---
title: LLM-Empowered Attack Investigation Framework
url: https://www.emergentmind.com/topics/llm-empowered-attack-investigation-framework
type: topic
---

# LLM-Empowered Attack Investigation Framework

Recent work uses large language models to automate attack investigation by transforming unstructured cyber threat intelligence, host and provenance logs, packet traces, and sparse alerts into structured attack intelligence, reconstructed attack chains, and analyst-ready reports. Across this literature, the central pattern is not a standalone LLM, but an engineered pipeline in which LLM reasoning is coupled with preprocessing, retrieval, graph or provenance expansion, constrained tool use, and post hoc verification. Representative systems include IntelEX for attack-level threat intelligence extraction from CTI reports [2412.10872], two distinct SHIELD systems for provenance-based APT detection and host-based intrusion detection [2502.02342; 2507.10873], Ananke for Kill-Chain-aligned attack reconstruction from heterogeneous logs [2509.01271], PROVSEEK for provenance-driven forensic analysis and threat intelligence extraction [2508.21323], an agentic workflow for early-stage alert triage [2604.25846], and CyberSleuth for forensic investigation of web application attacks from PCAPs and logs [2508.20643].

## 1. Operational scope and data modalities

The investigated systems differ primarily in the evidence they consume and in the granularity of the conclusions they produce. Some begin from human-authored CTI reports and extract tactics, techniques, procedures, and procedural context; others begin from runtime evidence such as provenance events, host logs, packet traces, or IDS alerts and reconstruct attack causality or deliver a verdict.

Representative systems and their principal input-output structure are summarized below.

| Framework | Primary inputs | Principal outputs |
|---|---|---|
| IntelEX | Unstructured CTI reports | tactics, techniques, procedures, attack sequence, STIX-compatible output |
| SHIELD [2507.10873] | host logs | compromised processes, IPs, files, tactics, attack story |
| Ananke | alerts plus Windows/Linux system logs | reconstructed multi-phase attack scenarios, Kill Chain reports |
| PROVSEEK | CTI reports and provenance databases | structured, verifiable forensic summaries, threat detection |
| CyberSleuth | PCAP files and application logs | targeted service, CVE, attack success, forensic report |

IntelEX is positioned upstream of runtime investigation: it transforms unstructured CTI reports into structured, attack-level intelligence centered on tactics, techniques, and procedures, with outputs compatible with STIX and usable for detection-rule generation or attack simulation [2412.10872]. By contrast, the provenance-based SHIELD combines anomaly detection, provenance graph analysis, and LLM contextual reasoning to detect stealthy, multi-stage APTs while generating interpretable attack descriptions [2502.02342]. The HIDS-oriented SHIELD addresses the “alert-to-intelligence gap” at host level by localizing suspicious windows, expanding evidence neighborhoods, and eliciting event-, tactic-, and story-level outputs from an LLM [2507.10873].

Ananke and PROVSEEK sit at the forensic reconstruction end of the spectrum. Ananke reconstructs multi-phase attack scenarios from massive, heterogeneous logs by combining provenance subgraph expansion with a dynamically adaptable Kill-Chain-aligned threat knowledge base [2509.01271]. PROVSEEK fuses vectorized CTI with system provenance databases through agentic planning, context-aware SQL generation, and verifiable explanation synthesis [2508.21323]. CyberSleuth narrows the domain to realistic web-attack forensics, using packet-level traces and application logs to identify the targeted service, the exploited vulnerability, and attack success [2508.20643].

## 2. Pipeline architecture and context reduction

A recurring architectural premise is that naïvely exposing raw security telemetry to an LLM is ineffective. The literature therefore places substantial emphasis on context reduction, locality selection, and evidence staging before high-cost reasoning.

IntelEX starts with a chunking and preprocessing module that splits a CTI report into segments likely to contain malicious indicators using IoC detection, explicitly to overcome input length limits and noise [2412.10872]. The HIDS-oriented SHIELD adopts event-level Masked Autoencoder processing to localize suspicious log windows before any LLM invocation, then selects only top-$k$ windows for further analysis [2507.10873]. The provenance-based SHIELD similarly applies Local Outlier Factor, provenance pruning, tag propagation, and Louvain community detection so that the LLM sees only suspicious communities rather than full provenance corpora [2502.02342].

Ananke constrains context by building a provenance graph around an alert, then using bounded forward and backward traversals and adjacency-prioritized expansion to grow the investigation only through suspicious neighborhoods [2509.01271]. PROVSEEK does not embed or score the entire provenance corpus; instead, it generates bounded, targeted SQL queries over provenance data and validates each claim against retrieved evidence [2508.21323]. The alert-triage workflow described in “Towards Agentic Investigation of Security Alerts” begins with an overview query over Suricata logs, after which an Investigator LLM selects up to four predefined SQL queries, one optional freeform SQL query, and a mandatory grep operation, all under strict validation and row limits [2604.25846].

CyberSleuth’s Flow Reporter Agent makes the same design choice at packet level. Rather than sending raw PCAP content directly to the reasoning model, a Flow Summariser sub-agent inspects each TCP/UDP connection and summarizes application-layer exchanges under a root-square token-allocation scheme, so that the main agent focuses on forensic reasoning instead of raw parsing [2508.20643]. This suggests that “LLM-empowered” investigation, in practice, is largely a problem of disciplined context curation rather than direct generative analysis over unfiltered evidence.

## 3. Threat-knowledge augmentation and reasoning substrates

The frameworks differ not only in how they reduce context, but also in the external security knowledge they bind into the reasoning loop. The dominant patterns are MITRE ATT&CK grounding, Cyber Kill Chain alignment, CTI retrieval, and provenance-aware local context reconstruction.

IntelEX grounds technique and tactic identification in MITRE ATT&CK and augments in-context classification with retrieval from an external vector database of embedded MITRE technique descriptions [2412.10872]. For a CTI chunk embedding $E_{part}$ and a technique-description embedding $E_{description}$, it uses cosine similarity,
$$
\text{cosine-dis}(E_{part}, E_{description})=\frac{E_{part}\cdot E_{description}}{\|E_{part}\|\|E_{description}\|},
$$
and retrieves the Top-K most similar techniques, with empirically selected $K=3$, as classification candidates. The same framework uses a GraphRAG-like procedure-extraction component that embeds full MITRE ATT&CK procedure sets and enforces an `<entity><relationship><action>` representation for generated procedure steps [2412.10872].

The HIDS-oriented SHIELD does not use a full RAG stack for benign context. Instead, it builds benign profiles offline as a key-value store mapping command-lines to observed context and frequencies through Deterministic Data Augmentation, then cross-checks neighborhood evidence against those profiles during investigation [2507.10873]. Its prompts are designed to elicit event/entity classifications, tactic-level prediction, and attack-story generation, all aligned with MITRE ATT&CK [2507.10873].

Ananke organizes public attack logs into stage-aware knowledge units aligned with the Cyber Kill Chain. Each unit contains a phase label, a natural-language behavior summary, key malicious entities, and links to adjacent phases. During investigation, a suspicious event sequence is embedded as $q$ and matched to knowledge units through
$$
\mathrm{ThreatScore}(q,r_i)=\frac{q\cdot \mathcal{E}(r_i)}{\|q\|\|\mathcal{E}(r_i)\|},
$$
after which the LLM reasons over the current sequence, the retrieved knowledge unit, and a short-term reasoning cache [2509.01271]. The explicit phase structure is central: it is used not merely for labeling, but for iterative context expansion and final report generation.

PROVSEEK combines vectorized CTI with live provenance evidence. CTI-derived IoCs become structured provenance queries, and the framework verifies each tool operation against concrete supporting events before those events enter the final explanation [2508.21323]. CyberSleuth uses a different knowledge substrate: web search over current CVE-relevant content, summarized into compact evidence for the reasoning agent, so that vulnerability identification is based on both packet or log evidence and up-to-date public documentation [2508.20643].

## 4. Agentic orchestration, verification, and hallucination control

A notable shift in this literature is from single-call prompting to role-specialized orchestration. Distinct LLM invocations are assigned planning, retrieval, synthesis, judging, or verdict functions, and these functions are often isolated from one another to reduce shared-context bias.

IntelEX explicitly adopts a “Triple LLM Design” in which context comprehension, retrieval, and judgment are segregated. Its LLM-as-a-Judgment module receives isolated context and reviews candidate techniques and tactics with a YES/NO decision and reasoning, filtering out outputs not grounded in the report [2412.10872]. The HIDS-oriented SHIELD uses multi-purpose prompting with chain-of-thought and self-consistency guidance, while also mapping returned IOCs back to original events for precise labeling and visualization [2507.10873].

PROVSEEK formalizes orchestration even more explicitly. It includes a central planner, extraction agents, data-retrieval agents, an investigation agent for evidence correlation, a Safety Agent for syntax checks and resource limits, and an Explanation Summary Agent that outputs grounded narratives [2508.21323]. The planning step decomposes analyst intent and CTI-derived queries into tool sequences,
$$
\pi=\langle a_1,a_2,\dots,a_T\rangle,
$$
and every tool result is subjected to evidence verification before being admitted into the explanation [2508.21323].

The alert-triage workflow in [2604.25846] makes the decomposition visible at SOC triage level. The Investigator LLM plans evidence collection under constrained interfaces; execution is handled separately under validation; the Summary LLM produces a plain-language executive summary with IoCs, mapped MITRE ATT&CK techniques, and a confidence score in $[0,1]$; and the Incident Verdict LLM emits one of four states: Malicious, Benign, Uncertain, or Requires further investigation [2604.25846]. This modularity is combined with strict guardrails: SQL is SELECT-only, time-bounded, parameterized, and row-limited, while grep is restricted to permitted text logs [2604.25846].

CyberSleuth compares four agent architectures and finds that simple modular separation can outperform more entangled multi-agent designs. The selected Flow Reporter Agent decouples inspection from interpretation and yields better accuracy, fewer reasoning steps, and lower cost than both the Single Agent and Tshark Expert Agent baselines [2508.20643]. This result is consistent with the broader claim, also supported by the host-log and alert-triage papers, that LLMs are most reliable when treated as guided modules inside a fixed analytical scaffold rather than as unrestricted general analysts.

## 5. Analyst-facing outputs and operational uses

The mature frameworks are distinguished by the quality and structure of their outputs. They do not stop at anomaly scores or suspicious entities; they aim to produce operationally consumable artifacts such as TTP inventories, procedural steps, mapped ATT&CK tactics, Sigma rules, forensic reports, or coherent attack narratives.

IntelEX aggregates findings in MITRE ATT&CK tactic order, supports STIX-compatible output, and directly connects extracted TTP intelligence to downstream detection-rule automation and attack simulation [2412.10872]. In the rule-generation path, extracted TTPs guide Sigma rule generation for Splunk, with syntax checking and auto-correction assisted by LLMs [2412.10872]. In the red-team path, the framework emits step-by-step procedure templates in `<entity><relationship><action>` form, intended for adversarial playbooks and attack reconstruction [2412.10872].

Both SHIELD systems emphasize interpretability. The provenance-based SHIELD generates attack summaries that map events to APT kill-chain stages, include actors, temporal sequence, and IOCs, and use confidence thresholds so that only higher-confidence detections produce full analyst-facing alerts [2502.02342]. The HIDS-oriented SHIELD produces event/entity classifications, tactic-level predictions, and readable attack stories, explicitly to improve analyst usability and close the alert-to-intelligence gap [2507.10873].

Ananke’s final product is a coherent forensic report organized by Kill Chain stages, temporal order, and cause-effect relationships [2509.01271]. PROVSEEK outputs an annotated subset of the provenance graph together with a causal narrative in which every claim is linked to precise supporting events [2508.21323]. CyberSleuth focuses its report schema on four concrete questions: the targeted service, the exploited CVE, whether the attack succeeded, and a human-readable structured forensic report [2508.20643]. These output choices reflect a broader movement from raw detection to evidence-backed explanatory security analytics.

## 6. Empirical evidence and benchmark patterns

The empirical record reported by these systems is heterogeneous in dataset, metric, and task, but several patterns are consistent: context reduction materially improves performance; knowledge augmentation improves precision and recall; and naïve direct prompting is repeatedly shown to be inadequate.

IntelEX was evaluated on 1,769 real-world Cisco Talos CTI reports and 16 high-quality manually curated and calibrated reports aligned with the latest MITRE ATT&CK. It reports a technique-identification $F_1$ score of 0.792, with precision 0.818 and recall 0.767, compared with AttackKG’s 0.338. In downstream rule generation, Sigma rule generation guided by extracted TTPs reaches $F_1$ scores up to 0.929 on Splunk for detecting simulated malicious events and logs. The paper also reports average per-report cost of approximately \$0.02 and sub-minute processing time with GPT-4o-mini, and states that 83.48% of generated procedures contained entity/relation/action information rated “extremely useful” by veteran security analysts [2412.10872].

The HIDS-oriented SHIELD evaluates on DARPA-E3, NL-SD, and ATLASv2 and reports outstanding entity/event detection precision, including $>0.95$ on DARPA-E3 and approximately $0.88$–$1.0$ on ATLASv2, with open-source DeepSeek-R1 outperforming or matching closed models in the reported comparison [2507.10873]. The provenance-based SHIELD evaluates on DARPA Eng. 3 CADETS, THEIA, Public Arena, and an in-house Blind Eagle APT dataset, and reports event-level results such as perfect precision and recall in the range $0.93$–$1.0$ on CADETS attack scenarios, together with dramatic false-positive reduction relative to prior systems [2502.02342].

Ananke reports evaluation on 15 attack scenarios spanning single-host and multi-host Windows and Linux environments, with over 4.3M log events and 7.2 GB of data. It reports average True Positive Rate of 97.1% and average False Positive Rate of 0.2%, compared with ATLAS at average TPR 79.2% and average FPR 29.1%, and further reports practical investigation runtimes of approximately 1 hour for single-host cases and under 3.5 hours for complex cases [2509.01271]. PROVSEEK evaluates on public DARPA Transparent Computing datasets and reports a 34% improvement in contextual precision and recall for intelligence extraction over retrieval-based methods, together with 22% and 29% higher precision and recall, respectively, for threat detection relative to both a baseline agentic AI approach and state-of-the-art provenance-based intrusion-detection systems [2508.21323].

CyberSleuth benchmarks four agent architectures and six LLM backends on 20 incident scenarios and then tests on 10 incidents from 2025. It reports that CyberSleuth correctly identifies the exact CVE in 80% of the 2025 cases and that a human study with 22 experts rated the generated reports as complete, useful, and coherent [2508.20643]. The alert-triage workflow evaluates four LLMs over malicious and benign subsets with 100 runs per model per subset, and reports that the workflow yields dramatically higher accuracy than sending only the alert description and overview query directly to the verdict model; in the malicious subset, GPT-5-mini reaches 100% accuracy under the workflow, whereas baseline LLMs failed to identify true positives [2604.25846].

## 7. Limitations, misconceptions, and adjacent research directions

A common misconception is that attack investigation with LLMs is principally a prompting problem. The accumulated evidence argues otherwise. The HIDS-oriented SHIELD states that building an HIDS by naïvely prompting an LLM is unlikely to succeed because of token limits, background noise, lost-in-the-middle effects, and interpretability problems [2507.10873]. The alert-triage study shows that when only sparse alert context is provided, all tested baseline LLMs failed to identify malicious cases correctly, whereas the agentic workflow with planning and constrained evidence collection materially improved results [2604.25846]. CyberSleuth similarly reports that adding more raw evidence is not uniformly helpful: application logs sometimes improve service identification but can reduce CVE and success detection when noisy or only weakly relevant [2508.20643].

A second misconception is that the investigation pipeline itself can be treated as trustworthy by construction. Several adjacent works frame this as an open systems-security problem. “A Framework for Formalizing LLM Agent Security” defines four contextual security properties—task alignment, action alignment, source authorization, and data isolation—and introduces oracle functions for verifying those properties during execution [2603.19469]. MATRA, an impact-driven threat-modeling framework for agentic AI systems, combines system analysis, asset-based impact assessment, attack trees, and risk quantification to map generic LLM threats to deployment-specific risk [2605.10763]. The goal-driven risk assessment framework in [2603.07460] extends this logic with Attack-Defense Trees and CVSS-based exploitability scoring to identify dominant paths and shared choke points in LLM-enabled systems.

The broader survey literature locates attack investigation inside a full agent-empowered cybersecurity lifecycle and explicitly characterizes the duality between LLM agents as defenders and as attack surfaces [2606.28450]. This suggests that future work on LLM-empowered attack investigation will not be limited to better extraction or reconstruction accuracy. It will also involve authorization-aware orchestration, secure tool invocation, provenance of evidence and instructions, benchmark design for long-horizon investigations, and defenses against attacks on the investigation agents themselves.

Source: https://www.emergentmind.com/topics/llm-empowered-attack-investigation-framework