{"id":"https://openalex.org/W7127089258","doi":"https://doi.org/10.1109/trustcom66490.2025.00113","title":"PROV-LLM: Advanced Persistent Threat Detection Based on Process Behavior Subgraphs Using Large Language Models","display_name":"PROV-LLM: Advanced Persistent Threat Detection Based on Process Behavior Subgraphs Using Large Language Models","publication_year":2025,"publication_date":"2025-11-14","ids":{"openalex":"https://openalex.org/W7127089258","doi":"https://doi.org/10.1109/trustcom66490.2025.00113"},"language":"en","primary_location":{"id":"doi:10.1109/trustcom66490.2025.00113","doi":"https://doi.org/10.1109/trustcom66490.2025.00113","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00113","pdf_url":null,"source":{"id":"https://openalex.org/S4363608016","display_name":"IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100643265","display_name":"C. L. Philip Chen","orcid":"https://orcid.org/0000-0001-5451-7230","observed_orcids":["https://orcid.org/0000-0001-5451-7230","https://orcid.org/0000-0002-2158-7969","https://orcid.org/0009-0009-1588-3460"]},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Canhua Chen","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124145745","display_name":"Yang Song","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I50760025","display_name":"Hangzhou Dianzi University","ror":"https://ror.org/0576gt767","country_code":"CN","type":"education","lineage":["https://openalex.org/I50760025"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Song","raw_affiliation_strings":["Hangzhou Dianzi University,School of Computer Science,Hangzhou,China,310018"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hangzhou Dianzi University,School of Computer Science,Hangzhou,China,310018","institution_ids":["https://openalex.org/I50760025"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103325591","display_name":"Yunpeng Li","orcid":"https://orcid.org/0000-0002-5156-889X","observed_orcids":["https://orcid.org/0000-0002-5156-889X"]},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yunpeng Li","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124846519","display_name":"Yun Feng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yun Feng","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006724208","display_name":"Xiaoyu Wang","orcid":"https://orcid.org/0000-0002-4067-4996","observed_orcids":["https://orcid.org/0000-0002-4067-4996"]},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyu Wang","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139808447","display_name":"Yuling Liu","orcid":"https://orcid.org/0000-0002-2740-9362","observed_orcids":["https://orcid.org/0000-0002-2740-9362"]},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuling Liu","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004834139","display_name":"Qixu Liu","orcid":"https://orcid.org/0000-0003-0895-9585","observed_orcids":["https://orcid.org/0000-0003-0895-9585"]},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qixu Liu","raw_affiliation_strings":["Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China,100085","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.53791271,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"978","last_page":"985"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9096999764442444,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9096999764442444,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.03929999843239784,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.020099999383091927,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.9539999961853027},{"id":"https://openalex.org/keywords/apt-detection","display_name":"APT detection","score":0.7720000147819519},{"id":"https://openalex.org/keywords/provenance-graphs","display_name":"provenance graphs","score":0.9440000057220459},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9570000171661377},{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.9869999885559082},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.8880000114440918},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"malware analysis","score":0.33399999141693115},{"id":"https://openalex.org/keywords/security-analyst-workload","display_name":"security analyst workload","score":0.7149999737739563}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7613999843597412},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7242000102996826},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.6617000102996826},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6180999875068665},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5960000157356262},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5436999797821045},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.5300999879837036},{"id":"https://openalex.org/C177774035","wikidata":"https://www.wikidata.org/wiki/Q1246948","display_name":"Granularity","level":2,"score":0.5157999992370605},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.513700008392334},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.4415000081062317},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39239999651908875},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.375900000333786},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.3702999949455261},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.35760000348091125},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2921000123023987},{"id":"https://openalex.org/C174998907","wikidata":"https://www.wikidata.org/wiki/Q357662","display_name":"Work in process","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.27649998664855957},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.26159998774528503},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.25619998574256897}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/trustcom66490.2025.00113","doi":"https://doi.org/10.1109/trustcom66490.2025.00113","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00113","pdf_url":null,"source":{"id":"https://openalex.org/S4363608016","display_name":"IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335892","display_name":"Youth Innovation Promotion Association","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W168132470","https://openalex.org/W2009232481","https://openalex.org/W2271004381","https://openalex.org/W2284900416","https://openalex.org/W2747669027","https://openalex.org/W2910711617","https://openalex.org/W2947745012","https://openalex.org/W2962703433","https://openalex.org/W2978956219","https://openalex.org/W2998038410","https://openalex.org/W3015650867","https://openalex.org/W3016038045","https://openalex.org/W3137205257","https://openalex.org/W3158906645","https://openalex.org/W3176367300","https://openalex.org/W3195954353","https://openalex.org/W3212868562","https://openalex.org/W4210803071","https://openalex.org/W4288057803","https://openalex.org/W4388481469","https://openalex.org/W4402263650","https://openalex.org/W4402265033","https://openalex.org/W4402288718"],"related_works":["https://openalex.org/W7165621171","https://openalex.org/W7155511203","https://openalex.org/W4407186288","https://openalex.org/W4412408057","https://openalex.org/W4411204262","https://openalex.org/W7115571124","https://openalex.org/W4382134209","https://openalex.org/W4416935023","https://openalex.org/W4409050119","https://openalex.org/W4416800330"],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"pose":[4],"significant":[5],"cybersecurity":[6],"challenges":[7],"through":[8],"stealthy,":[9],"multi-stage":[10],"attacks":[11],"that":[12,60,155],"leverage":[13],"zero-day":[14],"exploits":[15],"and":[16,42,86,122,150,163,172],"evasive":[17],"tactics.":[18],"While":[19],"provenance":[20,70],"graph-based":[21],"methods":[22,159],"show":[23],"promise":[24],"for":[25,133],"APT":[26],"detection,":[27],"existing":[28],"approaches":[29],"face":[30],"three":[31,139],"critical":[32,40],"limitations:":[33],"(i)":[34],"inappropriate":[35],"granularity":[36],"levels,":[37],"(ii)":[38],"insufficient":[39],"context,":[41],"(iii)":[43],"lack":[44],"of":[45,101,126],"interpretable":[46],"output.":[47],"To":[48],"address":[49],"these":[50],"challenges,":[51],"we":[52],"propose":[53],"Prov-LLM,":[54],"a":[55,92,99],"novel":[56],"LLM-enhanced":[57],"detection":[58,110],"system":[59,116],"leverages":[61],"process-centric":[62],"behavioral":[63],"subgraphs.":[64],"Our":[65],"approach":[66],"first":[67],"decomposes":[68],"large":[69],"graphs":[71],"into":[72],"process-centered":[73],"graphs,":[74],"enriching":[75],"them":[76],"with":[77],"key":[78],"attributes":[79],"such":[80],"as":[81],"process":[82,119,169],"names,":[83],"execution":[84],"paths,":[85],"command-line":[87],"arguments.":[88],"Prov-LLM":[89,137,156],"then":[90],"utilizes":[91],"Retrieval-Augmented":[93],"Generation":[94],"(RAG)":[95],"framework":[96],"to":[97,106],"establish":[98],"baseline":[100],"benign":[102],"behavior,":[103],"enabling":[104],"LLMs":[105,173],"perform":[107],"context-aware":[108],"anomaly":[109],"via":[111],"semantic":[112],"reasoning.":[113],"Finally,":[114],"the":[115,166],"reconstructs":[117],"anomalous":[118],"behavior":[120,170],"subgraphs":[121,171],"generates":[123],"human-readable":[124],"explanations":[125],"attacks,":[127],"offering":[128],"security":[129],"analysts":[130],"intuitive":[131],"insights":[132],"investigation.":[134],"We":[135],"evaluate":[136],"on":[138],"DARPA":[140],"OPTC":[141],"attack":[142,179],"datasets:":[143],"Plain":[144],"PowerShell":[145,148],"Empire,":[146,149],"Custom":[147],"Malicious":[151],"Upgrade.":[152],"Results":[153],"demonstrate":[154],"outperforms":[157],"state-of-the-art":[158],"in":[160],"accuracy,":[161],"precision,":[162],"recall.":[164],"Notably,":[165],"synergy":[167],"between":[168],"significantly":[174],"reduces":[175],"analysts\u2019":[176],"workload":[177],"during":[178],"investigations.":[180]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-02-03T00:00:00"}