaptive cyber deception. The honeynet-oriented HunterAgent in "Towards Agentic Honeynet Configuration" maintains an attack graph from summarized IDS alerts, previous inferred progression, and deployment constraints, then chooses which honeypot service to expose next under a budget constraint, using a discrete-time attacker-defender simulation with MITRE ATT&CK-style stages (Mirra et al., 14 Mar 2026). That system addresses attacker engagement and exposure efficiency, not forensic reconstruction. This suggests that "HunterAgent" has become a broader label for agentic cybersecurity systems that infer latent attacker state from incomplete telemetry, although the specific technical commitments of the trace-reconstruction HunterAgent are unusually stringent.

Those commitments define its practical boundary conditions. The paper is explicit that HunterAgent is not effective if all relevant orthogonal telemetry is erased simultaneously, if a ring-0 adversary compromises every surviving OS-layer source, or if out-of-vocabulary zero-day behavior leaves the retrieval prior too weak. Its calibration is empirical rather than worst-case, and its admissibility claim is conditional: verified edges are evidence, latent edges are leads (Zhao et al., 28 May 2026).

Within those limits, HunterAgent’s distinctive contribution is the explicit separation of semantic imagination from evidential authority. It allows an LLM to generalize across anti-forensic gaps, but only inside a typed ontology, only under a calibrated cost model, and only so long as the resulting reconstruction remains bounded by what surviving telemetry can still justify.