{"id":"https://openalex.org/W7137832631","doi":"https://doi.org/10.1609/aaai.v40i1.36994","title":"GARNET: GoT-Based Alert Reduction and Narrative Event Tracing","display_name":"GARNET: GoT-Based Alert Reduction and Narrative Event Tracing","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7137832631","doi":"https://doi.org/10.1609/aaai.v40i1.36994"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v40i1.36994","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i1.36994","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1609/aaai.v40i1.36994","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5111301052","display_name":"Yiru Gong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yiru Gong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129737947","display_name":"Song Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Song Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129663916","display_name":"Changzhi Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Changzhi Zhao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129658043","display_name":"Junrong Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Junrong Liu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129713934","display_name":"Tian tian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tian Tian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129690189","display_name":"Xiaobo Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiaobo Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129749158","display_name":"Bo Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bo Jiang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5129737085","display_name":"Zhigang Lu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhigang Lu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"40","issue":"1","first_page":"327","last_page":"335"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.4133000075817108,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.4133000075817108,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.11620000004768372,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0502999983727932,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.5806999802589417},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5123999714851379},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.3880000114440918},{"id":"https://openalex.org/keywords/knowledge-graph","display_name":"Knowledge graph","score":0.34139999747276306},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.34040001034736633},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.33000001311302185}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7311000227928162},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.5806999802589417},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5123999714851379},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39469999074935913},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.3880000114440918},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3594000041484833},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35740000009536743},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.34139999747276306},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.34040001034736633},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.3294000029563904},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.31949999928474426},{"id":"https://openalex.org/C146849305","wikidata":"https://www.wikidata.org/wiki/Q370766","display_name":"Ground truth","level":2,"score":0.2989000082015991},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.28209999203681946},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2696000039577484},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2669999897480011},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2655999958515167},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.25540000200271606}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1609/aaai.v40i1.36994","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i1.36994","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},{"id":"pmh:oai:ojs.aaai.org:article/36994","is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/36994","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i1.36994","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i1.36994","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4923059642314911,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G3882980231","display_name":null,"funder_award_id":"2023YFC2206402","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G5974510957","display_name":null,"funder_award_id":"XDA0460100","funder_id":"https://openalex.org/F4320321133","funder_display_name":"Chinese Academy of Sciences"}],"funders":[{"id":"https://openalex.org/F4320321133","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Alerts":[0],"generated":[1],"by":[2,165,208],"Security":[3],"Operations":[4],"Centers":[5],"(SOCs)":[6],"are":[7,38,50],"often":[8,39],"numerous":[9],"and":[10,58,82,113,121,139,163,191,226],"scattered,":[11],"requiring":[12],"significant":[13],"effort":[14],"from":[15],"security":[16],"analysts":[17,43,49],"to":[18,44,54,75,155,180,218],"manage,":[19],"which":[20],"severely":[21],"slows":[22],"response":[23],"times.":[24],"While":[25],"recent":[26],"alert":[27,34,98,111,119],"correlation":[28,99],"graph":[29,128,138,162,185],"methods":[30],"can":[31],"effectively":[32],"reduce":[33],"volume,":[35],"these":[36],"graphs":[37,112,120],"too":[40],"complex":[41],"for":[42,95],"understand.":[45],"As":[46],"a":[47,90,167,173],"result,":[48],"increasingly":[51],"seeking":[52],"ways":[53],"automatically":[55],"correlate":[56],"alerts":[57],"generate":[59],"concise,":[60,190],"human-readable":[61,192],"attack":[62,193,200],"path":[63,194],"summaries.":[64,195],"Recently,":[65],"Large":[66],"Language":[67],"Models":[68],"(LLMs)":[69],"have":[70],"demonstrated":[71],"superior":[72],"performance":[73],"due":[74],"their":[76],"advanced":[77],"capabilities":[78],"in":[79],"knowledge":[80],"reserve":[81],"reasoning.":[83],"In":[84],"this":[85],"work,":[86],"we":[87,131,150],"propose":[88],"GARNET,":[89],"framework":[91],"that":[92,203],"uses":[93,172],"LLMs":[94,125],"reasoning":[96,126,178,183],"on":[97],"graphs.":[100],"GARNET":[101,171,204],"addresses":[102],"three":[103],"key":[104],"technical":[105],"challenges:":[106],"1)":[107],"modality":[108],"alignment":[109,117],"between":[110,118,160],"logs;":[114,122],"2)":[115],"semantic":[116,158],"3)":[123],"enabling":[124],"along":[127,184],"paths.":[129],"Specifically,":[130],"first":[132],"project":[133],"the":[134,137,142,157,161,214,223],"embeddings":[135],"of":[136,211],"logs":[140,164],"into":[141],"same":[143],"vector":[144],"space":[145],"using":[146],"contrastive":[147],"learning.":[148],"Then,":[149],"design":[151],"self-supervised":[152],"graph-log":[153],"instructions":[154],"bridge":[156],"gap":[159],"training":[166],"novel":[168,174],"LLM.":[169],"Finally,":[170],"Graph-of-Thought":[175],"(GoT)-based":[176],"interaction":[177],"approach":[179],"guide":[181],"LLM":[182],"paths,":[186],"ultimately":[187],"generating":[188],"structured,":[189],"Experimental":[196],"results":[197],"across":[198],"six":[199],"scenarios":[201],"show":[202],"reduces":[205],"false":[206,215],"positives":[207],"an":[209],"average":[210],"80%,":[212],"lowering":[213],"positive":[216],"rate":[217],"below":[219],"0.0037.":[220],"It":[221],"outperforms":[222],"latest":[224],"approaches":[225],"provides":[227],"more":[228],"explainable":[229],"attribution.":[230]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-18T00:00:00"}