LLM-Empowered Attack Investigation Framework

• LLM-empowered Attack Investigation Framework is a modular system that converts unstructured cyber intelligence into structured forensic reports using specialized LLM reasoning and orchestrated pipelines.
• It employs rigorous context reduction techniques, provenance analysis, and threat-knowledge integration to accurately reconstruct attack chains and map MITRE ATT&CK tactics.
• Designed for scalability, the framework supports diverse data modalities—from CTI reports to packet traces—enhancing detection precision and investigative efficiency.

Recent work uses LLMs to automate attack investigation by transforming unstructured cyber threat intelligence, host and provenance logs, packet traces, and sparse alerts into structured attack intelligence, reconstructed attack chains, and analyst-ready reports. Across this literature, the central pattern is not a standalone LLM, but an engineered pipeline in which LLM reasoning is coupled with preprocessing, retrieval, graph or provenance expansion, constrained tool use, and post hoc verification. Representative systems include IntelEX for attack-level threat intelligence extraction from CTI reports (Xu et al., 2024), two distinct SHIELD systems for provenance-based APT detection and host-based intrusion detection (Gandhi et al., 4 Feb 2025, Sun et al., 15 Jul 2025), Ananke for Kill-Chain-aligned attack reconstruction from heterogeneous logs (Dai et al., 1 Sep 2025), PROVSEEK for provenance-driven forensic analysis and threat intelligence extraction (Mukherjee et al., 29 Aug 2025), an agentic workflow for early-stage alert triage (Eilertsen et al., 28 Apr 2026), and CyberSleuth for forensic investigation of web application attacks from PCAPs and logs (Fumero et al., 28 Aug 2025).

1. Operational scope and data modalities

The investigated systems differ primarily in the evidence they consume and in the granularity of the conclusions they produce. Some begin from human-authored CTI reports and extract tactics, techniques, procedures, and procedural context; others begin from runtime evidence such as provenance events, host logs, packet traces, or IDS alerts and reconstruct attack causality or deliver a verdict.

Representative systems and their principal input-output structure are summarized below.

Framework	Primary inputs	Principal outputs
IntelEX	Unstructured CTI reports	tactics, techniques, procedures, attack sequence, STIX-compatible output
SHIELD (Sun et al., 15 Jul 2025)	host logs	compromised processes, IPs, files, tactics, attack story
Ananke	alerts plus Windows/Linux system logs	reconstructed multi-phase attack scenarios, Kill Chain reports
PROVSEEK	CTI reports and provenance databases	structured, verifiable forensic summaries, threat detection
CyberSleuth	PCAP files and application logs	targeted service, CVE, attack success, forensic report

IntelEX is positioned upstream of runtime investigation: it transforms unstructured CTI reports into structured, attack-level intelligence centered on tactics, techniques, and procedures, with outputs compatible with STIX and usable for detection-rule generation or attack simulation (Xu et al., 2024). By contrast, the provenance-based SHIELD combines anomaly detection, provenance graph analysis, and LLM contextual reasoning to detect stealthy, multi-stage APTs while generating interpretable attack descriptions (Gandhi et al., 4 Feb 2025). The HIDS-oriented SHIELD addresses the “alert-to-intelligence gap” at host level by localizing suspicious windows, expanding evidence neighborhoods, and eliciting event-, tactic-, and story-level outputs from an LLM (Sun et al., 15 Jul 2025).

Ananke and PROVSEEK sit at the forensic reconstruction end of the spectrum. Ananke reconstructs multi-phase attack scenarios from massive, heterogeneous logs by combining provenance subgraph expansion with a dynamically adaptable Kill-Chain-aligned threat knowledge base (Dai et al., 1 Sep 2025). PROVSEEK fuses vectorized CTI with system provenance databases through agentic planning, context-aware SQL generation, and verifiable explanation synthesis (Mukherjee et al., 29 Aug 2025). CyberSleuth narrows the domain to realistic web-attack forensics, using packet-level traces and application logs to identify the targeted service, the exploited vulnerability, and attack success (Fumero et al., 28 Aug 2025).

2. Pipeline architecture and context reduction

A recurring architectural premise is that naïvely exposing raw security telemetry to an LLM is ineffective. The literature therefore places substantial emphasis on context reduction, locality selection, and evidence staging before high-cost reasoning.

IntelEX starts with a chunking and preprocessing module that splits a CTI report into segments likely to contain malicious indicators using IoC detection, explicitly to overcome input length limits and noise (Xu et al., 2024). The HIDS-oriented SHIELD adopts event-level Masked Autoencoder processing to localize suspicious log windows before any LLM invocation, then selects only top-$k$ windows for further analysis (Sun et al., 15 Jul 2025). The provenance-based SHIELD similarly applies Local Outlier Factor, provenance pruning, tag propagation, and Louvain community detection so that the LLM sees only suspicious communities rather than full provenance corpora (Gandhi et al., 4 Feb 2025).

Ananke constrains context by building a provenance graph around an alert, then using bounded forward and backward traversals and adjacency-prioritized expansion to grow the investigation only through suspicious neighborhoods (Dai et al., 1 Sep 2025). PROVSEEK does not embed or score the entire provenance corpus; instead, it generates bounded, targeted SQL queries over provenance data and validates each claim against retrieved evidence (Mukherjee et al., 29 Aug 2025). The alert-triage workflow described in “Towards Agentic Investigation of Security Alerts” begins with an overview query over Suricata logs, after which an Investigator LLM selects up to four predefined SQL queries, one optional freeform SQL query, and a mandatory grep operation, all under strict validation and row limits (Eilertsen et al., 28 Apr 2026).

CyberSleuth’s Flow Reporter Agent makes the same design choice at packet level. Rather than sending raw PCAP content directly to the reasoning model, a Flow Summariser sub-agent inspects each TCP/UDP connection and summarizes application-layer exchanges under a root-square token-allocation scheme, so that the main agent focuses on forensic reasoning instead of raw parsing (Fumero et al., 28 Aug 2025). This suggests that “LLM-empowered” investigation, in practice, is largely a problem of disciplined context curation rather than direct generative analysis over unfiltered evidence.

3. Threat-knowledge augmentation and reasoning substrates

The frameworks differ not only in how they reduce context, but also in the external security knowledge they bind into the reasoning loop. The dominant patterns are MITRE ATT&CK grounding, Cyber Kill Chain alignment, CTI retrieval, and provenance-aware local context reconstruction.

IntelEX grounds technique and tactic identification in MITRE ATT&CK and augments in-context classification with retrieval from an external vector database of embedded MITRE technique descriptions (Xu et al., 2024). For a CTI chunk embedding $E_{part}$ and a technique-description embedding $E_{description}$, it uses cosine similarity,

$$\text{cosine-dis}(E_{part}, E_{description})=\frac{E_{part}\cdot E_{description}}{\|E_{part}\|\|E_{description}\|},$$

and retrieves the Top-K most similar techniques, with empirically selected $K=3$, as classification candidates. The same framework uses a GraphRAG-like procedure-extraction component that embeds full MITRE ATT&CK procedure sets and enforces an <entity><relationship><action> representation for generated procedure steps (Xu et al., 2024).

The HIDS-oriented SHIELD does not use a full RAG stack for benign context. Instead, it builds benign profiles offline as a key-value store mapping command-lines to observed context and frequencies through Deterministic Data Augmentation, then cross-checks neighborhood evidence against those profiles during investigation (Sun et al., 15 Jul 2025). Its prompts are designed to elicit event/entity classifications, tactic-level prediction, and attack-story generation, all aligned with MITRE ATT&CK (Sun et al., 15 Jul 2025).

Ananke organizes public attack logs into stage-aware knowledge units aligned with the Cyber Kill Chain. Each unit contains a phase label, a natural-language behavior summary, key malicious entities, and links to adjacent phases. During investigation, a suspicious event sequence is embedded as $q$ and matched to knowledge units through

$$\mathrm{ThreatScore}(q,r_i)=\frac{q\cdot \mathcal{E}(r_i)}{\|q\|\|\mathcal{E}(r_i)\|},$$

after which the LLM reasons over the current sequence, the retrieved knowledge unit, and a short-term reasoning cache (Dai et al., 1 Sep 2025). The explicit phase structure is central: it is used not merely for labeling, but for iterative context expansion and final report generation.

PROVSEEK combines vectorized CTI with live provenance evidence. CTI-derived IoCs become structured provenance queries, and the framework verifies each tool operation against concrete supporting events before those events enter the final explanation (Mukherjee et al., 29 Aug 2025). CyberSleuth uses a different knowledge substrate: web search over current CVE-relevant content, summarized into compact evidence for the reasoning agent, so that vulnerability identification is based on both packet or log evidence and up-to-date public documentation (Fumero et al., 28 Aug 2025).

4. Agentic orchestration, verification, and hallucination control

A notable shift in this literature is from single-call prompting to role-specialized orchestration. Distinct LLM invocations are assigned planning, retrieval, synthesis, judging, or verdict functions, and these functions are often isolated from one another to reduce shared-context bias.

IntelEX explicitly adopts a “Triple LLM Design” in which context comprehension, retrieval, and judgment are segregated. Its LLM-as-a-Judgment module receives isolated context and reviews candidate techniques and tactics with a YES/NO decision and reasoning, filtering out outputs not grounded in the report (Xu et al., 2024). The HIDS-oriented SHIELD uses multi-purpose prompting with chain-of-thought and self-consistency guidance, while also mapping returned IOCs back to original events for precise labeling and visualization (Sun et al., 15 Jul 2025).

PROVSEEK formalizes orchestration even more explicitly. It includes a central planner, extraction agents, data-retrieval agents, an investigation agent for evidence correlation, a Safety Agent for syntax checks and resource limits, and an Explanation Summary Agent that outputs grounded narratives (Mukherjee et al., 29 Aug 2025). The planning step decomposes analyst intent and CTI-derived queries into tool sequences,

$\pi=\langle a_1,a_2,\dots,a_T\rangle,$

and every tool result is subjected to evidence verification before being admitted into the explanation (Mukherjee et al., 29 Aug 2025).

The alert-triage workflow in (Eilertsen et al., 28 Apr 2026) makes the decomposition visible at SOC triage level. The Investigator LLM plans evidence collection under constrained interfaces; execution is handled separately under validation; the Summary LLM produces a plain-language executive summary with IoCs, mapped MITRE ATT&CK techniques, and a confidence score in $[0,1]$; and the Incident Verdict LLM emits one of four states: Malicious, Benign, Uncertain, or Requires further investigation (Eilertsen et al., 28 Apr 2026). This modularity is combined with strict guardrails: SQL is SELECT-only, time-bounded, parameterized, and row-limited, while grep is restricted to permitted text logs (Eilertsen et al., 28 Apr 2026).

CyberSleuth compares four agent architectures and finds that simple modular separation can outperform more entangled multi-agent designs. The selected Flow Reporter Agent decouples inspection from interpretation and yields better accuracy, fewer reasoning steps, and lower cost than both the Single Agent and Tshark Expert Agent baselines (Fumero et al., 28 Aug 2025). This result is consistent with the broader claim, also supported by the host-log and alert-triage papers, that LLMs are most reliable when treated as guided modules inside a fixed analytical scaffold rather than as unrestricted general analysts.

5. Analyst-facing outputs and operational uses

The mature frameworks are distinguished by the quality and structure of their outputs. They do not stop at anomaly scores or suspicious entities; they aim to produce operationally consumable artifacts such as TTP inventories, procedural steps, mapped ATT&CK tactics, Sigma rules, forensic reports, or coherent attack narratives.

IntelEX aggregates findings in MITRE ATT&CK tactic order, supports STIX-compatible output, and directly connects extracted TTP intelligence to downstream detection-rule automation and attack simulation (Xu et al., 2024). In the rule-generation path, extracted TTPs guide Sigma rule generation for Splunk, with syntax checking and auto-correction assisted by LLMs (Xu et al., 2024). In the red-team path, the framework emits step-by-step procedure templates in <entity><relationship><action> form, intended for adversarial playbooks and attack reconstruction (Xu et al., 2024).

Both SHIELD systems emphasize interpretability. The provenance-based SHIELD generates attack summaries that map events to APT kill-chain stages, include actors, temporal sequence, and IOCs, and use confidence thresholds so that only higher-confidence detections produce full analyst-facing alerts (Gandhi et al., 4 Feb 2025). The HIDS-oriented SHIELD produces event/entity classifications, tactic-level predictions, and readable attack stories, explicitly to improve analyst usability and close the alert-to-intelligence gap (Sun et al., 15 Jul 2025).

Ananke’s final product is a coherent forensic report organized by Kill Chain stages, temporal order, and cause-effect relationships (Dai et al., 1 Sep 2025). PROVSEEK outputs an annotated subset of the provenance graph together with a causal narrative in which every claim is linked to precise supporting events (Mukherjee et al., 29 Aug 2025). CyberSleuth focuses its report schema on four concrete questions: the targeted service, the exploited CVE, whether the attack succeeded, and a human-readable structured forensic report (Fumero et al., 28 Aug 2025). These output choices reflect a broader movement from raw detection to evidence-backed explanatory security analytics.

6. Empirical evidence and benchmark patterns

The empirical record reported by these systems is heterogeneous in dataset, metric, and task, but several patterns are consistent: context reduction materially improves performance; knowledge augmentation improves precision and recall; and naïve direct prompting is repeatedly shown to be inadequate.

IntelEX was evaluated on 1,769 real-world Cisco Talos CTI reports and 16 high-quality manually curated and calibrated reports aligned with the latest MITRE ATT&CK. It reports a technique-identification $F_1$ score of 0.792, with precision 0.818 and recall 0.767, compared with AttackKG’s 0.338. In downstream rule generation, Sigma rule generation guided by extracted TTPs reaches $E_{part}$0 scores up to 0.929 on Splunk for detecting simulated malicious events and logs. The paper also reports average per-report cost of approximately \$0.02 and sub-minute processing time with GPT-4o-mini, and states that 83.48% of generated procedures contained entity/relation/action information rated “extremely useful” by veteran security analysts (Xu et al., 2024).

The HIDS-oriented SHIELD evaluates on DARPA-E3, NL-SD, and ATLASv2 and reports outstanding entity/event detection precision, including $E_{part}$1 on DARPA-E3 and approximately $E_{part}$2–$E_{part}$3 on ATLASv2, with open-source DeepSeek-R1 outperforming or matching closed models in the reported comparison (Sun et al., 15 Jul 2025). The provenance-based SHIELD evaluates on DARPA Eng. 3 CADETS, THEIA, Public Arena, and an in-house Blind Eagle APT dataset, and reports event-level results such as perfect precision and recall in the range $E_{part}$4–$E_{part}$5 on CADETS attack scenarios, together with dramatic false-positive reduction relative to prior systems (Gandhi et al., 4 Feb 2025).

Ananke reports evaluation on 15 attack scenarios spanning single-host and multi-host Windows and Linux environments, with over 4.3M log events and 7.2 GB of data. It reports average True Positive Rate of 97.1% and average False Positive Rate of 0.2%, compared with ATLAS at average TPR 79.2% and average FPR 29.1%, and further reports practical investigation runtimes of approximately 1 hour for single-host cases and under 3.5 hours for complex cases (Dai et al., 1 Sep 2025). PROVSEEK evaluates on public DARPA Transparent Computing datasets and reports a 34% improvement in contextual precision and recall for intelligence extraction over retrieval-based methods, together with 22% and 29% higher precision and recall, respectively, for threat detection relative to both a baseline agentic AI approach and state-of-the-art provenance-based intrusion-detection systems (Mukherjee et al., 29 Aug 2025).

CyberSleuth benchmarks four agent architectures and six LLM backends on 20 incident scenarios and then tests on 10 incidents from 2025. It reports that CyberSleuth correctly identifies the exact CVE in 80% of the 2025 cases and that a human study with 22 experts rated the generated reports as complete, useful, and coherent (Fumero et al., 28 Aug 2025). The alert-triage workflow evaluates four LLMs over malicious and benign subsets with 100 runs per model per subset, and reports that the workflow yields dramatically higher accuracy than sending only the alert description and overview query directly to the verdict model; in the malicious subset, GPT-5-mini reaches 100% accuracy under the workflow, whereas baseline LLMs failed to identify true positives (Eilertsen et al., 28 Apr 2026).

7. Limitations, misconceptions, and adjacent research directions

A common misconception is that attack investigation with LLMs is principally a prompting problem. The accumulated evidence argues otherwise. The HIDS-oriented SHIELD states that building an HIDS by naïvely prompting an LLM is unlikely to succeed because of token limits, background noise, lost-in-the-middle effects, and interpretability problems (Sun et al., 15 Jul 2025). The alert-triage study shows that when only sparse alert context is provided, all tested baseline LLMs failed to identify malicious cases correctly, whereas the agentic workflow with planning and constrained evidence collection materially improved results (Eilertsen et al., 28 Apr 2026). CyberSleuth similarly reports that adding more raw evidence is not uniformly helpful: application logs sometimes improve service identification but can reduce CVE and success detection when noisy or only weakly relevant (Fumero et al., 28 Aug 2025).

A second misconception is that the investigation pipeline itself can be treated as trustworthy by construction. Several adjacent works frame this as an open systems-security problem. “A Framework for Formalizing LLM Agent Security” defines four contextual security properties—task alignment, action alignment, source authorization, and data isolation—and introduces oracle functions for verifying those properties during execution (Siu et al., 19 Mar 2026). MATRA, an impact-driven threat-modeling framework for agentic AI systems, combines system analysis, asset-based impact assessment, attack trees, and risk quantification to map generic LLM threats to deployment-specific risk (hamme et al., 11 May 2026). The goal-driven risk assessment framework in (Nagaraja et al., 8 Mar 2026) extends this logic with Attack-Defense Trees and CVSS-based exploitability scoring to identify dominant paths and shared choke points in LLM-enabled systems.

The broader survey literature locates attack investigation inside a full agent-empowered cybersecurity lifecycle and explicitly characterizes the duality between LLM agents as defenders and as attack surfaces (Xu et al., 26 Jun 2026). This suggests that future work on LLM-empowered attack investigation will not be limited to better extraction or reconstruction accuracy. It will also involve authorization-aware orchestration, secure tool invocation, provenance of evidence and instructions, benchmark design for long-horizon investigations, and defenses against attacks on the investigation agents themselves.